Associate Professor of Information Society and Cyberculture at TalTech’s IT College
AI agents deployed without sufficient thought can create serious cybersecurity risks and make accountability even more complicated.
Cybersecurity specialists’ familiar warnings — “Watch what you sign, where you click and what you download!” — are now joined by a major red warning: “Watch what you let others, especially AI, do!”
An AI agent is, to some extent, a reflection of its user. This makes the person’s own critical thinking, ability to weigh up choices and clearly formulate tasks — or, more broadly, their communication skills — essential.
The paradox of AI is that it can do much of the thinking for its user, yet it is truly useful only to those who can also think for themselves and communicate their ideas to others.
In the near future, cybersecurity specialists will probably be kept busiest by careless, lazy people who have trained their AI agents superficially, leading the agents to do something unforeseen. Put simply: slapdash training leads to things getting out of hand.
Who is responsible when AI gets something wrong?
I wholeheartedly agree with the risk identified by my colleague Birgy Lorenz: an AI agent may follow a valid instruction from the wrong person.
I would add another factor. A chronic problem of the technological age is that legislation lags behind development. Whether the issue is social media, software licences or AI, the legal framework often struggles to keep pace with technological change.
Combine this with an AI agent’s ethical and legal indifference — it has no conscience and follows the law only insofar as compliance is built into its operation — and the result is a fairly explosive cocktail.
Particularly worrying is the possibility that people with flexible ethics will increasingly exploit outdated legislation and try to delegate responsibility to AI. We could end up in a situation where the agent is accountable, which effectively means nobody is.
Another major risk lies in interactions between different AI agents. Things can get out of hand when agents working together represent people with different goals and understandings, who have defined their agents’ tasks differently. The outcome might resemble an old joke by Estonian comedian Eino Baskin: “I put the plus and the minus together… Damn, what a bang!” The same danger can arise on the defending side, in cybersecurity.
The paradox of AI is that it can do much of the thinking for its user, yet it is truly useful only to those who can also think for themselves and communicate their ideas to others.
This opinion piece is based on the Delfi Forte article “TalTech researchers warn: a company’s most diligent employee could become a cybersecurity risk”.
