New risks AI brings to everyday work

In this lesson you'll

• Name five security risks that AI tools add to everyday work
• Connect each risk to the GUARD habit that addresses it
• Explain why AI makes old scams faster and more convincing

AI changes the security picture in two ways

First, AI tools are a new place for things to go wrong. They read what you give them, sometimes remember it, increasingly connect to your email, files and calendar, and can take actions for you.

Second, criminals use AI too. It helps them write flawless phishing messages, clone voices, create fake videos and research targets faster. The FBI's 2025 Internet Crime Report logged more than 22,000 complaints with an AI connection, with about $893 million in reported losses, and that only counts what people reported and recognized.

Five risks to know

The OWASP Gen AI Security Project publishes the OWASP Top 10 for LLM Applications, a widely used list of the biggest security risks in AI systems built on large language models (LLMs). It's written for builders, but several entries show up in everyday work:

Two more risks come from ordinary habits:

• Shadow AI: using personal accounts or unapproved AI apps for work, where your organization can't protect or see the data.
• Unpatched AI apps and browser extensions: AI add-ons are software too, and they need updates and approval like anything else (Update and maintain).

Old scams, new speed

Most AI-powered attacks are familiar scams made faster and more believable. A phishing email without spelling mistakes. A "CEO" voice message that sounds right. A fake job applicant with a generated face and a polished resume. Your defenses are the same GUARD habits: verify requests out of band, protect your sign-ins and report quickly. What changes is that looking and sounding real is no longer proof of anything.

Workplace example: a regional bank branch

A branch operations lead receives a voicemail that sounds exactly like her regional manager, asking her to approve an urgent wire for a "client emergency" and not to call back because he's boarding a flight. The bank's policy requires a call-back to a known number and a second approver for any wire request received by phone or voicemail. She follows the policy. The regional manager never left the message.

Try it

List every AI tool you've used for work in the past month, including AI features built into email, documents, meeting apps and browsers. For each, note:

If you aren't sure whether a tool is approved, that's your first question for IT or your manager.

Then ask an approved AI tool:

I work as a [role] in [industry]. Explain, in plain language and under 250 words,
the three AI-related security risks most likely to affect someone in my role,
with one practical habit for each. Don't use technical jargon.

Key takeaways

• AI is both a new place for things to go wrong and a tool criminals use to make scams faster and more convincing.
• Key risks include sensitive data disclosure, prompt injection, misinformation, excessive agency and AI-powered fraud.
• Shadow AI (unapproved tools and personal accounts) puts data where your organization can't protect it.
• Looking and sounding real is no longer proof. Verify the request.

Sources

• OWASP Top 10 for LLM Applications 2026 (opens in a new tab)
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report (opens in a new tab)