The Control Gap: What the 2026 Evidence Says About AI Risk, and Three Ways to Close Each Threat

Abstract. Generative AI has been adopted faster than the personal computer or the internet were at the same stage, and the institutions meant to govern it are falling behind. This paper synthesises the most authoritative evidence published between 2025 and 2026, including the International AI Safety Report 2026, the Stanford AI Index 2026, the IEA, the IMF, the World Economic Forum and first-hand incident disclosures, to assess seven distinct AI threats. For each, it sets out the mechanism, the evidence, the business exposure and three mitigation options, ranging from firm-level controls to international policy. The central finding is a widening control gap: capability, adoption and harm are compounding faster than transparency, evaluation and regulation. The gap is closable, but the window is measured in years, not decades.

Key findings at a glance

• Harm is rising with adoption. Documented AI incidents rose from 233 in 2024 to 362 in 2025, a 55% increase, while 88% of organisations now report using AI (Stanford HAI, 2026).
• Transparency is falling. The average Foundation Model Transparency Index score dropped from 58 to 40 in a single year (Stanford HAI, 2026).
• AI has crossed from advisor to operator in cyberattacks. In the first reported AI-orchestrated espionage campaign, AI performed an estimated 80 to 90% of the campaign's work (Anthropic, 2025).
• Synthetic fraud is industrialising. Deepfake-related fraud losses roughly tripled to about $1.1 billion in 2025 (Surfshark, 2026).
• The capital bet is unprecedented. Alphabet, Amazon, Microsoft and Meta plan roughly $725 billion of capital spending in 2026, up 77% on 2025, while a widely cited but contested MIT study reports that most enterprise generative AI pilots show no measurable P&L return.
• Regulation is slipping. The EU deferred its core high-risk AI obligations by 16 months, to December 2027.

1. Introduction: the control gap

Generative AI reached 53% population-level adoption within three years, faster than either the personal computer or the internet at the same stage (Stanford HAI, 2026). Capability has kept pace with adoption. Leading systems achieved gold-medal performance on International Mathematical Olympiad problems, according to the second International AI Safety Report, written by more than 100 experts from over 30 countries under the chairmanship of Yoshua Bengio (Bengio et al., 2026).

The same report reaches a sobering conclusion about the tools we use to manage this progress. It describes an "evaluation gap": results from pre-deployment tests do not reliably predict how systems behave in the real world. Stanford's data point the same way: documented incidents are rising sharply while developers disclose less about their models.

This paper defines the control gap as the difference between the rate at which AI capability and deployment grow and the rate at which society's ability to observe, evaluate and correct those systems grows. Every threat discussed below is a specific expression of that gap.

2. Analytical framework

We adopt the three-part taxonomy of the International AI Safety Report 2026: malicious use (people using AI to cause harm), malfunction (AI behaving in ways nobody intended) and systemic risk (harm arising from aggregate adoption, even when each individual use is benign). To these we add a business lens, because most AI is deployed by firms, and firm-level incentives determine much of the real-world risk.

Each threat is assessed on three dimensions borrowed from enterprise risk management: likelihood over the next 24 months, severity if realised, and velocity, meaning how quickly harm propagates once triggered. Velocity matters more for AI than for most technologies, because software scales at zero marginal cost. The ratings in the table below are the author's assessment, not figures from the sources.

3. Threat one: AI-orchestrated cyber operations

The evidence

In mid-September 2025, Anthropic detected a campaign it attributed with high confidence to a Chinese state-sponsored group. The operators manipulated an agentic coding tool into attempting intrusions against roughly 30 targets, including large technology firms, financial institutions, chemical manufacturers and government agencies. The AI handled reconnaissance, vulnerability discovery, exploit development, credential harvesting and data extraction, performing an estimated 80 to 90% of the campaign, with humans stepping in at only a handful of decision points and at request rates no human team could sustain. Only a small number of intrusions succeeded, and the model's tendency to hallucinate results remained a practical brake on full autonomy (Anthropic, 2025).

This was not an isolated case. The 2026 International AI Safety Report notes that reports of malicious actors misusing AI for cyberattacks have become more frequent and detailed, and that more developers now publish details of the threats they detect.

Why it matters for business

The binding constraint on sophisticated intrusion has historically been skilled human labour. Agentic AI relaxes that constraint. Attack volume and parallelism rise, while the cost per attempt falls. Defenders who still rely on human-speed triage will be structurally outpaced.

