France’s DGSI warns of real‑world risks from shadow AI in companies

France’s DGSI is effectively saying the AI risk conversation inside companies is already behind the curve. The agency’s examples—staff routinely pasting contracts into public LLMs, critical decisions delegated to black‑box scoring models, deepfake executives trying to trigger urgent fund transfers—are a snapshot of how quickly shadow AI has become embedded in workflows without governance.

For AGI observers, this is an early look at what happens when powerful models are deployed in messy human organizations long before formal controls or literacy catch up. Even if today’s systems are far from general intelligence, the combination of plausibility, opacity and automation is enough to create new attack surfaces and cognitive traps. As models become more agentic and are given broader API access, these issues compound.

The upshot is that the race to AGI isn’t just about more capable models; it’s about whether enterprises can build guardrails fast enough to avoid self‑inflicted wounds. Security and intelligence agencies stepping in with concrete case studies will likely accelerate internal policy‑making and push vendors toward features like enterprise‑grade logging, data‑use guarantees and deepfake‑resistant verification flows.