RUFARO MAFINYANI | The call is coming from inside the house

The summary arrived before I had even closed my laptop. Crisp. Structured. Insightful. Every key decision captured, every follow-up itemised, even a tone-of-room analysis alongside suggested next steps. The best meeting notes I had ever seen — and neither I nor the person across the table had written a single word.

The problem arrived when I traced the source: an AI meeting assistant that silently joins calls by scanning a participant’s calendar integration had attended our entire conversation without an invitation. I had never installed it. But the other party’s account had quietly granted it a seat at my table, access to my words, and a record of my strategy.

No pop-up. No consent prompt. No visible name in the participant list. The entire meeting had felt private. It was not. And that gap — between what feels secure and what actually is — is precisely where the new category of cyber-risk now lives.

The threat you approved

Trust bleed is the data exposure that flows not from hackers or rogue apps, but from the AI living inside the platforms your own organisation explicitly approved. We have spent a decade building cybersecurity muscle — firewalls, two-factor authentication, attachment scans, phishing awareness training. A whole choreography designed for a visible enemy that announces itself. But the new threat does not knock. It is already resident.

Microsoft Copilot, the tool most organisations in the Microsoft ecosystem actively permit, sits across Word, Excel, PowerPoint, Outlook and Teams, with read access to every file a user touches. In early 2025 security researchers discovered a single malicious e-mail could silently trigger Copilot to extract API keys, internal documents and confidential messages with zero user interaction and no visible warning. The vulnerability, named EchoLeak and rated critical by Microsoft, required no clicks, no downloads and no suspicious behaviour from the victim. It simply ran.

Meanwhile, Gemini is embedded before any Google result loads and processes anything uploaded. A finance analyst using Copilot to compile a quarterly report may unknowingly surface unreleased earnings data without any confidentiality flag. Samsung engineers pasted proprietary source code into ChatGPT to debug it and triggered an emergency company-wide ban. A 2025 LayerX report found 77% of employees have pasted company information into AI tools, with 82% using personal, unmonitored accounts. The data does not need to be stolen. Organisations are handing it over, one helpful prompt at a time.

The core paradox of this era: AI is simultaneously the greatest threat and the only viable defence. The asymmetry is permanent: the attacker needs to succeed once; the defender must succeed every single time

South African deputy communications minister Mondli Gungubele has publicly warned the country must prepare for AI-driven consumer scams at scale. Globally, AI-driven cyberattacks are projected to surpass 28-million incidents in 2025 — a 72% year-on-year increase — with breakout time collapsing to 29-minutes from initial compromise to deeper penetration, per CrowdStrike.

Microsoft’s chief security advisor for Africa, Kerissa Varma, is direct: Africa has become a proving ground where techniques are tested locally before being exported globally. In one documented case a finance officer at engineering firm Arup wired $5m (R81.9bn) after a video call with what appeared to be the CFO and senior leadership team. Every face was a deepfake. No human was present. The money was gone before anyone called to verify.

What makes this categorically different is tempo and intelligence. AI probes millions of entry points simultaneously, generates personalised attacks faster than any IT team can respond, and never stops. This is where legacy defences fail structurally:

• firewalls cannot inspect AI-generated content embedded inside trusted applications;
• traditional DLP tools scan e-mail attachments and file transfers but miss data pasted into browser-based AI prompts; and
• SIEM platforms alert on known attack signatures, not adaptive AI behaviour that has no prior fingerprint.

Each model generation multiplies the attack surface exponentially. Static defences are already obsolete.

In deploying AI solutions across organisations — mapping data flows, tracing where information originates, travels and lands — what consistently surfaces is a picture far more exposed than anyone anticipated. Data assumed to be siloed is connected. Processes assumed to be internal touch external APIs. The trust bleed is already running, quietly, in workflows that feel entirely routine.

Far-thinking organisations have stopped asking which AI to permit and started auditing what those tools are connected to and what they do with everything they access. The most effective catalogue every embedded tool, every API connection, every data pathway their people interact with daily. Some deploy self-hosted language models running entirely within their own infrastructure — no external API calls, no third-party transmission — accepting trade-offs in storage and processing as a fair security premium.

Others adopt open-source models they can inspect and confine. All invest in machine learning-based anomaly detection that monitors behaviour continuously, because annual training cycles and human-reviewed logs are too slow for a threat that evolves faster than any team can track.

The core paradox of this era: AI is simultaneously the greatest threat and the only viable defence. The asymmetry is permanent: the attacker needs to succeed once; the defender must succeed every single time. The starting point is not a firewall upgrade. It is a question most boards have not seriously asked: not what AI have we approved, but what is that AI connected to, and what is it doing right now, with everything it sees?

• Mafinyani is risk advisory & financial modelling partner at DiSeFu, a specialised financial technology and risk advisory firm operating in the Sub-Saharan region.