--- title: "Samsung, Arup, Avianca | Metaintro" canonical: "https://www.metaintro.com/blog/companys-ai-nightmares-hbr" language: "en" author: "drashtigarach" published: "2026-05-12T13:47:16.000Z" modified: "2026-05-12T13:47:16.000Z" --- [Back to Blog](/blog) [AI](/blog/tag/ai)[Technology](/blog/tag/technology)[News](/blog/tag/news)[Information](/blog/tag/information) # Samsung, Arup, Avianca: 5 AI Nightmares Every Board Should Map in 2026 HBR's Reid Blackman maps the AI nightmares boards must contain in 2026, from data leakage to agent risk, with real incidents and new jobs. [![Drashti Garach](https://cdn.metaintro.com/rs:fill:40:40/q:72/plain/images/5719d740-e510-42bc-8017-e040d145f35f_1766029465094.png)Drashti Garach @DrashtiGarach](/blog/author/drashtigarach) [May 12, 2026](/blog/archive/2026/05)11 min read ![Samsung, Arup, Avianca: 5 AI Nightmares Every Board Should Map in 2026](https://cdn.metaintro.com/rs:fill:1200:675/q:78/plain/images/fictional.png) [https://x.com/intent/tweet?text=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](https://x.com/intent/tweet?text=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr)[http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr)[https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr&title=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr&title=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026)[mailto:?subject=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&body=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](mailto:?subject=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&body=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr) Every company has the same recurring dream now. An AI model that thinks like the best employee, never sleeps, never quits, and ships flawless work by Monday. The nightmare runs underneath, in a parallel layer few executives talk about openly. Confidential code uploaded to a public chatbot. A customer service bot inventing refund policies the company has to honor. A finance worker wiring twenty-five million dollars to scammers after a video call with deepfaked colleagues. In a piece published May 11 in [Harvard Business Review](https://hbr.org/2026/05/what-are-your-companys-ai-nightmares), AI ethicist [Reid Blackman](https://www.virtueconsultants.com/) argues that boards now need to map their AI nightmares before agents make them real. ## How Did Generative AI Become a Liability Issue? The first wave of corporate AI risk involved narrow predictive models that scored loans, screened resumes, and ranked content. The second wave, generative AI, opened the door wider. Now anyone with a laptop can paste sensitive material into a chatbot, and the chatbot can speak on behalf of the company without anyone double-checking what it just said. That shift is what Blackman, founder of the AI risk firm Virtue and author of [Ethical Machines](https://store.hbr.org/product/ethical-machines-your-concise-guide-to-totally-unbiased-transparent-and-respectful-ai/10501) from Harvard Business Review Press, calls the move from a contained product problem to a distributed workforce problem. [Samsung learned that lesson early](https://www.bloomberg.com/news/articles/2023-05-02/samsung-bans-chatgpt-and-other-generative-ai-use-by-staff-after-leak). In April 2023, engineers pasted proprietary source code and meeting notes into ChatGPT to fix bugs faster. By May 2023 the company had banned generative AI on company devices, with an internal survey showing 65 percent of employees viewed the tools as a security risk. Industry research firms now treat that incident as the canonical case for data exfiltration through prompts. The follow up was even more telling. Within a year, companies that had blocked the tools watched employees pull them in anyway through personal devices, mobile browsers, and unofficial browser extensions, which security teams started calling [shadow AI](https://www.gartner.com/en/articles/what-is-shadow-ai). The shadow AI problem is now the dominant question on most chief information security officer dashboards. Workers do not feel like they are being reckless. They feel like they are being productive, because the official tooling is slower than the unofficial tooling, and the gap is what governance has to close. The category of risk Blackman calls reputational fallout shows up in different shapes. A chatbot quotes a refund policy that does not exist and a tribunal forces the airline to honor it. A retail bot is goaded into recommending the products of a direct competitor on the company's own website. A customer service bot uses a racial slur after being prompted with a leading question. None of these required malice. They required only a generative model deployed without guardrails, monitoring, and a human in the loop for high stakes interactions. Every one of those incidents produced a board level conversation the following Monday, and most of those conversations ended with the same question. Who is supposed to be watching this. ## What Are the Specific AI Nightmares Boards Should Worry About? Blackman and the broader AI governance field have converged on a recurring set of risk categories. Data leakage is the first, and the Samsung pattern explains why. Sensitive code, customer data, employee records, and unreleased financials are now being typed into models whose providers may retain the inputs for training, troubleshooting, or both. Even where retention is contractually limited, the