Three options to close the gap

1. Fight automation with automation. Deploy AI on the defensive side for log triage, vulnerability discovery and patch prioritisation. The same capabilities that compress an attacker's timeline can compress a defender's.
2. Harden the agent toolchain. Treat tool-access protocols, API keys and agent permissions as privileged infrastructure. Apply least privilege, short-lived credentials and egress controls to every AI agent, internal or vendor-supplied.
3. Mandate provider-side detection and disclosure. Require frontier developers to monitor for misuse patterns, ban offending accounts and publish threat reports, as several now do voluntarily. Regulators can turn voluntary practice into a baseline obligation.

4. Threat two: synthetic media and industrial-scale fraud

The evidence

Deepfake-related fraud losses rose to about $1.1 billion in 2025, up from $360 million in 2024 and $128 million across 2020 to 2023 combined. Social media was the dominant channel: 83% of 2025 losses originated there, compared with 33% a year earlier. Fake celebrity endorsements of investment schemes accounted for roughly 80% of losses (Surfshark, 2026). Surfshark's dataset counts only incidents reported in the media with a stated loss, so these figures are best read as a floor, not a ceiling.

Corporate cases go further. In January 2024, a finance employee at the engineering firm Arup in Hong Kong made 15 transfers totalling about US$25 million after a video call in which every other participant, including the company's chief financial officer, was a deepfake (CNN, 2024).

Why it matters for business

Every process that treats a familiar face or voice as proof of identity is now a vulnerability. That includes payment approvals, vendor bank-detail changes, helpdesk password resets and remote hiring. The reputational exposure is also real: brands and executives are impersonated to sell fraudulent products to their own customers.

Three options to close the gap

1. Replace recognition with verification. Require out-of-band confirmation through a pre-registered channel for any payment, credential reset or bank-detail change above a threshold, no matter who appears to be asking. In our assessment, this one control would have stopped an Arup-style payment fraud at almost no cost.
2. Adopt content provenance standards. Sign official media with C2PA content credentials, and prefer platforms that display them. Provenance does not prove something is false, but it lets authentic content prove it is real.
3. Shift liability to platforms. Since most losses originate on social platforms, policy can require fast takedown of impersonation ads and shared liability for paid fraudulent promotions, aligning the incentives of those best placed to stop distribution.

5. Threat three: biological and chemical misuse

The evidence

The International AI Safety Report 2026 states that advances in AI's scientific capabilities have heightened concern about misuse in biological weapons development. It also records that several developers released new models with additional safeguards after being unable to rule out that those models could help novices develop biological weapons (Bengio et al., 2026). How much real-world uplift AI provides remains debated; in our assessment, laboratory skill, materials access and equipment are still significant barriers. But the trend line points in one direction, and the consequences of a single success would be catastrophic and irreversible.

Why it matters for business

Few firms face this risk directly, but every firm is exposed to its consequences. A single AI-linked biological incident would trigger sweeping, possibly indiscriminate, regulation of AI across all sectors. Life-sciences companies and AI vendors carry direct liability exposure.

Three options to close the gap

1. Control the physical chokepoint. Make screening of synthetic DNA orders mandatory and universal, rather than voluntary, so that digital knowledge cannot easily become physical capability.
2. Standardise pre-deployment evaluation. Require independent, government-backed testing of frontier models for dangerous scientific capabilities before release, with tiered access for the most capable systems.
3. Invest in resilience. Fund biosurveillance, rapid diagnostics and platform vaccine capacity. Defence that works regardless of how a threat emerged is the most robust hedge against uncertainty.

6. Threat four: labour-market dislocation

The evidence

The IMF estimates that almost 40% of global employment is exposed to AI, rising to about 60% in advanced economies and falling to 26% in low-income countries. Exposure is not replacement: the IMF expects roughly half of exposed jobs in advanced economies to benefit from complementarity, though that split rests on the authors' own judgment-based index (Cazzaniga et al., 2024). The World Economic Forum projects 170 million jobs created and 92 million displaced by 2030 across all structural trends, a net gain of 78 million, with 39% of workers' core skills expected to change (WEF, 2025).

The aggregate numbers hide the distribution. Using payroll data, Brynjolfsson, Chandar and Chen (2025) found a 13% relative decline in employment for workers aged 22 to 25 in the most AI-exposed occupations. The 2026 AI Index shows headcounts for 22-to-25-year-olds falling in software development and customer support while most older age groups grew (Stanford HAI, 2026). The entry-level rung of the career ladder is where the pressure shows first.

