AI Cyber Threats: The Monster Also Builds the Shield

Written by

in

Policy documents and office files representing AI governance and regulatory review
Policy documents and office files representing AI governance and regulatory review

There are some stories that are so neat they almost feel planted.

South Africa has had to withdraw an early draft of its national AI policy after it was found to contain fictitious and potentially AI-generated references. The policy was meant to help position the country as a leader in artificial intelligence. Instead, it became a case study in one of AI’s most basic risks: it can sound clever while making things up. Reuters reported that an independent panel has now been appointed to review the policy, with a revised version expected for public comment by January 2027.

That is not just embarrassing.

It is perfect.

A government document about regulating AI appears to have been undermined by the exact sort of AI problem the policy should probably have warned about.

You could not design a cleaner metaphor if you tried.

The problem is not that AI made a mistake

AI makes mistakes. That is not news.

Anyone who has used ChatGPT, Claude, Gemini, Copilot, or any similar tool for more than ten minutes knows this. These systems can be incredibly useful. They can summarise, structure, draft, explain, brainstorm, translate, analyse, and generally act like a very fast assistant with no coffee breaks and no sense of shame.

But they can also produce complete rubbish with the confidence of a senior consultant billing by the hour.

That is the real issue.

Not the error itself.

The confidence.

AI does not always say, “I’m not sure.” It often says, “Here you go,” and hands you something that looks finished. It gives you headings, citations, polished language, impressive structure, and the general aroma of competence.

And because it looks like work, people mistake it for work.

That is where things go wrong.

The danger is the handover point

The South Africa story is not really about whether someone used AI.

Of course governments will use AI. So will businesses, universities, councils, police forces, law firms, hospitals, journalists, charities, and everyone else currently pretending they are “exploring the technology” while quietly pasting things into chatbots.

The issue is not use.

The issue is supervision.

AI is not dangerous because it drafts. AI is dangerous because people stop checking the draft.

That is the thin, boring line between productivity and public humiliation.

If an AI tool creates a reference list, someone still needs to verify the references exist.

If an AI system summarises evidence, someone still needs to check the evidence.

If an AI model proposes policy, someone still needs to understand the policy.

If an AI tool helps write a risk assessment, someone still owns the risk.

This is the bit that will separate serious organisations from performative ones.

The serious ones will build verification into the process.

The performative ones will generate documents faster, publish them sooner, and then act surprised when the wheels come off.

“Human oversight” cannot just mean a human was nearby

One of the great phrases of the AI age is going to be human oversight.

It sounds reassuring. Sensible. Adult.

But it can mean almost anything.

A human clicked “approve.”

A human skimmed the output.

A human forwarded the document.

A human sat in the meeting where the thing was discussed.

That is not oversight. That is scenery.

Proper human oversight means someone competent has checked the output against reality. It means the human is not just present, but responsible. It means they understand the tool well enough to know where it fails. It means the boring checks still happen.

Especially the boring checks.

Because AI failure is often not dramatic.

It is not always a robot going rogue. Sometimes it is a fake academic paper in a reference list. Sometimes it is a wrong legal citation. Sometimes it is a made-up quote. Sometimes it is a spreadsheet formula that looks fine until it quietly ruins a budget.

The failures are small until they are not.

This is why AI literacy matters

AI literacy does not mean everyone needs to become a machine learning engineer.

Most people do not need to understand the maths. They do not need to train models, fine-tune transformers, or pretend they know what a vector database is at networking events.

But they do need to understand the behaviour.

They need to know that AI can hallucinate.

They need to know that fluency is not accuracy.

They need to know that a confident answer is not the same thing as a correct one.

They need to know that citations, names, dates, case law, policies, academic papers, technical standards, statistics, and quotes are all high-risk areas.

They need to know when to use AI as a drafting assistant and when to treat it like a suspicious intern who has just discovered Wikipedia and cocaine.

Helpful? Yes.

Fast? Definitely.

Reliable without checking? Absolutely not.

The irony is funny, but the lesson is serious

It is easy to laugh at a government AI policy being pulled because of allegedly AI-generated fake references.

And we should laugh a bit.

Because come on.

But the more serious point is that this will not be the last time. In fact, it is probably happening everywhere already. The only difference is whether anyone notices before publication.

AI is being introduced into systems that already had weak checking, vague accountability, overloaded staff, and a deep institutional love of polished documents nobody properly reads.

That is fertile ground for artificial confidence.

The machine produces confident output.

The organisation performs confident governance.

The public gets confident language.

And somewhere underneath it all, nobody has checked whether the source exists.

The future belongs to people who can verify

There is a lot of talk about prompt engineering, automation, agents, workflows, and productivity gains.

Fine. All useful.

But the underrated skill of the AI age may be verification.

Can you check the claim?

Can you trace the source?

Can you test the output?

Can you spot when something sounds right but feels thin?

Can you tell the difference between a useful draft and a dangerous one?

That is where the value is going to be.

Not blindly rejecting AI.

Not blindly trusting it.

Using it aggressively, but checking it ruthlessly.

That should be the standard.

AI is not the problem. Unchecked confidence is.

This story does not prove that AI should be kept away from government policy. That would be the wrong lesson.

AI can absolutely help policymakers. It can compare international approaches, summarise consultation responses, identify gaps, model impacts, explain technical concepts, and help turn dense material into something readable.

That is good.

But if AI is helping shape the rules of the future, then the people using it need to be better than the tool. They need to bring judgement, scepticism, domain knowledge, and responsibility.

Otherwise we are not using AI.

We are laundering guesses through professional formatting.

The South Africa case is embarrassing, but useful. It gives every organisation a simple warning:

Before you announce your AI strategy, make sure your AI has not invented the footnotes.

Because the future may be artificial.

But the accountability will still be human.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *