Private AI needs private data and private inference

In July, Satya Nadella wrote that when a company uses AI, "you essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful."¹ A month later Alex Karp told Palantir's shareholders that "our customers have declined to become vassal states of the language labs."²

Both of them sell the alternative, and so do we, so take it with salt. But they're describing something real. Your context, the notes, plans and documents your AI works from, is the thing that makes the AI useful to you. It's also the thing you hand over every time you use it.

TLDR: private AI needs two things. Private data: your context lives in a place you control, where no model trains on it. And private inference: the model that reads it, and writes the answer, doesn't pass it on to anyone. agentleFS gives you the first. For the second you choose, file by file: a frontier AI like Claude or ChatGPT when that's fine, and a local LLM, a model that runs on your own computer, when it isn't. Both read the same folder.

Why the people selling AI say to guard your data

Listen to the people who run the biggest AI businesses and they keep saying the same thing: your data is the part worth protecting.

Karp's letter goes furthest. "Every organization in the world is awakening to the risks of handing the creators of the language models the keys to their institutions," he wrote. What the labs want, in his telling, is "control over data, the prompts that the models ingest, and more fundamentally the organizational and business intelligence, their alpha," which they are "structurally designed to capture from their customers."² On Palantir's earnings call the same week he put it more bluntly: "You are paying for the right for them to migrate your IP, your know-how, your expertise to their model."³

Nadella said it at Davos in January: if a company's know-how ends up inside someone else's model, "you're leaking enterprise value to some model somewhere."⁴ Mark Zuckerberg made the case for open models on the same ground: "Many organizations handle sensitive data that they need to secure and can't send to closed models over cloud APIs. Other organizations simply don't trust the closed model providers with their data."⁵ IBM's research director Darío Gil pointed out that "less than 1% of enterprise data has made it into AI models" so far, which means nearly all of it is still yours to give away or keep.⁶

They each sell something that profits from you agreeing, so weigh it. But when Palantir, Microsoft, Meta and IBM, who agree on little else, all land on the same advice, it's worth taking: the context that makes you good at what you do is the thing to keep.

Is ChatGPT safe for confidential information?

It starts with people, not models. In a survey of 1,000 US employees at large companies, 57% admitted entering sensitive information into public AI assistants, and only 29% said their company had a policy against it.⁷ Cyberhaven's 2026 report puts it at 39.7% of all interactions with AI tools involving sensitive data.⁸

And it has already gone wrong. In 2023 Samsung engineers pasted source code and meeting notes into ChatGPT, and Samsung banned public AI tools, warning staff that what goes in "is stored on external servers, making it difficult to retrieve and delete."⁹ JPMorgan and Verizon restricted ChatGPT that year too, and so did Apple.¹⁰¹¹ In IBM's 2025 breach study, one in five breached organizations had a breach caused by shadow AI, the tools staff use without approval, and those breaches cost about $670,000 more.¹²

Does ChatGPT train on your data? What happens to what you send

Once your text is on a lab's servers, all of these have already happened:

• It can train the next model. On consumer plans OpenAI says "we may use your content to train our models."¹³ In 2025 Anthropic asked Claude users to choose, and keeps chats five years for those who allow training.¹⁴ Business and API plans are off by default at both.
• People can read it. Google says human reviewers read some Gemini chats, keeps reviewed chats up to three years, and asks you not to enter "confidential information that you wouldn't want a reviewer to see."¹⁵
• A court can order it kept, and handed over. In May 2025 a judge ordered OpenAI to keep ChatGPT and API logs it would otherwise delete, deleted chats included.¹⁶ In January 2026 another judge upheld an order to give the New York Times 20 million of them.¹⁷
• It can lose its legal protection. A trade secret stays one only while you take reasonable steps to keep it secret, and lawyers warn that pasting one into an AI prompt puts that at risk.¹⁸ In February 2026 a federal judge ruled that a defendant's chats with consumer Claude weren't privileged, partly because its terms said inputs weren't confidential.¹⁹
• It can leak. A 2023 ChatGPT bug showed some users other people's chat titles, and in 2025 more than 370,000 shared Grok chats turned up in Google search.²⁰²¹

The court order is the one that moved people. On Hacker News, one engineer wrote that it's "the main reason I can't use any LLM agents or post any portion of my code into a prompt window at work. We have NDAs and government regulations (like ITAR) we'd be breaking if any code left our servers."²²

Private AI means private data and private inference

Most advice stops at the first half: keep your files somewhere safe. But a file sitting safely in a folder isn't the risk. The risk is the moment a model reads it. That moment is called inference, the step where a model takes your text and writes its answer, and it's where the text leaves your hands.

Nadella says it plainly: "This requires more than data protection. Models learn from 'exhaust,' the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong."¹ Moxie Marlinspike, who built Signal's encryption, puts it more bluntly: "When you use an AI service, you're handing over your thoughts in plaintext."²³

So what can you do about the second half? There are three ways to make inference private, and each one asks you to trust less:

1. A contract. A business or API plan that doesn't train on your data, or keeps nothing at all. OpenAI's zero-data-retention customers were outside the court order, because "it is not stored."²⁴ You're trusting the lab's word. 2. Sealed hardware. Apple's Private Cloud Compute and Google's Private AI Compute run the model on servers built so that even the company can't read your data.²⁵²⁶ You're trusting the chip maker, and researchers have already pulled keys out of that kind of hardware with a sub-$1,000 device and physical access.²⁷ 3. Your own computer. A local LLM sends nothing anywhere. You're trusting only yourself.

None of this means don't use a frontier AI. A business plan is fine for most work, and most companies still run most of their AI on closed models.²⁸ The better way is to keep the context you own in a place you control, and decide each time which rung it deserves. For the payroll file, the acquisition memo or the customer list, pick the bottom rung, and then nothing you'd regret is sitting on someone else's servers.

A local model doesn't make an agent safe on its own

Here's the part people skip. Simon Willison calls it the lethal trifecta: an agent that can read your private data, read content from strangers, and send messages out. "If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker."²⁹ Bruce Schneier and Barath Raghavan write that the trick, called prompt injection, "might be unsolvable in today's LLMs."³⁰

A local model is just as easy to trick. It removes the lab as a reader, not the attacker. So the fix is to limit what each agent can reach in the first place: give it only the folders its job needs, and then a tricked agent can only leak what was in those folders.

What agentleFS does with your data

• No training. We don't use your content to train or improve any model, ours or anyone else's (privacy policy).
• No model call of ours. Your AI connects with your sign-in and reads what you've given it. Which model reads it is your choice.
• Per-folder permissions. An agent can never reach more than the person behind it, and you can give it less.
• An audit log of who read and changed what. Your search words are kept only as a hash.
• Delete forever destroys our copy. Backups expire within about 90 days.

What we can't promise: once a frontier AI reads a file, that lab has it, under its own terms. That is where a local LLM comes in.

How to run AI locally on your own files

Apps that run open models on your computer can now use a remote MCP server. MCP is the standard way an AI connects to an outside service like agentleFS. Add https://mcp.agentlefs.com/mcp in one of these:³¹

Then ask the local model what you'd ask any AI: Read my pricing notes in agentleFS and draft the email. The answer is written on your computer. No lab sees the notes.

Frontier AI vs a local LLM on the same folder

Use each where it fits: the frontier model for the plan, the local one for the payroll notes. Your context stays yours either way, and you get the best of both without handing over the part that makes you you.

Try it: sign up, install LM Studio or Jan, and add the address above.