Authorization Abuse

Authorization abuse occurs when a user or system with legitimate access to an AI application exploits that access in ways beyond their intended role or permissions. This includes scenarios like an employee using a generative AI tool to extract confidential business data, a contractor accessing model training pipelines they should only observe, or an AI system performing actions on behalf of a user without explicit consent for each action. For compliance and governance, authorization abuse matters because it bridges the gap between security controls and insider risk: strong passwords and multi-factor authentication may prevent unauthorized login, but they cannot stop someone already inside from misusing their legitimate credentials to bypass guardrails, exfiltrate sensitive information, or manipulate AI outputs in ways that create legal or reputational harm.

1 item