Why staff using ChatGPT, Claude and Gemini for work could create problems for employers

Cybersecurity specialists are warning employers of potential issues that may arise when staff utilize external AI applications, such as Claude, ChatGPT, and Gemini, for work purposes. Known as shadow AI, this practice can result in the leakage of crucial data and, in certain instances, the introduction of malware and viruses into a company's internal systems.

It is crucial for businesses to be aware of which AI tools employees are using when handling sensitive company information, as this could lead to complications with customer data and intellectual property.

When sensitive data is pasted into an external AI application, or even when an AI tool is asked to revise an email, this information is transmitted to a cloud service outside the company. If an employee's personal account is compromised, the company's data could be compromised as well. Vladislav Tushkanov, a research and development group manager at Kaspersky, a cybersecurity company, emphasized that employees may perceive the advantages of completing tasks more swiftly, but employers will not have any record of the systems used or the data received by those systems. He stressed that personally identifiable information should not be transmitted via cloud platforms.

To mitigate these risks, Vladislav suggested that employees should be educated on the importance of using only internal AI systems for processing information. Premchand Kurup, the chief executive of the cybersecurity firm ParamountAssure, echoed this sentiment and recommended that companies identify unauthorized AI usage, establish approved alternatives, and set clear access limits.

The 2026 Middle East Cost of a Data Breach Report by IBM revealed that 26% of malicious breaches were AI-enabled, with the average cost of a breach in the region amounting to $8 million. This report was based on organizations in the UAE and Saudi Arabia.

As AI agents become more sophisticated, monitoring them will present an additional challenge. Agentic AI is expected to perform more tasks with reduced human oversight, raising questions regarding accountability when problems arise. "We can't put AI agents in jail, so ultimately it'll always have to be a human [who is accountable]," Costi Perricos, Deloitte's global generative AI leader, stated.

Businesses will need to manage these agents as a digital workforce, incorporating performance evaluations and determining the extent of responsibility for each system. Perricos emphasized the importance of tracking agent behavior, determining readiness for use, and knowing when to terminate them.

The UAE government aims to introduce agentic AI across 50% of federal sectors and operations within two years, as part of a framework announced in April. Kurup advised that companies should set access limits and enforce AI-assisted security investigations using verified internal records. Employees should be required to provide evidence they can verify before approving sensitive actions, and records should be maintained for review.

Similarly, Ahmed Hafez, the director of solution engineering for the Middle East, Turkey, and Africa at Snowflake, underscored the significance of trusted information and controls over what AI agents can access. As these systems undertake increasingly complex tasks, extensive testing in controlled environments, along with built-in governance and security measures, becomes increasingly vital.