Your financial data’s no longer your company's most valuable asset. That distinction now belongs to your AI model exhaust: the record of every correction, override and judgment call your people feed an AI agent. Yet most companies hand it to frontier AI vendors without much thought, like some kind of donation, unaware they’re jeopardizing the same competitive edge they're trusting AI to help them fortify.
Key Takeaways
- Model exhaust captures how your business reaches decisions, and that method is the one asset a competitor can’t purchase at any price.
- The governance reflex that made finance leaders interrogate cloud architecture 15 years ago still isn't consistently aimed at AI trace data.
- Opt-out settings leak in places most executives have never looked, and a single feedback click can send an entire conversation into a vendor's training pipeline for five years.
- When every company in an industry runs the same models sharpened by the same corrections, differentiation collapses toward price.
- A deliberate multi-model strategy, governed like financial reporting, lets you use frontier AI where it’s safe and keep your operating logic where it belongs.
What is model exhaust, and why does it outrank your financial data?
Model exhaust is the trace data from AI sessions that records how your people make decisions. It outranks financial data because a ledger describes outcomes while model exhaust describes methods, which is the part of your business a competitor could never buy on the open market at any price.
I spent the first decade of my career building ERP software at Oracle, and back then, if you wanted to sell cloud-based financial software to a CFO, you didn't get to talk about features. You were asked about architecture. Multi-tenant or single-tenant? Who else sits on that hardware? What happens if an engineer fat-fingers a config at two in the morning?
I had that same conversation hundreds of times. Many CFOs wanted us to sign non-disclosure agreements before they'd evaluate in any way whether our software would fit their requirements. But they weren't being paranoid. They were doing their job.
Yet those same people now paste claims logic, revenue models and board material into whichever AI window loads fastest.
I think about that a lot when, for instance, I watch an insurance adjuster correct an AI agent by telling it to flag a claim differently. Five years ago, that correction happened in a hallway or over a desk divider, or not at all. Now it's structured, timestamped and machine-readable. And in most configurations, that correction goes right to the AI vendor.
Why do executives who guarded financial data now give away AI trace data?
Executives who guarded financial data in 2012 now give away AI trace data because the security threat arrives disguised as a productivity tool. This camouflage leaves those same leaders protecting the ledger while handing over the reasoning that produced it.
Microsoft CEO Satya Nadella made this argument himself in July 2026, writing that companies pay for intelligence twice, once in cash and again in the proprietary knowledge they surrender to make the model useful.
Now, I want to be careful here. Nadella runs a cloud business, and the fix he proposes happens to be a cloud business. The self-interest is sitting right there on the table. But he's also describing the mechanism accurately, and a correct observation doesn't stop being correct because the person making it has something to sell.
So how real is it? In September 2026, after OpenAI announced a Navier–Stokes proof, two mathematicians who had used the company's tools on related work raised questions about credit. OpenAI denied its researchers saw their work, but the company also conceded it cannot rule out that de-identified data from the mathematicians’ product usage helped improve its models.
How does model exhaust leak after you switch off training?
Model exhaust leaks through the subtle AI settings nobody reads and the employees nobody tracks. A thumbs-up or thumbs-down on a Claude conversation, for example, permits training on that entire conversation and preserves it for up to five years, which means a helpful click from a junior analyst quietly overrides the privacy policy you thought you’d set for your whole company.
Read that twice. Anthropic's own documentation confirms that explicit feedback allows it to use your chats and coding sessions for training and that a rating preserves the full related conversation for five years. It's true that Team and Enterprise administrators can switch that off with the "Rate chats" setting, but most haven't because most have never even heard of it.
I'm not trying to pick on one AI vendor here. I'm pointing at a whole category of data leakage that’s not covered by your acceptable use policy for AI.
And that’s only for the AI usage you know about. Rate-limiting your sanctioned tool to control spend simply relocates AI usage to personal accounts, past your logging, into consumer plans with consumer-grade data security defaults. The cost from that shadow IT is measurable, with IBM's 2026 Cost of a Data Breach Report putting the global average around $5 million. (The report also found shadow AI incidents climbing from 20% to 43%, with 68% of breached organizations running no AI governance policy at all.)
Where does the race to the bottom start when everyone shares the same model exhaust?
When everyone shares the same model exhaust, the race to the bottom starts the moment your advantage lives inside a model your competitors also rent. Once the same agents handle claims, underwriting and service across an entire sector, sharpened by everyone's corrections at once, the only variable anybody has left to compete on is price.
