How to Protect Your Company From AI Risks: Practical Tips in Light of the Latest Warnings

You protect your company from AI risks with seven steps: know every AI tool and agent running in it, give each agent its own account with the least access possible, require human approval before any payment, deletion or message to customers, keep customer data out of unapproved tools, patch internet-facing systems within days, verify money requests through a second channel, and review what your insurance covers. These steps come from the warnings of October 2026: Microsoft urged companies to treat agents as insiders that can make mistakes or be manipulated; the two PHP2Shell flaws, one of them found with an AI model, joined the list of actively exploited vulnerabilities 5 days after disclosure; and Anthropic's IPO filing warned that its models may behave in ways no user or developer intended.

What are the latest warnings, and why do they concern your company?

In less than a month, warnings came from the companies that build AI models and from government cybersecurity agencies. These are the main ones, in the order they came out:

What these warnings share is that AI raises the risk from two directions: from outside, because attackers now find and exploit flaws faster, and from inside, when a tool or an agent gets more access than it needs. OpenAI, which led the coalition that responded to the PHP flaws, calls them one of the most impactful security issues in recent memory and says "the same capabilities can also help attackers rapidly develop offensive tools and exploits". It expects similar findings "to increase sharply in the coming months". Anthropic's IPO filing adds that "bad actors have already conducted high-profile cyberattacks using AI's capabilities to discover vulnerabilities, generate malware, and evade detection tools".

How do you protect your company? 7 practical tips

1. Know every AI tool and agent running in your company. Microsoft puts it plainly: "You cannot secure what you cannot see." It has extended its tools to detect 60 types of agents running on employees' devices, including Claude Code, OpenAI Codex and GitHub Copilot, because some arrive on devices without any central deployment. Start with one sheet listing each tool, who uses it, what data it reaches, whether the account is personal or a business account, and who owns it. That same sheet is the starting point of SDAIA's national AI risk management framework.
2. Give each agent its own account and the least access possible. Microsoft's example is an agent that reviews expense claims: it needs to read the claims and the company policy, but it should not inherit every permission of the employee who set it up. Microsoft recommends that an agent begin with no authority, receive only what the task needs and only for as long as the task lasts, and that higher-impact actions require verified human approval. In practice: do not connect an agent to the manager's account, do not hand it the company's bank password, separate read access from write access, remove forgotten keys in code and settings that open more than it needs, and keep a way to stop it at once. Satya Nadella, Microsoft's chief executive, sums it up: "The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least."
3. Do not let an agent act on what it read in an email, a file or a web page without review. Anthropic's IPO filing defines prompt injection as an attack in which malicious instructions are embedded in content a model is asked to process, such as websites, documents or tool outputs, to manipulate its behavior, typically without the user's knowledge. An agent that reads customer email and can transfer, delete or send may carry out an order an attacker wrote inside a message. Microsoft describes the same scenario: the expense agent may meet a prompt injection in an external document, and its behavior changes although its configuration has not. Make every step that moves money or data out of the company pass through an employee's approval, especially after the agent has read content from outside. We saw the same risk with coding agents that run an attacker's command as soon as you open the project.
4. Keep customer data out of unapproved tools. According to the OpenAI Help Center, OpenAI does not by default use inputs or outputs from ChatGPT Business, ChatGPT Enterprise or its API to improve its models, while content from the individual Free, Plus and Pro plans may be used for training unless the user turns it off in settings. Anthropic says it does not by default train on inputs from its commercial products, such as Claude for Work and its API. So standardize on business accounts, and tell your staff in writing what never goes into any tool: customers' personal data, contracts and passwords. If you put customers' personal data into an AI tool, its provider processes that data on your behalf, and Article 17 of the implementing regulation of the Saudi Personal Data Protection Law requires you to choose a processor that offers sufficient guarantees, under an agreement that sets the purpose and duration of processing and the processor's duty to tell you about any leak. If a leak may harm the people concerned, Article 24 requires you to notify the competent authority within 72 hours of learning of it.
5. Patch internet-facing systems within days, not weeks. Fortinet says AI tools now help attackers reverse-engineer patches and build working exploits "in hours or days, rather than weeks", and that "the window between disclosure and exploitation continues to shrink". Anthropic says exploits can now be developed in minutes. That is why, for the PHP2Shell flaws, CISA asked for clear steps: inventory every system running PHP, patch immediately starting with internet-facing systems, and take offline whatever cannot be updated until it is, noting that a web application firewall (WAF) may give some protection in the meantime. The Saudi National Cybersecurity Authority issued an alert recommending that affected products be updated. Apply the same rule to every exposed system: the website, the firewall, the VPN and email. Details are in our articles on the PHP2Shell flaw, the new Linux vulnerability and FortiGate firewalls.
6. Verify any request for money or data through a second channel. In their awareness campaign on deepfakes, SDAIA and the Communications, Space and Technology Commission say that "seeing someone in a video or hearing their voice is not proof that they said it", and list financial losses and scams, breaking into verification systems and identity theft among the risks. So never transfer money or send data on the strength of a call, a voice message or a video, even if the voice sounds like the manager's. Call the person back on the number you already have, and require two signatures for any transfer above a limit you set. We covered the layers of protection in our article on deepfakes and AI fraud, and how to close every route that moves your company's money without your signature in the lesson of the Binance hack.
7. Review what your insurance covers and what your suppliers' contracts say. Anthropic's IPO filing states: "Because our models may behave in ways that no user or developer intended, claims arising from such actions could result in substantial liability." It adds that its insurance policies may not provide sufficient coverage, and that "the insurance market for AI-specific risks is nascent and evolving". If that is the position of the company that builds the model, ask your insurer in writing: does the policy cover a data leak caused by an AI agent, or a fraudulent transfer made with a cloned voice? And ask every tool provider where your data is stored, how long it is kept, and when it will tell you about an incident.

What do Saudi authorities say?

Three references matter for any Saudi business that uses AI:

• SDAIA launched the national AI risk management framework as a guidance reference for government and private entities; we explained its four stages and how your company can apply them.
• The National Cybersecurity Authority put its draft AI Cybersecurity Guidelines to public consultation, with 5 August 2026 as the deadline for feedback. The draft rests on 4 domains: cybersecurity governance, cybersecurity defense, cybersecurity resilience and third-party cybersecurity, and it covers generative and agentic AI.
• The Personal Data Protection Law binds every business that processes personal data, including Articles 17 and 24 of its implementing regulation mentioned above. There is more in our practical guide to the law.

What is the plan for the first 30 days?

Origami's view

We do not read these warnings as a reason to switch AI off in your company, but as a reason to run it within clear limits. Microsoft itself says the goal is not a model whose every action is predictable, but "systems that remain secure even when the model is not". At Origami we build AI features and agents into companies' systems with limited permissions, approval steps and clear logs, review code built with AI tools and close its gaps, and update internet-facing servers and applications. Contact us to review your tools and agents together.

Key takeaways

• The warnings of October 2026 say AI speeds up finding and exploiting flaws, that agents can make mistakes or be manipulated, and that models may behave in ways no one intended.
• Know your tools and agents, give each agent the least access, and require human approval before financial and sensitive steps.
• Use business accounts that do not train models on your data by default, and keep customer data out of unapproved tools.
• Patch exposed systems within days, verify money requests through a second channel, and review your insurance and supplier contracts.