What are the cyber risks of using AI?

Short answerAI brings a few new risks, such as hidden instructions in documents that trick the AI, and it makes some old ones easier for attackers, such as convincing phishing emails. None of them is a reason to stay away from AI. Each has a practical control, and two that help early are limiting what the AI can reach and keeping a person approving anything that matters.

Security bodies such as OWASP, the UK NCSC and ENISA publish practical guidance on AI risks.
Prompt injection, including instructions hidden in emails or web pages, is the risk to understand first.
The more an AI can do on its own, the more a mistake or an attack can cost: limit its access and its actions.
Staff using unapproved AI tools can be a bigger day-to-day risk than any clever attack.
Attackers use AI too, so payment and password requests need checks that do not rely on spotting bad grammar.

On this page:Where the guidance comes from Risks that come from the AI tool itself Risks that come from how people use it Risks from attackers using AI

Where the guidance comes from

You do not need to invent your own list of AI risks. Several respected bodies publish one, free of charge:

The OWASP Top 10 for LLM Applications 2025 lists ten security risks for applications built on large language models (the technology behind tools such as ChatGPT, Claude, Copilot and Gemini). Prompt injection is number one.
The UK National Cyber Security Centre published Guidelines for secure AI system development in November 2023, covering secure design, development, deployment, and operation and maintenance.
In April 2024 the US National Security Agency, with CISA, the FBI and the national cyber agencies of Australia, Canada, New Zealand and the UK, published joint guidance on deploying AI systems securely, aimed at organisations that use AI built by others.
The EU cybersecurity agency ENISA published a Multilayer Framework for Good Cybersecurity Practices for AI in June 2023, which starts from ordinary cybersecurity foundations and adds AI-specific layers on top.

A common thread runs through all of them: AI is software, so normal security still applies, plus a few new habits.

Would it help to map which of these risks apply to the AI your teams already use? Book a free AI Value Briefing and we will look at it with you.

Risks that come from the AI tool itself

Prompt injection. Text the AI reads can try to give it orders. In direct injection a user types it; in indirect injection it is hidden in a document, email or web page the AI is asked to read, as OWASP explains. Control: give the AI the least access it needs, label outside content as untrusted, and require a person to approve high-risk actions.
Data leakage. Confidential or personal information can end up in a tool, a chat history or an answer shown to the wrong person. Control: use approved business accounts, keep a short never-paste list, and tidy file permissions before connecting AI to them.
Insecure output handling. If AI output is passed straight into another system, such as a website, a database query or a script, it can carry an attack with it. OWASP advises treating the model like an untrusted user. Control: check and clean AI output before any system acts on it.
Excessive agency. An AI agent with more tools, permissions or freedom than it needs can do real damage when it misunderstands or is manipulated. Control: OWASP recommends fewer tools, narrower permissions and user approval for high-impact actions.
Supply chain. Plug-ins, connectors, models and code from third parties can be weak or malicious. Control: use only components your IT team has reviewed and approved, and keep a list of what is installed.

Risks that come from how people use it

Shadow AI means staff using AI tools the organisation has not approved, often a free personal account, because the approved option is missing or slow. It is rarely malicious, but it puts company data in places nobody has checked.

Control: offer a sanctioned tool that is good enough for real work, publish a short list of what is approved, and make it easy to ask. Banning AI without an alternative tends to push use out of sight rather than stop it.

Over-trust is the quieter risk: AI can state wrong things confidently. Control: a named person checks anything that leaves the building or affects someone's job, money or rights.

Risks from attackers using AI

The NCSC assessed in January 2024 that AI gives attackers a capability uplift in reconnaissance and social engineering, and that generative AI can produce convincing phishing lures without the spelling and grammar mistakes people used to rely on. Cloned voices and fake video can make a request seem to come from a manager or supplier.

Controls that do not depend on spotting a fake:

Verify any request to pay, change bank details or reset a password through a second channel you already know, such as a call-back to a saved number.
Require two people for payments above a threshold.
Use phishing-resistant sign-in, such as security keys or passkeys, where your systems allow it.
Refresh awareness training with AI-made examples, so staff see what a polished fake looks like.

What to do next

Write down which AI tools are approved, what data they may hold, and share the list with every team.
For each AI tool or agent, list what it can read and do, and switch off anything it does not need.
Add a call-back or second-person check for payments and bank detail changes, whatever channel the request arrives through.

Goes deeper in our free AI Field Guide: 9. Checking AI output before you use it, 10. Data safety: what never to paste, and other rules, 13. Connectors and integrations: letting AI use your tools safely, 19. AI that acts for you: browser and computer use, 26. Guardrails and permissions: what AI may and may not do. Ask for these guides.

Talk it through with us

Tools and data rules are agreed with your IT team before anything starts, so your people learn to use AI inside clear limits and keep a person checking the result.

Book my AI Value BriefingA conversation, not a pitch. We will not ask for confidential data. How we handle your details.

Jacques Mouton, founder of Synapse Fusion. Leads AI adoption programmes that turn AI spend into hours back. About Jacques.
How this page was made: researched and drafted with AI assistance from the sources below, each opened and checked on the date shown, and reviewed against our editorial rules.