Picture 20 insurers running identical reasoning, each one having donated its own edge cases to the training pool. What exactly do you say in a pitch? You can't claim better service because your competitor is using the same agent. An agent that’s trained partly on your people's work.
Which workloads belong on frontier models, and which belong on private AI?
The workloads that belong on frontier AI models are ones where the input is public, and the output isn't your operating logic. Use private AI models if the model exhaust would teach an outsider how your business runs and thinks.
That distinction means the test is what the trace reveals about your method, not how sensitive the input file happens to look, as I explain in this table.
(For those of you wondering “if we push core work onto open-weight models, won't we be settling for subpar results?”, Epoch AI tracks open-weight models trailing frontier closed models by an average of only four months, an eight-point gap on its capabilities index. Only four months. I don’t consider that to be a difficult trade when it comes to workflows where secure control of the trace matters more than the last few benchmark points.)
How can we govern AI trace data the way we govern financial data?
To govern AI trace data the way you govern financial data, you need to classify it, route it, contract for it and audit it using the discipline you already apply to financial reporting.
- Classify every workflow by what its trace would teach a competitor, not by how sensitive the input looks.
- Route each tier to a named destination: frontier model, managed private deployment or air-gapped environment.
- Negotiate training, retention and feedback terms into your data processing agreement before the pilot starts.
- Disable feedback and rating features on enterprise plans (and train your people on what those buttons actually trigger).
- Give employees enough sanctioned capacity that nobody needs a personal account to finish the week.
- Audit your AI routing quarterly, the same way you audit financial controls.
Now, be sure to notice what I didn't include in that list. I’m not telling you to ban frontier AI (there’s a place for it...). I’m not recommending you slow anyone down (no one has time for that...). And I’m not suggesting you form a special AI governance committee (don't get me started on committees...).
What I'm saying is that cloud technology eventually won because somebody did the hard, boring work of governing it first. That CFO in 2012 wasn't trying to stop the cloud; she was trying to understand where and how her sensitive data would live physically within it before she bet her job on it.
Nobody is doing that hard work for AI model exhaust yet.
But everyone needs to start.
FAQs
What is “model exhaust” or “AI model exhaust?”
The phrase “model exhaust” or “AI model exhaust” means the continuous trail of digital prompts, tool calls, human corrections, rejected outputs, evaluation results, feedback ratings, metadata and other user context generated during AI sessions that unintentionally exposes your sensitive organizational information to public consumption and model retraining.
Does opting out of training in a frontier AI model fully protect my company's data?
Opting out of a frontier AI model’s training as part of your organization’s privacy setting does not fully protect your data because that setting governs only model training; it doesn't apply to any special retention rules and feature-level exceptions that may exist.
Anthropic's own documentation, for example, states that users who click the thumbs up or thumbs down icon below a chat give Anthropic permission to use that entire conversation for model training (and preserve it for up to five years!), even if their employer’s company-wide privacy toggle is set to exclude company data from Anthropic’s model training.
How can I stop employees from using unsanctioned AI tools (shadow AI) without blocking AI entirely?
You can stop employees from using unsanctioned AI tools by giving them an approved path to (and enough tokens for) AI that's faster and more relevant than any workaround. Rate limits and bans push employees onto personal accounts and other unsanctioned tools, which is the exact outcome you want to prevent.
Who in my organization should be responsible for and own AI trace data and AI model exhaust?
Whoever owns data governance at your company should be responsible for and own your AI trace data and AI model exhaust because the classification, contracting and audit discipline pointed as this new category of asset should be identical to what that team already applies to financial data and customer records.
Is the threat from AI model exhaust real, or is it just vendor scaremongering?
The threat from AI model exhaust risk is real and documented, not hypothetical. In the Navier–Stokes mathematical dispute, for instance, OpenAI publicly conceded it couldn't rule out that de-identified customer usage data had improved its models. While we can argue about how often that kind of thing happens at scale, the mechanism still holds true.
Is enterprise AI safer than consumer AI?
While enterprise AI plans carry stronger default data protections than consumer plans (including narrower training permissions and clearer contractual terms), enterprise AI protections still don't eliminate data risk. It's because employees frequently use consumer-grade AI tools in addition to/instead of their sanctioned AI tools, and innocent user activity can unwittingly override a company-wide model training opt-out setting.
Do open-source AI capabilities lag far behind frontier AI capabilities?
Open-weight models trail frontier closed models by only an average of four months according to Epoch AI's capabilities index. We believe the complete control you gain over your trace data and core operational data via private AI far outweighs the four months of frontier-model capability lag.