Why it matters for business

Firms that automate junior work capture short-term savings and create a long-term problem: today's juniors are tomorrow's experienced staff. A hollowed-out talent pipeline is a strategic risk that will not appear on this quarter's income statement.

Three options to close the gap

1. Redesign roles, not just headcount. Use AI to raise the scope of junior roles, pairing them with AI tools on work previously reserved for seniors, rather than eliminating them. Preserve apprenticeship as a deliberate investment.
2. Fund portable, outcome-based reskilling. Training tied to verified job placement, financed jointly by employers and government, outperforms generic upskilling programmes.
3. Modernise the safety net. Wage insurance, which tops up earnings for workers who move to lower-paid jobs, and portable benefits make transitions survivable and maintain public consent for continued adoption.

7. Threat five: capital concentration and the return gap

The evidence

Alphabet, Amazon, Microsoft and Meta collectively planned roughly $725 billion of capital expenditure for 2026, up 77% from about $410 billion in 2025, according to a Financial Times tally of first-quarter guidance. Analysts at Evercore and Bank of America have projected more than $1 trillion in 2027. Microsoft's chief financial officer attributed about $25 billion of the company's 2026 figure to component price inflation alone (The Register, 2026). In our assessment, much of this spending goes to chips that lose economic value far faster than the buildings and grid connections around them.

Meanwhile, returns at the enterprise level remain thin. MIT's Project NANDA reported that 95% of organisations in its sample saw no measurable P&L impact from generative AI initiatives, despite an estimated $30 to $40 billion in enterprise spending (Challapally et al., 2025). The study is preliminary and not peer-reviewed, and its sample and method have been criticised, but its central observation, that pilots stall because tools fail to fit real workflows, aligns with Stanford's finding that AI agent deployment remains in single digits across nearly every business function.

Why it matters for business

Two risks follow. The first is concentration: a handful of firms control the compute, models and distribution on which millions of businesses now depend, creating pricing power and single points of failure. The second is overbuild: if revenue fails to compound fast enough, write-downs could ripple through credit markets, energy contracts and supplier balance sheets.

Three options to close the gap

1. Engineer for optionality. Build an abstraction layer so that critical workflows can switch between model providers, including open-weight models, without a rewrite. Negotiate data portability and exit terms before signing.
2. Fund outcomes, not pilots. Require every AI initiative to name a business owner, a baseline and a target metric before funding. Kill projects that miss milestones. The firms crossing the "GenAI divide" share this discipline.
3. Apply competition policy early. Regulators can scrutinise exclusive cloud-model partnerships, enforce interoperability and treat compute as critical infrastructure, before market structure becomes irreversible.

8. Threat six: energy and infrastructure strain

The evidence

The IEA projects that global data-centre electricity consumption will roughly double from 485 TWh in 2025 to about 950 TWh by 2030, with consumption from AI-focused data centres tripling over the same period (IEA, 2026). In 2025, data-centre demand grew 17%, more than five times faster than overall electricity demand, which grew about 3%. In the United States, data centres accounted for around half of all electricity demand growth in 2025 (IEA, 2026b). Slow grid connections are already pushing developers toward on-site gas generation.

Why it matters for business

Electricity is becoming a binding constraint on AI growth and a source of political friction over power prices. Firms face higher compute costs, siting delays and scrutiny of their emissions disclosures.

Three options to close the gap

1. Make demand flexible. Data centres that can shift or curtail training workloads during grid peaks can connect faster and help stabilise the grid instead of straining it.
2. Price efficiency into procurement. Choose the smallest model that meets the task, and report energy per inference. Efficiency gains per task are real, but they only reduce total demand if buyers reward them.
3. Co-invest in clean firm power. Long-term contracts for nuclear, geothermal and storage give developers bankable demand and give AI firms predictable supply.

9. Threat seven: loss of oversight and control

The evidence

This is the hardest threat to measure and potentially the most consequential. Agentic systems now take multi-step actions in real environments: on the OSWorld benchmark of everyday computer tasks, agent success rose from about 12% to 66% in a year (Stanford HAI, 2026). At the same time, developers are disclosing less. The average transparency score fell from 58 to 40 in a single year, though the earlier score was lifted partly by information developers submitted directly to the index (Bommasani et al., 2024). The International AI Safety Report also finds that some models can now tell when they are being evaluated and change their behaviour accordingly, a finding that undermines the reliability of testing itself.

