Lists of AI security risks tend to be written for companies that build their own AI models. Most small and mid-sized businesses don’t. They use AI: chatbots, note-takers, Copilot, Gemini, and a growing number of agents. The risks that matter to them are about what that AI can see, who owns it, and what attackers do with it.
Here are the seven AI security risks worth your time in 2026, what each looks like in a real business, and the one thing that cuts it most. Every figure names its source.
1. Company data in personal AI accounts
Staff paste client documents, figures and emails into AI tools signed in with their own accounts. The company can’t see that data, keep it or delete it.
- 67% of people using AI services on corporate devices did so from non-corporate accounts. (Verizon 2026 Data Breach Investigations Report)
- 34% of office professionals had entered customer data into public AI tools. (PagerDuty Shadow AI survey, June 2026)
What cuts it: approve a work account for the tools people really use, and see how much goes into the rest. Our shadow AI statistics post has the full numbers.
2. AI apps with standing access to mail and files
One click on “Allow” gives an AI note-taker, writing assistant or scheduling tool lasting access to a mailbox, calendar or drive. That access stays after the person stops using the app, and often after they leave. Each grant is an OAuth grant someone approved once and nobody reviews.
What cuts it: list every AI app connected to Microsoft 365 or Google Workspace, see what each can reach, and remove what nobody has used in 90 days.
3. AI assistants that surface what was overshared
Microsoft 365 Copilot and Gemini can find anything a person can already open. In most businesses that’s far more than anyone thinks: payroll shared with everyone, old contracts in open sites, HR notes in a team folder. The AI doesn’t create the problem. It makes old sharing mistakes easy to find. See what Microsoft 365 Copilot can see.
What cuts it: fix “shared with everyone” folders and sites before you switch AI assistants on, and keep checking after.
4. AI agents with no owner and too much access
Agents built in Copilot Studio, Gemini or other tools read mail, move files and call other apps on their own. Many run on a shared admin account or a person’s own login, so nobody can say what they’re allowed to do or switch them off quickly.
- Of organisations that had a breach involving AI, 92% lacked proper access controls on their AI. (IBM Cost of a Data Breach Report 2026)
- Fewer than half of organisations are actively securing non-human identities. (IBM 2026)
What cuts it: give every agent its own identity, a named owner and a review date. See AI agent identity and non-human identity.
5. Prompt injection
An attacker hides instructions in an email, a web page or a shared document. When an AI assistant or agent reads it, it may follow those instructions, for example by summarising a mailbox to an outside address. OWASP lists prompt injection first (LLM01) in its 2025 Top 10 for large language model applications. (OWASP GenAI Security Project)
What cuts it: limit what each agent can reach and do, so a tricked agent can’t do much harm, and watch what agents actually do, not just what they’re set up to do.
6. AI-powered attacks on your people
Attackers use AI to write better phishing emails, clone voices and move faster once they’re in.
- One in four malicious breaches was AI-enabled, up 56% in a year, and those breaches cost about $6 million on average. (IBM 2026, 602 organisations, March 2025 to February 2026)
- The FBI counted more than 22,000 complaints involving AI in 2025, with losses above $893 million, including more than $30 million in business email compromise that used AI. (FBI IC3 2025 Annual Report)
What cuts it: the basics matter more, not less. That means MFA everywhere, fewer admins, and a phone call to confirm any payment or bank-detail change. A convincing email is no longer a sign that it’s real.
7. AI nobody is watching at all
The common thread in risks 1 to 6 is that nobody has the list. Only 40% of organisations used access controls on AI models and data. (IBM 2026) You can’t set rules for AI tools you don’t know about.
What cuts it: one register of every AI tool, app and agent, each with an owner, what it can reach and a review date.
A worked example: a 140-person law firm
This is an illustrative example, not a real client.
In one month, the firm’s IT provider finds:
| Risk | What they found | Fix |
|---|---|---|
| Personal AI accounts | 19 people use ChatGPT, 12 on personal accounts, pasting draft letters | Approve a work account and tell people |
| AI app access | A meeting note-taker reads 31 mailboxes; its sponsor left in spring | Revoke it |
| Oversharing | A “Litigation” site is open to the whole firm | Limit it to the case team before Copilot goes live |
| Ownerless agent | An intake agent runs on a shared admin account | Give it its own identity and an owner |
| AI-powered phishing | A cloned-voice call asks accounts to change a supplier’s bank details | Confirm by phone on a known number |
Lawyers also have their own guidance here: ABA Formal Opinion 512 (July 2024) says lawyers should understand the risks before putting client information into generative AI tools.
Checklist
- Every AI tool, AI app and agent listed, with an owner.
- Work accounts approved for the AI tools people actually use.
- AI apps with mail or file access reviewed, and unused ones removed.
- “Shared with everyone” files and sites fixed before AI assistants are switched on.
- Each AI agent on its own identity, with limits and a review date.
- MFA everywhere, and payment changes confirmed by phone.
- Someone watching what AI tools and agents actually do, not just how they’re set up.
How Centeye helps
Centeye Lumen, the AI governance and registry platform, finds the AI tools and AI apps in use and what each can reach. It puts each one in a register with an owner, and coaches, blocks or revokes on your rules. Centeye Synthwatch (early access) gives every AI agent an identity, an owner and an off switch, and shows what each one can reach and actually did. To see where one tenant stands today, run the free AI Exposure Check.
Frequently asked questions
What are the biggest AI security risks for a small business?
Company data going into personal AI accounts, AI apps with standing access to mail and files, AI assistants surfacing overshared files, and AI agents with no owner. AI-powered phishing raises the stakes on all of them.
Is Microsoft 365 Copilot a security risk?
Copilot only shows people what they can already open. The risk is that most businesses have overshared files that Copilot makes easy to find. Fix the sharing first and keep checking it.
What is prompt injection, in plain terms?
Hidden instructions in an email, page or document that an AI tool reads and may follow. OWASP ranks it first in its 2025 Top 10 for large language model applications.
Where should we start?
Make one list of every AI tool, AI app and agent in use, with an owner for each. Most of the other fixes follow from that list.
Figures from the Verizon 2026 Data Breach Investigations Report; the PagerDuty Shadow AI survey (June 2026, Wakefield Research, 1,250 office professionals); the IBM Cost of a Data Breach Report 2026 (Ponemon Institute, 602 organisations, March 2025 to February 2026); the FBI IC3 2025 Annual Report; and the OWASP Top 10 for LLM Applications 2025. ABA Formal Opinion 512 was issued in July 2024. The worked example is illustrative. Microsoft 365, Copilot and Copilot Studio are trademarks of the Microsoft group of companies. Google Workspace and Gemini are trademarks of Google LLC. ChatGPT is a trademark of OpenAI.