← All lab updates
When people trust the machine too much: ten AI-specific weak spots attackers can use
Most AI security work looks at the model. Many incidents start with the person reading its answer: a confident reply accepted without a check, an assistant treated like a colleague, a voice that sounds right. The Cybersecurity Psychology Framework (CPF3) lists ten of these AI-specific weak spots. Here they are in plain words, with what to do about each group.
## The attacker's shortcut
Breaking a model is hard. Getting a person to act on what a model says is easier. An invented figure in a summary, an instruction slipped into a document the assistant reads, a cloned voice on a call: each one works only if someone trusts the output enough to skip the check.
The Cybersecurity Psychology Framework (CPF3) maps the pre-conscious habits that make people exploitable. One of its ten categories is dedicated to AI.
## The ten AI-specific weak spots
| | Weak spot | In plain words |
|---|---|---|
| 9.1 | [Treating the AI as a person](https://cpf3.org/indicators/9-1-anthropomorphization-of-ai-systems/) | Sharing secrets or granting permissions because the assistant "feels" like a colleague |
| 9.2 | [Automation bias](https://cpf3.org/indicators/9-2-automation-bias-override/) | Letting the machine's answer override your own judgement |
| 9.3 | [Algorithm aversion](https://cpf3.org/indicators/9-3-algorithm-aversion-paradox/) | The opposite swing: ignoring a correct alert after one mistake |
| 9.4 | [Authority transfer](https://cpf3.org/indicators/9-4-ai-authority-transfer/) | "The AI said so" becoming a reason that needs no approval |
| 9.5 | [Uncanny valley](https://cpf3.org/indicators/9-5-uncanny-valley-effects/) | Discomfort with near-human AI that distorts decisions |
| 9.6 | [Trust in what you cannot see](https://cpf3.org/indicators/9-6-machine-learning-opacity-trust/) | Trusting a system more because nobody can explain it |
| 9.7 | [Accepting invented facts](https://cpf3.org/indicators/9-7-ai-hallucination-acceptance/) | Taking a fluent, confident answer as a checked one |
| 9.8 | [Human-AI team breakdown](https://cpf3.org/indicators/9-8-human-ai-team-dysfunction/) | Nobody owning the decision when a person and an AI share it |
| 9.9 | [Emotional manipulation by AI](https://cpf3.org/indicators/9-9-ai-emotional-manipulation/) | Being moved by warmth, urgency or flattery in a generated message |
| 9.10 | [Fairness blindness](https://cpf3.org/indicators/9-10-algorithmic-fairness-blindness/) | Missing that a system treats some people worse |
## What to do, in three moves
1. **Put a check where money, data or permissions move.** Any action an AI suggests in those three areas gets a second, human confirmation through a separate channel. This covers 9.2, 9.4 and 9.7 at once.
2. **Name the owner.** For every AI-assisted decision, one person signs it. That is the fix for 9.8, and it also slows down 9.1.
3. **Read the model too.** The human weak spots are amplified when the model itself flatters, invents or gives in under pressure. That is the side we read and correct: a model that holds its ground leaves people fewer chances to trust the wrong thing.
## Try it
The CPF3 [quick scan](https://cpf3.org/scan/) asks one question per indicator and returns a map of where an organisation is exposed. It takes about ten minutes.
## Go further
- [How CPF3 maps onto model behaviour](/cpf-mapping)
- [AI sycophancy, explained](/news/tutorials/ai-sycophancy-explained-five-minute-check)
This update is not available.