The biggest AI security risk is doing nothing

On September 14th, 2026, AI frontier lab OpenAI called on UK lawmakers to impose regulations to tackle the security threats posed by the rapid development of artificial intelligence .

This follows an unsolicited attack from an OpenAI agent that broke the firewalls of startup Hugging Face earlier this year.

Cybersecurity isn’t a new issue for business leaders, but its significance is increasing in the age of AI.

Clients trust them with information, employees don’t want to disclose their salaries or investors don’t want to make their investments public.

Without clear governance and processes on the use of AI, these are all at risk of being leaked.

Doing nothing poses an existential risk for firms.

A new class of security risks AI presents great opportunities to speed up repetitive tasks, like data reporting, leaving more time for employees to produce more strategic, quality work for clients.

For an agent to become useful, it needs as much context and information access as possible, but this is where there is the greatest potential for something to go wrong if not managed correctly.

For instance, agents may have access to bookkeeping, reporting, document management and CRM systems, meaning a successful attack could expose highly sensitive client information.

The main issue is LLMs have difficulty distinguishing data from instructions.

An agent can interpret instructions from an email, a document or a webpage, even if those are malicious.

These are called prompt injection attacks.

Basically hackers manipulate generative AI systems by feeding them with malicious inputs disguised as legitimate user prompts.

Another threat is data leaking.