I’ve spent the last few months writing on this blog about building my own home AI system — a supervisor of sub-agents that controls real things in my house: lights, a git server, my email, my health data. Every single write it can make goes through an explicit approval step before anything actually happens, because I learned early and repeatedly that a confident-sounding language model and a correct one are not the same thing, and the gap between them shows up exactly when you’re not watching for it. That project has been a genuinely useful lens for a different question I want to start writing about here: what happens when the entity building the AI system isn’t a hobbyist gating every write behind their own explicit click, but a business plugging one into a CRM, a codebase, or a customer support queue, at a pace that outstrips anyone’s ability to actually think through what could go wrong?
This is the first entry in a series on that question. I’m splitting it into the shape the risk actually takes in practice — security, operational, governance and compliance, and workforce — because trying to cover “AI risk in business” as one topic produces exactly the kind of vague hand-wringing that helps nobody make a real decision. This one is about security, because it’s the part I have the most direct, hands-on intuition for, and because the industry’s own data says it’s currently the sharpest edge.
Prompt injection is the new SQL injection, and it’s winning#
If you’ve followed security for a while, prompt injection should feel uncomfortably familiar. SQL injection happens because a system fails to distinguish between “instructions” and “data” — user input gets concatenated straight into a query and the database can’t tell the difference between a name field and a command. Prompt injection is the same failure, one abstraction layer up: a language model reads its system instructions and the content it’s processing — an email, a webpage, a pull request description, a support ticket — through the same channel, as the same kind of text, and it has no reliable, enforced way to tell “the user asked this” apart from “this document says to do this.” Malicious instructions hidden in whatever the model is asked to read can hijack its behavior just as effectively as legitimate ones.
The industry’s own numbers say this isn’t theoretical anymore. Prompt injection sits at #1 on OWASP’s 2026 Top 10 for LLM Applications for the second year running, and for the first time that ranking was built with real incident data weighted alongside practitioner surveys, not just opinion. NIST has tracked a greater than 2,000% increase in AI-specific CVEs since 2022. Reported prompt injection attacks specifically are up 340% year over year.
And these aren’t hypothetical academic exploits. A vulnerability disclosed as CVE-2025-53773, carrying a 9.6 CVSS score, let a hidden prompt injected into a pull request description achieve remote code execution through GitHub Copilot. “EchoLeak,” found in Microsoft 365 Copilot, was a zero-click prompt injection that could silently exfiltrate enterprise data with no user interaction required at all. A prompt injection aimed at Claude-powered GitHub Actions issue triage led to a compromised npm package that quietly installed a persistent daemon on roughly 4,000 developer machines, harvesting credentials, SSH keys, and cloud tokens along the way. Researchers found a path in Grafana’s AI features — nicknamed GrafanaGhost — that could force the platform to ship sensitive enterprise data to an attacker’s own server through an external rendering flow that had nothing to do with what the feature was supposedly for.
The common thread across all four: none of these required tricking a human. They required tricking the model, once, through content it was already going to read as part of doing its job.
Excessive agency: the risk you create by giving it more to do#
The second-fastest-rising item on that same OWASP list is “excessive agency,” which jumped from sixth place in 2025 to third in 2026 — the biggest single move on the entire list. The plain-language version: the more real actions you let a model take on its own — sending the email, merging the pull request, updating the record, running the command — the more damage a single successful manipulation, or a single confident mistake, can actually cause. A model that can only draft text for a human to review is a very different risk profile than one that can act on its own conclusions.
This is the exact problem I built my own project’s core architecture around, long before I’d have called it by this name. Every sub-agent in my system can propose a write — “here’s what I’d like to do” — but none of them can execute one without a separate, deterministic dispatcher running only what a human explicitly approved, with no model in that second step at all. It’s not a sophisticated defense. It’s closer to the oldest idea in security: don’t let the thing that can be tricked also be the thing that pulls the trigger. But it’s exactly the pattern OWASP is now pointing at as the fastest-growing gap in production AI systems, and I’d bet real money that most of the excessive-agency incidents behind that ranking exist because “let’s give the agent more tools” got approved a lot faster than “let’s also build the approval gate for those tools” did. Capability is fun to ship. Guardrails are boring to ship. Only one of those facts changes the risk.
Shadow AI is the part nobody’s actually watching#
The last piece is less about the model itself and more about what happens when employees route around whatever official AI policy exists — or doesn’t. Recent surveys put the number of employees using unapproved AI tools at work above 80%, with a substantial share admitting they’ve pasted confidential company data directly into a public AI tool. That’s not a hypothetical insider threat. That’s routine Tuesday-afternoon behavior at a huge share of companies right now, happening because the sanctioned tool is slower or worse than the free one, and nobody’s stopped to weigh that tradeoff against what’s leaving the building through it.
IBM’s 2026 Cost of a Data Breach report is the number I keep coming back to on this: shadow AI was a contributing factor in 43% of the breaches it studied, up from roughly one in five the year before — more than doubling in a single year. Organizations with high levels of shadow AI use paid an average of $670,000 more per breach than organizations with little or none. And here’s the part that should actually worry a CISO more than the raw numbers: among the organizations that got breached through AI, the share that had any AI governance policy in place at all fell, from 37% to 32%. That’s backwards from what you’d want to see. It suggests governance isn’t keeping pace with adoption even at the exact organizations already getting burned by the gap.
Where this leaves things#
None of this is an argument against using AI in a business context — I’d be a fairly unconvincing messenger for that position, given what I spend my weekends building. It’s an argument for treating “we added an AI feature” with the same seriousness as “we opened a new network port,” because that’s structurally what’s happening: a new channel into your systems and your data, with a still-immature set of default protections around it, being adopted faster than most organizations’ security posture is adapting to match. Prompt injection means the content your AI processes is now part of your attack surface, not just its own instructions. Excessive agency means every new capability you hand it is a lever someone else might eventually pull instead of you. Shadow AI means the actual boundary of your AI exposure is wider than whatever’s on your approved-tools list, whether anyone’s accounted for that or not.
Next up in this series: operational risk — what happens when the AI isn’t attacked at all, just wrong, and a business makes a real decision on top of that anyway. After that, governance and compliance, and where the actual liability lands when an AI system causes harm nobody explicitly authorized. And eventually, the workforce question, which is the one I suspect people actually care about most and are least honest with themselves about.