Shadow AI is 'all over the place'

FRED STREEFLAND, CHECKPOINT

Inside a simulated company built by AI security lab Irregular, an agent was asked to fetch a document from an internal wiki. It hit an access denied message, but instead of reporting the problem, it found a secret key hardcoded into the application. It then decoded its own session cookie, forged an administrator's login and collected the file. In a second test, an agent running a backup server found an admin password in an unrelated utility script, used it to switch off Windows Defender and finished a download the endpoint tool had blocked. In a third case, two agents conferred about publishing login details on LinkedIn, then hid the password inside the spacing of the text to get it past the data loss prevention system. Nobody asked the agents to break anything—they were handed an objective, given the tools and left to work out the route for themselves.

For CISOs, AI is a new form of insider risk. But before this becomes a security team's technical headache, it's a governance problem. Fred Streefland, field CISO at Check Point, says there are three principles a CISO should always follow: how the organisation makes its money, gets full visibility, and is in control.