The AI Safety Net is Full of Holes: What 2026 Taught Us So Far

The conversation around AI Safety Net is Full of Holes has reached a critical point. Look, I’m not here to be the fun-police. I love AI as much as the next bloke. But we’ve hit a point in 2026 where the hype has officially outrun the brakes, and the brakes weren’t even attached to begin with.

I was reading through the latest Experian and White & Case reports this morning, and the numbers are bloody terrifying. We’re talking over 8,000 major data breaches in just the first half of last year, with 345 million records floating around in the wild. If you think the “big guys” have this under control, you’re dreaming. In fact, 69% of people don’t believe banks or retailers are ready for what’s coming.

The shift we’re seeing right now isn’t just about a clever hacker in a hoodie. It’s about Autonomous AI Agents. These things are self-operating bots that can execute complex attacks without a human even lifting a finger. It’s like leaving the front door unlocked and finding out the burglar is an invisible robot that can pick locks at light speed.

Here’s the reality: your data is being used as training material for the very tools that will eventually be used to scam you. We’ve seen a massive spike in “Synthetic Identities” – AI-created profiles that look so real they can bypass most standard verification checks. One in four millennials has already been hit by identity theft this past year. That isn’t a statistic; it’s a crisis.

Also, regulators are finally waking up, but they’re creating a patchy mess. From the DOJ bulk data rules to Missouri and Maryland passing their own “Online Data Privacy Acts,” businesses are drowning in compliance while the hackers are just getting more efficient. If you’re a business owner, you can’t just tick a box and hope for the best anymore.

So, what should you actually do?

First, stop feeding the beast. If your staff are using AI tools without a clear policy, they’re likely leaking your trade secrets and customer data into a public model.

Second, get serious about “Privacy-Enhancing Technologies.” If you aren’t looking at quantum-resistant encryption yet, you’re already behind. The attackers are already using AI to find vulnerabilities in current standards.

Third, verify everything. If a video call from your “boss” asks for a transfer or sensitive files, call them back on a different number. Deepfakes aren’t just for viral TikToks anymore; they’re the new phishing.

We’re in an era where cyberattacks aren’t just about stealing your credit card; they’re about manipulating digital reality itself. Don’t be the low-hanging fruit.

> “AI is evolving at breakneck speed, and cybercriminals are the early adopters. If you isn’t using AI to defend your data, you’re bringing a knife to a gunfight.”

### Related Reading
* [Your Staff are Feeding AI Tools 18,000 Terabytes of Company Data](https://philiphall.com/your-staff-are-feeding-ai-tools-18000-terabytes-of-company-data-most-bosses-have-no-idea/)
* [The NSA’s Warning on AI Agent Security](https://philiphall.com/nsa-mcp-ai-agent-security-warning-2026/)
* [Why Stolen Passwords are Still King](https://philiphall.com/ai-dethroned-stolen-passwords-hackers-verizon-2026/)

Related Reading

The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.

Subscribe

Related articles

Google’s Gemini AI Autonomously Hacked Three Companies. Here’s What Happened.

Google has confirmed its Gemini AI autonomously hacked three real companies during a security test. The model guessed passwords, searched for leaked credentials, and accessed protected systems before stopping itself.

440 AI Agents Broke Into 395 Organisations in 26 Seconds. Nobody Stopped Them.

A swarm of 440 AI agents exploited two PaperCut flaws and compromised 395 organisations across 48 countries. The agents reached domain admin in 6 hours and ignored explicit instructions to stay out of 28 countries.

For $3,000 and a Few Days, Researchers Used Claude to Hack OpenAI

Security researchers used Anthropic's Claude AI to hack OpenAI's internal systems for less than $3,000 in tokens. What the HEIF Heist tells us about the new economics of cyber attacks.

The AI Hacking Crisis Is Already Here. Six New Incidents Prove It

OpenAI disclosed six new incidents where its models concealed mistakes, sought unauthorised credentials and uploaded files to the public internet. Cybersecurity experts say the real risk is powerful models meeting poor security controls.

Inside OpenAI’s Log of Misbehaving Models: Rewriting Jailbreaks and Covering Up Errors

OpenAI published six new reports of its models rewriting jailbreak instructions and concealing errors during training, alongside a faster public disclosure framework.
Philip Hall
Philip Hall
Philip Hall is a Sydney-based Cyber AI and Automation leader with more than 30 years of technology experience and a career in cyber security dating back to 2008. His work spans cyber architecture, cloud security, threat intelligence, assurance, incident support, AI-enabled defence and the security of autonomous agents.