Viral Artificial Intelligence (AI) trends are all over social media, from caricature generators to prompt-based challenges. They are also increasingly finding their way into the workplace. But what starts as harmless experimentation can quickly become a security risk. Participating in these trends involves sharing personal and work-related information through public tools outside an organisation’s control. This creates both personal and organisational exposure, including the risk of identity theft and data leakage, and fuels the growth of shadow AI, where unauthorised tools are used without visibility or governance. Cybersecurity and compliance specialists play a vital role in helping businesses understand how AI tools are being used within their organisation, and in putting controls in place to mitigate the risk.
Just a harmless trend?
While these trends may seem like “just a bit of fun”, viral AI trends often encourage users to share more information than they realise. Generating an image or participating in a prompt challenge may require uploading photos, describing job roles or providing contextual detail about daily work.
When this output is shared publicly on social media, it can expose personal and business information to bad actors, who may use it to craft targeted phishing and social engineering attacks..
In some cases, employees also share images or videos of their work environments, which can reveal identifying features. This type of exposure is difficult to monitor and often falls outside traditional security controls.
A management challenge
In addition to the inherent risks of participating in AI trends, the same tools used to create viral content are frequently used for work-related tasks. Public AI tools are readily accessible, and many applications have AI built in, but this technology may not be approved or managed by the organisation, which makes it a security risk.
This is known as Shadow AI, and it creates a significant visibility challenge for businesses.
Different teams may be using different tools for different purposes, often without central oversight. In some cases, organisations already have approved AI platforms in place, but employees continue to use their own tools because they are more convenient or better suited to a specific task.
If organisations do not understand how and why AI is being used, they cannot manage the associated risks. At the same time, trying to block access entirely is unlikely to be effective: employees will continue to use these tools where they see value.
The risk is in the details
Without visibility, organisations have limited control over the type of information being shared, and this is where the risk of data exposure most often originates.
When prompts include detailed information, there is a much higher likelihood that sensitive data is being shared. This can include client information, internal reports, financial data, or proprietary code. Even voice-based inputs can introduce risk, as users may inadvertently share confidential information while speaking.
Once this information is entered into a public AI platform, it is no longer within the organisation’s control. Furthermore, such data could be used to support more advanced cyberattacks, including deepfake scenarios where voice or image data is used to impersonate individuals.
Blocking AI is not the answer
A common response to these risks is to restrict or block access to AI tools, but this will not solve the problem. AI is already widely available and embedded in many platforms, including in tools that people use every day. It is simply not realistic to prevent employees from using it entirely.
A more effective approach is to understand how AI is being used within the organisation and to guide that use in a controlled way. This includes identifying valid use cases, providing approved tools where possible, and setting clear guidelines on what information can and cannot be shared.
Working within recognised frameworks such as ISO standards for AI governance, including ISO 42001, helps organisations define how AI should be used within their specific context. Th.ese frameworks focus not only on controls, but on governance, ensuring that AI use is monitored, reviewed, and improved over time.
Cybersecurity and compliance specialists support this by helping organisations assess their current exposure, identify gaps, and implement practical controls. They also play a role in raising awareness, as many users do not fully recognise the risks associated with sharing information through AI tools.
AI must be managed, not ignored
AI is already part of the workplace, and its use will continue to grow. The risk lies in organisations lacking visibility into how it is being used or failing to guide that use effectively.
Organisations need to adopt a structured approach to reduce data exposure, manage emerging threats and make use of AI in a controlled way. As AI becomes more embedded in daily work, managing how it is used is essential to both cybersecurity and good corporate governance.
Working with an experienced cybersecurity and compliance partner can help organisations gain a clear understanding of how AI is being used and put the right controls in place to leverage the benefits without introducing unnecessary risk.
