In recent months, cybersecurity incidents have grown and become increasingly professionalized through the use of artificial intelligence. This trend has led cybercriminals to explore new attack targets, and companies’ own AI systems have become the perfect target for them.
Despite this scenario, Logixs, a Spanish company specialized in the design and integration of AI solutions for companies, warn that 8 out of 10 companies do not have cybersecurity protocols in their AI projects, according to their client portfolio, since the majority assume that their traditional policies serve in the same way to protect a language model or an agent.
“In recent times we have seen how awareness in terms of cybersecurity has increased in companies, also driven by regulations such as the AI Act, DORA or NIS2. However, there are still many companies that, when trying to accelerate projects to see results soon, introduce security halfway, when it should be from the design,” declares Luis Bravo, head of information security at Logixs. “Likewise, there are also cases in which these projects are stopped precisely by the fear of implementing it and that it is not safe, which poses the risk of being left behind.”
The greatest danger comes from within the company
Among the most frequent risks, which are repeated in all companies regardless of their size or sector, the use of public AI tools by staff without supervision stands out. In these unsecured environments, employees share sensitive information such as contracts, customer data, or proprietary code without the company’s knowledge. So much so that 8 out of 10 Spanish employees who already use AI in their workplace claim to have used tools not provided by their company without communicating it, according to a study by Cegid, while 6 out of 10 claim to use AI without guidelines or corporate supervision, according to VML The Cocktail and Salesforce.
Among the most common risks in AI projects are the lack of traceability to explain why an AI tool gave a specific answer or where it extracted the data from. Additionally, the deployment of agents with excess permissions connected to critical unattended systems and the theft of AI service keys can also be used by attackers, skyrocketing bills in a matter of hours. In fact, only 30% of Spanish companies know exactly where the data used by their AI systems is stored and processed, according to a recent study by Red Hat.
Likewise, the use of AI to program faster is generating invisible failures. An example of this is AI that writes code that works. When this happens, companies tend to review their code and processes less than necessary. In fact, in 2 out of every 10 audits that the Logixs team performs on software previously developed by companies with the help of AI, at least one vulnerability or exposed credential appears.
Main cybersecurity problems
And it is not an isolated case. According to Veracode’s GenAI Code Security 2025 report, 45% of code samples generated by more than 100 AI models fail security tests. In addition, there have been documented cases in which AI recommends software packages that do not exist and that cybercriminals register with malicious code under those same names to infect companies.
The use of AI to program faster is generating invisible failures
“Cybersecurity is critical in AI projects. Therefore, at Logixs we have developed our own system that accompanies the entire development cycle with AI agents, from the moment the first line of code is written until it is put into production, with continuous monitoring and not just a review at the end of the project.
In this way, we can detect problems in time that could end up becoming an incident, from access codes or passwords included in the code to personal data protected by the RGPD. Additionally, before we put an agent into production, we subject it to controlled attacks in an isolated environment to see how it responds to manipulation attempts, such as injection of instructions, or misuse of its permissions,” says Bravo.