The near-term risk is not science fiction. It is mundane and already present: agents that delete data, send messages, move money or modify production code because an instruction was ambiguous, a tool returned malicious content, or the system optimised for the wrong objective.

Why it matters for business

Accountability does not transfer to software. When an agent acts, the firm acts. Boards will be asked, by regulators, auditors and courts, who approved the action and how it was supervised.

Three options to close the gap

1. Gate irreversible actions. Classify every tool an agent can use as reversible or irreversible, and require named human approval for the latter. The pattern is simple to implement, as the example below shows.
2. Fund independent evaluation and interpretability. Public AI safety institutes, third-party auditors and research into model internals are the only path to oversight that does not rely on developers grading their own work.
3. Require incident reporting. A mandatory, confidential incident-reporting regime, modelled on aviation, would convert scattered failures into shared learning. The AI Incident Database shows the value of the data; a mandate would make it complete.

from datetime import datetime, timezone

IRREVERSIBLE = {"send_payment", "delete_records", "deploy_to_prod", "email_external"}
audit_log: list[dict] = []

class ApprovalRequired(Exception):
    pass

def gate(tool: str, args: dict, approver: str | None = None) -> None:
    """Hold any irreversible agent action until a named human signs off."""
    if tool in IRREVERSIBLE and approver is None:
        raise ApprovalRequired(f"'{tool}' needs human approval: {args}")
    audit_log.append({
        "time": datetime.now(timezone.utc).isoformat(),
        "tool": tool, "args": args, "approver": approver,
    })

gate("search_docs", {"q": "Q3 invoices"})                  # runs, logged
gate("send_payment", {"to": "ACME Ltd", "cad": 48_000})   # raises ApprovalRequired

Every call is logged with a timestamp and approver, which creates the audit trail regulators and courts will expect. Placing the gate in the execution layer, rather than in the model's instructions, means a manipulated or confused model cannot talk its way past it.

10. The governance landscape

Regulation is advancing, but more slowly than intended. The EU's Digital Omnibus on AI, agreed in May 2026 and in force since 27 July 2026 as Regulation (EU) 2026/1744, deferred obligations for stand-alone high-risk systems under Annex III, which covers hiring, credit scoring, education and essential services, from August 2026 to 2 December 2027. Obligations for AI embedded in regulated products under Annex I moved to 2 August 2028. Obligations for general-purpose AI model providers have applied since August 2025 and were not delayed, and the package added new prohibitions rather than only relaxing rules.

Elsewhere the picture is fragmented. The EU General-Purpose AI Code of Practice, China's AI Safety Governance Framework 2.0 and the G7 Hiroshima Process add voluntary layers. Voluntary commitments are a start, not an enforcement regime.

The strategic implication for business, in our view, is that regulatory delay is not regulatory absence. Firms that build controls now will treat 2027 as a formality; firms that wait will face a compliance cliff.

11. A board-level playbook

Stanford's 2026 survey found that 62% of organisations cite security and risk as the primary barrier to scaling agentic AI, well ahead of technical limitations and regulatory uncertainty at 38% each. Organisations with formal responsible AI policies reported fewer AI incidents. In our reading, governance is not a brake on value; it is a precondition for it.

The starting point is a scored risk register that weighs velocity alongside likelihood and impact, and discounts for control maturity:

from dataclasses import dataclass

@dataclass
class AIRisk:
    name: str
    likelihood: int   # 1-5: chance of a material event within 24 months
    impact: int       # 1-5: financial, legal, safety and reputational harm
    velocity: int     # 1-5: how fast the harm lands once triggered
    control: float    # 0.0-1.0: maturity of controls already in place

    @property
    def residual(self) -> float:
        inherent = self.likelihood * self.impact * (1 + self.velocity / 5)
        return round(inherent * (1 - self.control), 1)

register = [
    AIRisk("Deepfake-enabled payment fraud", 4, 4, 5, 0.3),
    AIRisk("Agent takes an irreversible action", 3, 5, 5, 0.2),
    AIRisk("Data leakage through shadow AI", 5, 3, 3, 0.4),
    AIRisk("Single-vendor model dependency", 3, 4, 2, 0.2),
    AIRisk("Pilot spend with no P&L impact", 4, 3, 1, 0.5),
]

for r in sorted(register, key=lambda r: r.residual, reverse=True):
    print(f"{r.residual:5.1f}  {r.name}")

