It can be unsettling what Gemini and ChatGPT have figured out about you, and how easily your privacy can be punctured. The New York Times Tech article tackles the problem head-on: it shows you how to find out what the systems appear to know based on the prompts you provide.

The point is simple, and it is immediate. Instead of guessing whether an AI chatbot is “just being generic,” you can use prompts to test what it will infer about you. If the model returns personal details you did not explicitly include, you have your answer, and it is not a comforting one.

Zoom out for a second, because this is not only a consumer worry. In the real world, executives are now living with AI tools inside work laptops, customer-support workflows, recruiting pipelines, and marketing systems. Even when a company is not “doing anything shady,” the output of a model can reflect patterns it has seen before, how it interprets language, and what it can plausibly guess from context. That creates a new operational question: not whether the model is malicious, but whether it is revealing more than you intended.

For privacy, the uncomfortable part is that the mechanism does not need to be complicated. A chatbot is designed to be helpful, not quiet. When you ask questions in a way that supplies just enough scaffolding, the system may fill in the blanks. The article’s core value is that it reframes the anxiety into an experiment you can run. You are not relying on fear or rumors. You are running a prompt-driven check to see what the system seems to “know” about you.

That matters because privacy expectations are not static. Over the last few years, regulators and courts have steadily expanded how they think about personal data, consent, and misuse. While the New York Times article is focused on testing what Gemini and ChatGPT can infer, the second-order implication is about governance. If prompt-based probing can extract personal information from AI systems, then compliance teams will increasingly ask for evidence: what data can be inferred, what safeguards are in place, and how risks are mitigated in real deployments.

There is also a vendor dynamics angle. When customers can test a system and demonstrate that it reveals sensitive details, product teams get pressure from both sides. Security leaders want stronger controls. Legal teams want clearer documentation and predictable behavior. And procurement teams can demand tighter terms, like auditability and more specific privacy protections. The article is basically a reminder that opacity is not a strategy. If models can be probed, they can also be evaluated, and that evaluation can show up in contracts.

For boards and executives, the strategic stake is not limited to one tool or one chatbot. It is about how quickly an AI interface can turn into an information-extraction surface. A company that deploys these systems without a testing mindset could get blindsided by user behavior, employee workflows, or customer queries that accidentally supply the right context for a model to infer personal information. In other words, the risk can arrive through normal usage, not “red team” hacking.

The New York Times piece positions the answer as a workflow: use prompts to find out what Gemini and ChatGPT appear to know about you. Read that as a blueprint for internal practice too. If you are responsible for data governance, you should expect that the first wave of operational pressure will come from people doing exactly what the article suggests: checking what an AI system can infer. The winners will treat those checks as part of due diligence, not as an afterthought.