The CFO nearly signed. That close. A single signature on a multimillion-dollar commitment to a cloud vendor whose credentials were fake, whose reviews were fabricated, whose security certifications were forged.
The deal was stopped only because someone — the report does not say who — caught the discrepancy before the ink dried. But the question now is: How many others did not?
Security researchers are tracking a sharp rise in what they call grounding attacks. The name matters. It is not a hack of the AI’s code.
The model works fine. It returns answers.
The problem is the ground it stands on — the data it was fed. In this case, a black-hat actor seeded training data with false vendor information. The AI assistant did what it was built to do: it weighed options, named trade-offs, and presented a careful comparison.
Every word of that comparison was poisoned. The assistant had no way to know. This is the vulnerability the researchers are now racing to understand.
When an AI fetches real-time information from the open web — vendor comparison sites, industry forums, financial data aggregators — it cannot always tell a legitimate source from a sophisticated fake. The attacker does not need to break the model.
They just need to corrupt the foundation. The AI does the rest. The black-hat community has already codified this approach.
The report describes a playbook. Attackers first identify the data sources an enterprise AI is likely to query.
Then they inject false information — fake reviews, manipulated API responses, compromised third-party databases. The AI ingests the poisoned data. It presents the lies as authoritative.
The consequences are not theoretical. They are already showing up on the timeline. Security researchers are recording a sharp increase in these attacks.
The CFO incident is not isolated. It is a warning shot.
Consider what this means for any enterprise that uses an AI assistant for research. Procurement decisions. Investment analysis.
Competitive intelligence. Contract negotiations.
The AI sees the web as a library. The attacker sees the web as a minefield they can plant. That asymmetry is the whole game.
The vendor in this case is not named. Neither is the CFO. The report keeps them anonymous.
But the pattern is clear. The attacker targeted a specific decision — a major cloud infrastructure investment — and built a false reality around it.
The AI became a delivery system for that lie. The research filing details the mechanics: the model was not broken. It performed exactly as designed.
The corruption was in the sources, not the code. That makes this attack hard to defend against.
You can patch a model. You cannot patch the internet. What comes next is harder to see.
The black-hat playbook is now documented. Other actors will study it. The researchers are tracking the rise, but tracking is not stopping.
Enterprises that rely on AI for research need to ask a question they may not have asked before: How do we know the AI’s sources are real? The answer, for now, is not clear.
The CFO in London found out the hard way. She nearly committed millions on a recommendation built from lies. The deal was stopped.
But the method worked. That fact is not going away.