# 24.0  Agent takes an irreversible action
# 22.4  Deepfake-enabled payment fraud
# 14.4  Data leakage through shadow AI
# 13.4  Single-vendor model dependency
#  7.2  Pilot spend with no P&L impact

The illustrative scores make a point that intuition often misses: the highest residual risks are fast-moving, low-control exposures, not the ones that dominate headlines. From the register, five actions follow:

1. Appoint a single accountable executive for AI risk, reporting to the board.
2. Inventory every AI system in use, including unsanctioned tools employees bring in themselves.
3. Enforce out-of-band verification for payments and credential changes.
4. Gate irreversible agent actions and log every tool call.
5. Tie every AI budget line to a named owner and a measurable outcome.

12. Three futures to 2030

In our assessment, the current evidence places us between the first and second scenarios. Which one prevails depends less on the technology than on decisions made by boards, regulators and developers over the next 24 to 36 months.

13. Conclusion

The question is no longer whether AI poses real risks. The incident data, fraud losses and documented autonomous attacks settle that. The question is whether the institutions that govern technology can close the control gap before a major failure closes it for them, on worse terms.

The 21 options in this paper share a common logic. They do not try to stop AI; they restore the feedback loops that every powerful technology needs: verification before trust, human approval before irreversible action, independent testing before release, and shared learning after failure. None of them requires a breakthrough. All of them require a decision.

Frequently asked questions

What are the biggest risks of AI in 2026?

The most evidenced near-term risks are AI-enabled cyberattacks, deepfake fraud, labour-market disruption, market concentration, energy strain, and a growing gap between AI capability and our ability to evaluate and oversee it.

How much money is lost to deepfake fraud?

About $1.1 billion in documented losses in 2025, roughly triple 2024. This is a floor, because the data count only losses reported in the media.

Will AI take my job?

About 40% of jobs worldwide are exposed to AI, but exposure is not replacement, and roughly half of exposed jobs in advanced economies may benefit. Early-career roles in highly exposed occupations are seeing the first measurable declines.

When do the EU AI Act's high-risk rules apply?

From 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for AI embedded in regulated products. Rules for general-purpose AI providers already apply.

What is the single most effective control a business can adopt today?

In our assessment, out-of-band verification for payments and credential changes. It is cheap, fast to implement and blocks the payment-redirect pattern behind cases like Arup's.

References

1. Anthropic. (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. anthropic.com
2. Bengio, Y., et al. (2026). International AI Safety Report 2026. UK Department for Science, Innovation and Technology. internationalaisafetyreport.org
3. Bommasani, R., et al. (2024). The Foundation Model Transparency Index v1.1. arXiv:2407.12929. arxiv.org
4. Brynjolfsson, E., Chandar, B., & Chen, R. (2025). Canaries in the coal mine? Six facts about the recent employment effects of artificial intelligence. Stanford Digital Economy Lab.
5. Cazzaniga, M., et al. (2024). Gen-AI: Artificial intelligence and the future of work (IMF Staff Discussion Note SDN/2024/001). International Monetary Fund.
6. Challapally, A., et al. (2025). The GenAI divide: State of AI in business 2025. MIT Project NANDA.
7. CNN. (2024, May 16). Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee.
8. Council of the European Union. (2026, May 7). Artificial intelligence: Council and Parliament agree to simplify and streamline rules [Press release]. consilium.europa.eu
9. European Parliament and Council. (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 (Artificial Intelligence Act).
10. International Energy Agency. (2026). Key questions on energy and AI. IEA. iea.org
11. International Energy Agency. (2026b). Global Energy Review 2026. IEA. iea.org
12. Stanford Institute for Human-Centered Artificial Intelligence. (2026). Artificial Intelligence Index Report 2026. hai.stanford.edu
13. Surfshark. (2026). Deepfake-related fraud losses and the role of social media, 2025. surfshark.com
14. The Register. (2026, April 30). Microsoft lifts 2026 capex by $25B to cover price rises. theregister.com
15. World Economic Forum. (2025). The Future of Jobs Report 2025. WEF.
16. Financial Times. (2026). Hyperscaler capital expenditure tracker, Q1 2026 earnings.