By Edward Johnson, Associate Director - Head of Global Analysis, Sibylline
Businesses with extensive AI implementation continue to make an erroneous assessment that as long as their cybersecurity is up to date, their passwords are strong, and their code is secure then their data is safe behind a secure wall of protection. The problem is the gates have already been opened to an outsider which can, even with the best intentions, let some of the bad guys in.
What businesses must understand is that AI agents operating inside a company’s infrastructure make it a more accessible target than if it operates without one. In the past year, there have been numerous examples of AI tools leading to company data being exposed, due to vulnerabilities within the AI tool itself.
The Tool Nobody Approved
In April 2026, the cloud platform Vercel disclosed a breach that began at Context.ai, a small developer of AI assistants. Attackers had broken into Context.ai weeks earlier and stolen the access permissions it held on behalf of its users. One of those users was a Vercel employee who had signed up with a work account and granted the tool full access. The attackers used that permission to take over the employee’s Google Workspace account, reach Vercel’s internal systems and collect some customers’ credentials. A seller later advertised the stolen data for $2 million. Vercel’s perimeter was not forcefully breached but door was opened by the member of staff having installed the tool on his laptop, allowing hackers to pose as members of staff to gain access.
What makes this matter particularly interesting is that Vercel had not given the employee permission to use the tool that allowed hackers access into their systems. They simply had no idea that the tool was being used at all. One person’s mistake was enough to give the hackers access. This introduces an entirely different aspect to cybersecurity concerns. Not only is allowing an external AI access to your systems giving hackers an opportunity to break into your systems, but it can also happen entirely without the knowledge of the company that an employee has opened a backdoor. This is shadow AI: the use of unsanctioned or unapproved AI tools on workplace systems. IBM’s Cost of a Data Breach Report 2026 recorded ShadowAI incidents making up 20% of breached companies in 2025 jumping to 43% in 2026.
Leaving the Door Open
In August 2026, a researcher disclosed a flaw at tl;dv, an AI meeting notetaker. Anyone with an account, including a free one, could ask its database for the full list of meetings: 181,874 records from 84,312 users across 35,003 email domains. The records were metadata, not recordings: who was meeting, when, and the links to join. For anyone building a picture of an organisation, that is the valuable part.
The list covered government bodies in 23 countries, universities and corporations, and it sat behind a single missing access rule. Many of those named had no chance to vet the tool, because they were invited to the meeting by another participant. The company says the flaw is now fixed but the lesson stands: tl;dv’s value as a target came from its large pool of customer data without the protection that was required.
Arriving With a Staff Pass
What has changed is how much work an intruder has left to do. In a case of just software being vulnerable, SolarWinds’ software was tampered with in 2020, about 18,000 organisations installed an infected update, yet the attackers went further in only around 100 companies and nine federal agencies, each a separate intrusion. An AI assistant removes that step. To be useful it is given standing access to mail, documents, calendars and customer records, and whoever steals that access inherits all of it. At Vercel, a token taken from an AI tool let attackers act as a named employee. In a different event at Klue, a market intelligence AI company, stored tokens were used to query at least twelve companies’ customer records at once, without cracking a password or facing a login check. The intruder no longer breaks in and looks around but hitches a ride off the back of software which is installed by an employee.
Count the Gates
The more AI variables there are operating in a single system, the greater the uncertainty over cyber security. Although any third-party AI tool operating inside a company system presents some level of threat, making sure there are the minimum number of tools needed which come from verified sources and have been authorised beforehand by the company is the best way to minimise the risk posed by Shadow AI. Employees using unauthorised third-party systems create a company blind spot for potential intrusion with potentially severe consequences.
None of this is an argument against using AI at work. It is an argument for knowing which gates have been opened, and to whom. A company can keep its own walls in perfect repair and still be reached through a tool it never approved, or through a supplier whose defences do not match the value of what it holds. The question for any business is no longer how secure its own systems are but how secure the systems are of every external piece of software it interacts with.
Latest News
