The AI world is having a loud fight about whether the machines are about to outsmart us.

As I write this, the AI world is having a loud, public fight about whether the machines are about to outsmart us.

While they argued, your customer data was quietly walking out the door.

Here’s the fight: Anthropic, the AI lab that markets itself as the safe, responsible choice, built a model called Mythos and said it was too dangerous to release. Then it shipped Fable 5: the same kind of model with safety instructions bolted on top. Within days, a researcher who goes by Pliny the Liberator talked Fable 5 into handing over the dangerous material anyway. Just by typing the right words. The guardrails were mostly for show. The industry has been arguing ever since: is AI an existential threat, or is the threat hyped up to scare regulators and box out smaller competitors?

It’s a good fight. Smart people on both sides.

And for you, it’s almost completely beside the point.

Because while the experts debate superintelligence, here’s what is actually happening inside companies like yours, every single day:

• Someone on your team pastes a customer list into a chatbot to clean up the formatting.
• Someone uploads a signed contract to an AI tool to “summarize the key terms.”
• Someone connects a shiny new AI assistant to their inbox so it can draft replies for them.

See the problem?

The real AI risk in your company isn’t a machine that out-thinks you. It’s a tool that is too eager to help, used by people nobody told what’s off-limits.

That’s not science fiction. That’s a Basic Persistent Failure. I’ve written before about BPFs: the boring, basic gaps that cause most incidents, not the exotic attacks that grab headlines.

Think about what an AI chatbot really is. It’s a very fast assistant that will repeat almost anything you feed it, and can be talked into repeating things you never meant to share. Your secrets are only as safe as the words someone uses to ask for them.

Most companies bought AI before they governed it. The tool showed up. People started using it. Nobody wrote down which data can go in, which tools are approved, or what happens to the data once it lands inside.

AI changes the speed, not the game. The failure is the same one we have always had: useful technology, deployed faster than the rules to manage it.

So you don’t need an AI ethics board. You don’t need to pick a side in the superintelligence debate. You need to govern the AI you already bought, at the level where the risk actually lives: the workflow.

That’s what an AIR-MAP does. Here’s the short version you can start this week:

1. List the AI tools your people actually use. Not the approved list. The real list. Ask them, and promise nobody is in trouble.
2. Find the three workflows where AI touches your most sensitive data: customer records, financials, contracts, anything covered by a regulation.
3. For each one, answer a single question: what data goes in, and where does it go after that?
4. Write the rules nobody has written yet. Which tools are approved. Which data never goes in. Who to ask when someone is unsure.
5. Tell your people. A rule nobody knows about isn’t a control.

That’s it. No moat. No magic. Just management.

What AI tools are your people using right now that you never approved?

If you don’t know the answer, that is the finding.

-Kip