What We Learned
Never give one AI every key
From VISIT Summit 2026 in Gothenburg. One of eight insights we took home from three days and 26 sessions.
The next security incident in hospitality might not look like a break-in. It might look like an AI agent doing exactly what it was asked. At VISIT Summit 2026, Thibault Miclo explained how to stop that from happening.
People are still the easiest way in
Most attacks still start with a person, not a system. A phone call is now the second most common way attackers get into an organization, according to the Mandiant M-Trends 2026 report cited in the session. The most expensive attacks discussed cost their companies billions of kronor, and none of them involved AI. The basics still decide most outcomes: who can call your staff, what they can be persuaded to do, and how fast you notice.
The new risk has three ingredients
AI agents add a new kind of risk on top. An agent becomes dangerous when it has three things at the same time. It reads content from outside, such as emails, reviews or web pages, which someone else can write. It has access to private data, such as guest records or bookings. And it has a way to send information out, such as sending an email or calling another system.
With all three, an attacker does not need to break in. They only need to hide an instruction in something the agent will read. Remove any one of the three, and the problem goes away. An agent that reads outside content but cannot reach private data is safe. So is one that can reach private data but cannot send anything out.
Most organizations do not know what they have
The survey figures in the session showed how far most organizations are from that kind of control. 82% have AI agents running that nobody owns. 65% have already had an incident. 68% believe they can see their agents, but only 21% say they could switch one off if they had to.
The rules are arriving
The EU AI Act’s transparency requirements, which include telling people when they are dealing with an AI, already apply. The rules for high-risk systems have moved to December 2027. For most hospitality businesses, the practical work is the same either way: know which agents you run, what they can reach, and who is responsible for them.
What to do
- Make a list of every AI agent and integration you use, and give each one an owner.
- Make sure that owner can switch the agent off.
- Never give one agent outside input, private data and a way out at the same time.
- Train your team for the call that sounds like a colleague or a supplier.
Heard in: Protecting Your Organisation in a Changing World (Thibault Miclo, VISIT)