AI and human risk: the threats arising from behaviour

AI creates new behavioural risks: sensitive data in chatbots, more convincing phishing, and decisions delegated to algorithms. How to manage human risk in the age of AI.

June 12, 2026 · 6 min

There is a lot of talk about how AI makes attacks more sophisticated. There is far less talk about how AI is creating new behavioural risks, which arise from the way people use it every day. It is here, not in the attacks themselves, that much of the risk lies.

Data leaving the company

The most common risk is also the most trivial: someone pastes sensitive data, code or confidential information into an AI chatbot to save time. That data then slips out of the organisation’s control. There was no attack: it was simply a behaviour, repeated by many people, every day.

Organisations are concerned about the data generated by generative AI, but many do not yet have a strategy for dealing with people’s behaviour.

Phishing you no longer recognise

AI has made social engineering attacks more convincing: error-free emails, personalised messages, convincing impersonations. The tell-tale signs people had grown accustomed to relying on (grammatical errors, odd tone) no longer work. We need to behave differently – it’s not just a matter of being more vigilant.

Decisions delegated to the algorithm

A more subtle risk concerns those who use AI to make decisions: assessments, selections and prioritisation. Delegating to an algorithm does not remove responsibility, and an algorithm can introduce errors or biases that no one checks. The decision remains a human one, even when suggested by a machine.

Managing human risk in the age of AI

The answer is not to ban AI, but to train people to use it without creating risks: knowing what never to copy and paste, recognising new forms of attack, and retaining human judgement where it matters. It is human risk, in its newest form.