The biggest AI security risk is doing nothing

Date:
Thu, 22 Oct 2026 10:36:26 +0000

Description:
The existential risk of doing nothing about AI is bigger than the risk of doing it badly.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter On September 14th, 2026, AI frontier lab OpenAI called on UK lawmakers to impose regulations to tackle
the security threats posed by the rapid development of artificial
intelligence . This follows an unsolicited attack from an OpenAI agent that broke the firewalls of startup Hugging Face earlier this year. Ken
Bastiaensen Social Links Navigation

CTO & Co-Founder at Ravical. Cybersecurity isnt a new issue for business leaders, but its significance is increasing in the age of AI. Clients trust them with information, employees dont want to disclose their salaries or investors dont want to make their investments public. Without clear
governance and processes on the use of AI, these are all at risk of being leaked. Doing nothing poses an existential risk for firms. Latest Videos From TechRadar Watch full video here: A new class of security risks AI presents great opportunities to speed up repetitive tasks, like data reporting,
leaving more time for employees to produce more strategic, quality work for clients. For an agent to become useful, it needs as much context and information access as possible, but this is where there is the greatest potential for something to go wrong if not managed correctly.

For instance, agents may have access to bookkeeping, reporting, document management and CRM systems, meaning a successful attack could expose highly sensitive client information. You may like Agentic AI is increasing the pressure on organizations to reduce cyber risk exposure Why employees, not threat actors, are 2026s biggest risk Why agentic AI demands a new approach
to enterprise security

The main issue is LLMs have difficulty distinguishing data from instructions. An agent can interpret instructions from an email, a document or a webpage, even if those are malicious. These are called prompt injection attacks. Basically hackers manipulate generative AI systems by feeding them with malicious inputs disguised as legitimate user prompts.

Another threat is data leaking. An agent can visit a website or perform a web search and potentially release confidential information, for example by incorporating company data into a URL or a search query. This could expose sensitive data to the Internet without the company or the agent noticing. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro
newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The risk becomes particularly acute when three things come together: an agent receives untrusted inputs, accesses sensitive information and takes action in external systems the so-called Lethal Trifecta. A malicious instruction hidden in an email, document or webpage can potentially trigger actions at a later point using the agent's legitimate permissions.

Therefore, firms need to set strict guardrails around each agent to limit
what data it can access, what capabilities it has and what actions it is allowed to take. This is essential to avoid information leaks or an AI agent going rogue. The threat sitting inside a company AI adoption is scaling
across all levels of a business, from finance to marketing, sales to product development. New research from Turbotic shows 51% of business leaders fear employees are feeding sensitive company data into unauthorized AI tools and 36% are concerned about employees using AI without oversight. This is called Shadow AI. What to read next AI agents dont create new risk. They inherit it AI agents are inside the enterprise are your security foundations ready for them? Rogue AI agents arent flukes, theyre patterns

When an employee prompts a public AI platform, it leaks sensitive client information and receives output that looks confident but could be inaccurate. This could lead to inconsistent tone, misaligned advice or data breaches. The problem isnt the technology itself, but its the lack of traceability and
human review. Placing too much confidence in AI tools without the right guardrails is dangerous.

Most of the time, employees dont even realize the security issues that
pertain to AI usage.

They need to understand that experimentation outside any approved workflow or data safeguard is a security risk. Sharing sensitive information with a
public model or using content generated by AI without reviewing it risks greater exposure to compliance breaches, AI slop and reputational damage.

Most importantly, employees become responsible for output they cannot
explain, verify or trace.

To remove this risk, leaders need to democratize AI by giving employees
access and clear guidance on the tools theyre allowed to use, how to provide the right context to AI agents, set up processes to review AI output and establish any guardrails to prevent data breaches. This approach that we call Organizational AI will make a firm more capable from security and capacity perspectives. Managing the risks of AI Despite increasing warnings about AI security threats, fewer than 1% of organizations have fully operationalized responsible AI, according to a report from the World Economic Forum and Accenture.

Given the risks associated with free AI usage, having a responsible AI policy is now obligatory.

Without restrictions on basic access controls, employees may be able to use
AI to surface information they shouldnt have access to, from colleagues salaries or confidential investor data. Once an AI agent is connected to an organization's data, weak permissions are a liability and it can more easily surface accidental access.

Anything that relates to company data, client communications, or that influences professional advice needs to be controlled by clear governance.
Its the responsibility of leaders to provide employees with auditable and transparent boundaries, and step one involves providing clear guidelines on what, when and how AI tools can be used. Then comes explainability combined with governance and oversight to generate trust. The critical need for Organizational AI Firms need to get the fundamentals right: What data can AI access? Where does the input come from? What systems can it connect to? What actions is it allowed to take? When must a human review or approve the
output? All of these should be clearly communicated to employees and baked into processes.

Organizational AI is implementing a system that runs across the whole firm that the organization can grow into for a better client experience, team development and security management.

Companies should start now. The existential risk of doing nothing is bigger than the risk of doing it badly. We've featured the best AI website builder. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/the-biggest-ai-security-risk-is-doing-nothing


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)