act of transmission can violate data residency rules in regulated industries. Hallucinations are the second. A model invents a court case, a citation, a refund policy, or a clinical guideline that sounds plausible because the model is optimized for plausibility, not truth. When the company puts that output in front of a customer, a patient, or a regulator, the company owns the consequence. [Lawyers in several jurisdictions](https://www.courtlistener.com/docket/63107798/mata-v-avianca-inc/) have already been sanctioned for citing fabricated cases produced by chatbots, and the same risk now applies to compliance memos, financial disclosures, and engineering documentation. Intellectual property leakage is the third. Models trained on third party data can reproduce copyrighted text, code, or design assets, and the company that ships the output without checking inherits the liability. The same risk runs in reverse. A proprietary algorithm or trade secret pasted into a public model can end up in a competitor's prompt window six months later, with no clean way to prove the path. Deepfake fraud is the fourth, and the most cinematic. In 2024, [the engineering firm Arup confirmed](https://edition.cnn.com/2024/02/12/business/arup-deepfake-scam-hong-kong-intl-hnk/index.html) that a finance worker in its Hong Kong office wired roughly twenty five million dollars to scammers after joining a video call in which every other participant, including the chief financial officer, was a deepfake. The fifth category, and the one Blackman spends the most time on in his new piece, is agent risk. Once an AI agent can take actions in the world, like sending emails, executing trades, opening tickets, or pulling code, the blast radius of a bad output expands from a single screen to the entire system the agent can touch. A hallucination on a chat screen is an embarrassment. A hallucination from an agent with permissions is an incident. Bias is a sixth category that has not gone away just because newer models can write fluent prose. Resume screeners that filter out women's colleges, claim adjudicators that downgrade certain zip codes, and pricing models that quote different rates to different demographic groups have all triggered regulatory actions. A seventh, less discussed, is vendor concentration. When most enterprises route their AI workloads through three or four model providers, an outage, a policy change, or a security incident at any one of those vendors becomes a board level event for thousands of companies at once. Add insider misuse to the list, where an employee uses an approved tool to generate something the company would never have signed off on, and the surface area starts to look uncomfortably similar to the early days of cloud adoption, when every business unit spun up its own services and the security team found out months later. ## What Does Real AI Governance Look Like? Most AI policies are still written like a magazine subscription. Employees check a box that they read them and nothing in the workflow changes. The frameworks that boards now point to do more. The [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), released in January 2023 with a [Generative AI Profile](https://airc.nist.gov/AI_RMF_Knowledge_Base/AI_RMF) added in July 2024, organizes the work around four functions: govern, map, measure, and manage. The [EU AI Act](https://artificialintelligenceact.eu/) sets baseline obligations for high risk systems and tougher rules for general purpose models. Internal programs that work tend to combine an inventory of every AI system in use, a tiered review process based on risk, red teaming for high stakes deployments, monitoring for drift after launch, and a clear escalation path when something fails. Blackman's argument is that governance built for predictive models does not scale to agents. The reason is autonomy. A scoring model produces a number and a human acts on it. An agent produces an action, often invisibly, and the company only sees the consequence later. That asymmetry is why the new generation of AI governance programs is being built around testing and observability rather than approval forms. The boards that are getting it right have stopped asking whether their company should adopt AI and started asking whether their company can prove what its AI is doing on any given day. ## Who Owns AI Risk Inside the Company? The honest answer is no one yet, in most companies. Boards are starting to ask. The chief information officer owns the systems but rarely the model behavior. The chief technology officer owns the build but rarely the policy. The chief human resources officer owns the workforce that uses the tools but rarely the audit trail. The general counsel owns the liability but rarely the technical controls. The chief information security officer owns the breach response but rarely the model lifecycle. Companies that have made progress have either named a chief AI officer with a real budget, or routed AI risk through an enterprise risk function with explicit hand offs to each of those leaders. That is also where the new jobs are appearing. [Gartner reported in April 2026](https://www.gartner.com/en/newsroom/press-releases) that 85 percent of organizations are expanding AI related roles, with AI governance lead, AI risk manager, model risk officer, prompt security engineer, and AI assurance auditor showing up in postings that did not exist eighteen months ago. The same firm [reported in May 2026](https://www.gartner.com/en/newsroom/press-releases) that roughly 80 percent of AI deployments are still failing to produce measurable return on investment, a gap that is itself becoming a job category for people who can connect governance to value. The pattern suggests that the next decade of corporate hiring will run on two tracks at once. One track expands AI usage. The other track audits, regulates, and contains it. ## What Should Workers Know About Their Company's AI Risk Posture? For employees, this is no longer abstract. The way a company handles AI risk shapes job security, the quality of the tools available, and the exposure of personal data inside human resources systems. A few signals are worth watching. Does the company publish an AI use policy that names specific approved and prohibited tools? Is there a clear path to flag an AI mistake without retaliation? Is there a stated position on whether agents can make decisions about hiring, firing, performance reviews, or compensation? Companies that answer those questions clearly are typically the ones with mature governance. Companies that avoid the questions tend to be one incident away from a headline. The hiring market is shifting accordingly. Roles in AI governance, machine learning assurance, and responsible AI now sit alongside traditional cybersecurity and compliance roles in many job ladders, and they pay competitively because the supply of people who understand both the technology and the regulation is thin. Workers with backgrounds in audit, privacy, security, ethics, and policy can move into these jobs faster than most assume, often without a formal computer science degree, because what employers need first is judgment about acceptable risk, not a familiarity with model architectures. The candidates who pair that judgment with a working fluency in how large language models actually fail, including prompt injection, jailbreaks, training data poisoning, and tool misuse by agents, will be the ones who set the going rate for these roles. ## What Happens If Boards Keep Ignoring This? The nightmare scenario Blackman sketches is not one big breach. It is dozens of small ones that compound. A bot makes a promise the company has to honor. An agent runs a query that pulls personally identifiable information into a vendor system. A model generates a marketing image that reuses a copyrighted character. A deepfake of an executive circulates on social media on an earnings day. Each one is survivable. Together they erode the trust customers, regulators, and employees place in the company, and that trust is the asset boards are paid to protect. The companies that will look smart in five years are the ones that treated AI nightmares the way they once treated cybersecurity. As a discipline with a budget, a leader, a board report, and a culture that rewards the team that prevents the headline, not just the one that ships the feature. ## People Also Asked **Q: What are the biggest AI risks companies face right now?** A: Data leakage through prompts, hallucinated outputs that the company has to defend, intellectual property exposure, deepfake fraud targeting finance and executive workflows, and the new category Reid Blackman emphasizes most, AI agents taking unauthorized actions inside connected systems. **Q: Who should own AI governance inside an organization?** A: A growing number of companies are naming a chief AI officer with a real budget, with explicit hand offs to the chief information officer, general counsel, chief information security officer, and chief human resources officer rather than letting any one of them shoulder it alone. **Q: What jobs are appearing because of AI risk?** A: AI governance lead, AI risk manager, model risk officer, prompt security engineer, AI assurance auditor, and responsible AI program manager are now standard postings, and they often go to candidates with audit, privacy, security, ethics, or policy backgrounds rather than pure machine learning resumes. Future-proof your career by tracking how the companies you target handle AI risk and where they are hiring governance talent. [Metaintro](https://www.metaintro.com) surfaces the roles and the labor market signals that show where this category is heading next. ### Share this article [https://x.com/intent/tweet?text=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](https://x.com/intent/tweet?text=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr)[http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr)[https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr&title=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr&title=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026)[mailto:?subject=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&body=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr](mailto:?subject=Samsung%2C%20Arup%2C%20Avianca%3A%205%20AI%20Nightmares%20Every%20Board%20Should%20Map%20in%202026&body=https%3A%2F%2Fwww.metaintro.com%2Fblog%2Fcompanys-ai-nightmares-hbr) For job seekers ## The job you want exists. We’ll find it. No more scrolling job boards. Get matched roles by text, with the pay and the reason they fit. [Get Started Free](/signup)[Search matching jobs](/jobs/search) - MatchCompare live roles against your current evidence. - PositionTurn proof projects into role-specific applications. - ImproveUse market feedback to keep the skill plan current. [Return to navigation](#main-navigation)