WASHINGTON – The analyst at a pharmaceutical company who spent last Tuesday refining drug trial summaries in ChatGPT probably did not think of it as a data transaction. The API was licensed. The contract was signed. But according to Microsoft chief executive Satya Nadella, something significant was leaving the building all the same.
In a blog post published Sunday, Nadella laid out an argument that is as much competitive positioning as genuine warning. Enterprises that route sensitive work through external AI providers are paying a hidden cost, one that most companies have not yet added to their budgets. “You essentially pay for intelligence twice,” Nadella wrote, “once with money, and again with something even more valuable: the proprietary knowledge you must reveal.” The post was directed at enterprise buyers, but its subtext runs straight at OpenAI and Anthropic.
The mechanism Nadella labels “exhaust” is the residue of everyday AI use. Every prompt is a data input. Every time a user corrects a model response, flags an output as wrong, or lets an AI agent execute a task on their behalf, they generate signal. That signal, Nadella argues, enriches the provider’s underlying model, whether or not the provider intends it, and whether or not the enterprise has carefully read the contractual clause that technically prohibits training on customer data. The distinction between what a contract permits and what is technically possible is exactly where his argument lives.
Consider what that exhaust stream might contain in practice. A law firm using Anthropic’s Claude to review acquisition documents is feeding detailed financial structures into the provider’s system. A hospital using a chatbot to draft patient communication templates is transmitting clinical protocols. A software company using an AI coding assistant is exposing proprietary architecture decisions with every accepted suggestion. None of that data matches what the contracts define as “training data,” but it is visible to the provider, and Nadella’s argument is that the structural incentive to learn from it is built into the business model.
OpenAI and Anthropic both publish enterprise terms stating they do not, by default, train on data submitted through the API. Neither company responded to requests for comment on Nadella’s blog post, as TechCrunch reported. Nadella does not accuse them of violating those commitments. He is describing a structural vulnerability: an enterprise is handing over data it would otherwise treat as a trade secret, and doing so at scale, across every employee who opens a chat window.
Several large organizations have already started adjusting. T-Mobile, ADP, and SAP have each made moves toward on-premise AI infrastructure in recent months, deploying models inside their own data centers rather than forwarding sensitive queries to external servers. Two developer platforms, Vercel and OpenRouter, have said they are routing more traffic toward open-source models, which can run locally without any prompt data reaching a third party. The common thread across these decisions is the same: institutional knowledge should stay inside the organization’s own perimeter.
That calculation is increasingly practical because the performance gap between open-source and commercial AI has narrowed considerably. Nous Research’s Hermes open-source AI agent has accumulated more than 214,000 GitHub stars and is reportedly in talks to raise capital at a $1.5 billion valuation, a sign that open-source alternatives have matured enough to attract serious investment. Companies running inference on locally hosted models gain complete custody of their prompts; nothing leaves the network.
Nadella also surfaced a tension that has grown louder in AI legal and policy circles. Major AI providers prohibit enterprise clients from using model outputs to train competing systems, a practice known as model distillation. Those same providers, however, built their flagship models by training on vast public datasets, including content generated by earlier systems. The restrictions, Nadella implies, reflect current market power rather than principled logic, and they were written by the companies that benefit from them.
The argument deserves a closer reading when its source is considered. Microsoft makes money from Azure, the cloud platform that runs on-premise AI workloads. If enterprises become uncomfortable sending sensitive queries to external providers, the most natural alternative involves deploying models on infrastructure that Microsoft sells. Nadella is not wrong that the structural incentive he describes exists. But the blog post does not cite audits, legal proceedings, or disclosed internal practices at any provider. The gap between “the incentive to misuse exhaust data exists” and “exhaust data is being misused” is not filled by anything in his post. Enterprises reading it should register the conflict before acting on the conclusion.
The central question Nadella raises, whether providers are actively profiting from enterprise exhaust in ways that harm their own customers, has no verified answer in public reporting. Enterprise contracts are being renegotiated, on-premise deployments are growing, and open-source performance is rising, all at the same time. But until someone publishes the evidence that proves or disproves Nadella’s core claim, the warning functions as much as a sales argument for Azure as a technical finding about the AI industry.
