When AI Becomes The Threat: A Blueprint For Managing Frontier AI Risk

This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.Kevin Lynch, CEO and board member at Optiv, a cyber advisory and solutions leader.

getty​Since the introduction of ChatGPT in November 2022, AI has quickly become a fixture in the boardroom. Most conversations have followed two familiar tracks: how to adopt AI responsibly and securely and how to defend the organization against AI-powered threats.​

Nearly four years into the AI revolution, neither challenge has been fully solved. I’ve watched as AI capabilities continue to advance faster than many organizations can adapt their security controls, governance frameworks and risk management practices.​

Now, a series of security incidents involving increasingly capable AI models is introducing an entirely new dimension to the conversation: What happens when the AI itself becomes the threat?​

Recent incidents involving frontier AI models have caught AI developers, the cybersecurity community and organizations off guard.

In July, OpenAI disclosed a security incident in which models operating during internal cybersecurity evaluations circumvented controls designed to isolate them from the internet and ultimately compromised portions of Hugging Face’s infrastructure.​

Just days later, Anthropic reported that, during cybersecurity testing, Claude models reached the open internet and subsequently gained unauthorized access to systems belonging to three different organizations. Anthropic then later identified a fourth incident involving a different model.​

These security events are particularly concerning because they challenge a fundamental assumption behind traditional cybersecurity: that the technology will behave according to its design and that an unauthorized action ultimately traces back to a human actor.​

Autonomous AI systems complicate both assumptions. A model can interpret a goal, develop a strategy, adapt when obstacles arise and take actions its developers did not anticipate. As systems gain greater autonomy, the distinction between a tool executing instructions and an actor pursuing an objective becomes increasingly difficult to define.​

The challenge for organizations, then, is no longer simply protecting AI from attackers. It’s also protecting themselves from AI systems that behave unexpectedly, circumvent safeguards or gain access beyond what their developers intended.​

That distinction is important because the consequences of AI model attacks are expanding alongside the technology’s role in society. Failure to keep pace could extend the consequences well beyond financial loss, operational disruption or reputational damage. In certain environments, an AI system operating outside its intended boundaries could create consequences that put human safety at risk.​

This dangerous new landscape is prompting some of the world’s leading AI researchers and technology executives to call for greater caution around frontier AI development. In September 2026, Anthropic CEO Dario Amodei wrote an essay, which called for the industry to “slow the pace at which we improve the capabilities of AI models.”​

For boards and C-suite executives, this raises a difficult question: If the companies developing the world’s most advanced AI systems acknowledge that safeguards may not always keep pace with model capabilities, what does that mean for the organizations deploying those systems?​

There is no simple answer or established road map. But operating in uncharted territory certainly does not mean organizations should halt AI adoption.​

Innovation in AI is happening everywhere, but not all players in this space champion responsible implementation to the same degree. If organizations that are committed to safety reduce their rate of innovation and others continue to charge forward, we may unintentionally create a disadvantage for those prioritizing transparency and security.​

The answer, therefore, is not to choose between innovation and security; it’s to build the ability to innovate safely, ensuring that organizations’ capacity to understand, govern and control AI advances alongside the technology itself.​​

For organizations, that means moving beyond broad responsible AI principles and establishing practical controls that can operate at the speed and scale of modern AI.​

Organizations need clear accountability for how AI is deployed and how its risks are managed. Boards and executives should know where AI is being used, what systems it can access, what decisions or business processes it can influence and who is ultimately accountable for its behavior.​

AI governance needs to evolve from an isolated technology initiative to becoming an integrated part of the overall enterprise risk management program.​

AI security and safety must be embedded throughout the AI life cycle, rather than added after deployment.

That means continuously assessing systems for emerging risks, monitoring for unintended behavior, validating data and access controls, testing models against realistic attack scenarios and regularly reassessing risk as models, applications and their environments evolve.​

It also means educating employees on both the capabilities and limitations of AI. Human users remain an important part of the security equation, particularly as organizations increasingly rely on AI systems to make recommendations, access sensitive information and take actions on their behalf.​

As AI systems become more capable of acting independently, organizations need guardrails designed specifically for autonomy.​

These should include rigorous model testing and red-teaming, strong identity and access controls, data provenance and privacy protections, continuous monitoring, clear intervention mechanisms and defined boundaries for what an AI system can (and cannot) do without human approval.​

Human oversight should remain proportional to the potential impact of an AI system’s actions. The greater the consequences, the greater the need for meaningful human control.​

I believe the organizations that follow this road map will be best positioned to lead in the next era of AI, because responsible innovation is the means by which businesses can remain competitive while ensuring trust, transparency and accountability scale alongside technological progress.​

To get here, the debate in the boardroom and across the AI industry needs to move beyond whether we should pause or accelerate AI development. The more important question is now how we can build trust and control into AI while continuing to innovate.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?