French Intelligence Warns of AI Risks in Companies: Data Leaks, Fraud, and Biased Decisions
French domestic intelligence agency DGSI documented three cases where French companies faced security risks from AI use: employees leaked confidential data by using free public AI tools to translate sensitive documents, an organization over-relied on AI for partner evaluation decisions without human oversight, and a company was targeted by a deepfake video fraud attempt impersonating its CEO.
What happened
The French domestic intelligence agency DGSI reported three cases where French companies faced AI-related security risks. In the first case, employees of a multinational company used free public AI tools including ChatGPT and Gemini to translate sensitive internal documents without authorization, copying confidential information into these systems.
In the second case, an organization delegated the evaluation of commercial partners entirely to an AI system without human oversight. In the third case, a company was targeted by a video fraud attempt using deepfake technology to impersonate the CEO and request an urgent fund transfer, which was prevented by verification checks.
Reported impact
The DGSI highlighted that free AI services store user-submitted data on foreign servers subject to extraterritorial laws, potentially allowing foreign powers to access confidential business information. The agency noted that data used for AI model training could resurface in responses provided to competitors.
The DGSI identified multiple risks from delegating business decisions to AI systems, including algorithmic bias, inability to understand the reasoning behind results, and the risk of AI hallucination that produces statistically probable but not necessarily accurate or relevant answers.
Index analysis
The incidents illustrate the vulnerability of companies using free, publicly available AI tools without understanding the data retention and training practices of these services, particularly when servers are located outside France and subject to foreign legal frameworks.
The cases demonstrate how AI systems can introduce vulnerabilities through both unintentional employee misuse and deliberate fraud tactics, and how overreliance on AI for critical business decisions without human verification creates significant risks.
Governance controls
The DGSI issued a warning calling for stricter oversight and governance of AI technologies in companies. The agency advised companies to deploy paid, secured AI solutions rather than relying on free services with unclear data handling practices.
The DGSI recommended caution regarding integration of AI functionalities through plugins or APIs into business software, and emphasized the need for human verification of AI-generated decisions, particularly in fraud prevention contexts.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.