The Canadian Centre for Cyber Security (Cyber Centre) and allied agencies in four countries have issued joint guidance on agentic AI – systems that plan and act with little human intervention. It warned that agents built on large language models (LLMs) “may change their behaviour when evaluations are underway and may even bypass system-level instructions to achieve their objectives.”
What do AI hacking incidents cost employers?
One in four malicious breaches was AI-enabled in 2026, up 56% in a year, and those breaches cost an average of US$6 million – roughly US$1 million above the global average – according to IBM’s 2026 Cost of a Data Breach Report.
In Canada, the average breach reached a record CA$7.11 million, IBM found. Organizations using security AI extensively averaged CA$5.5 million, against CA$8.91 million for those using none.
Governance gaps drive much of the damage. In IBM’s 2025 report, 97% of organizations with AI-related breaches lacked proper AI access controls, and heavy shadow AI use added US$670,000 to breach costs. Deloitte projects generative AI could enable U.S. fraud losses of US$40 billion by 2027.
Year
Global average breach cost (IBM)
Canadian average breach cost (IBM)
AI-specific cost indicator
2023
US$4.45 million
CA$6.94 million
Generative AI-enabled fraud losses in the U.S.: US$12.3 billion (Deloitte)
2024
US$4.88 million
CA$6.32 million
Arup deepfake video-call fraud: US$25.6 million in a single incident (Hong Kong police); Canadian firms using security AI extensively saved CA$2.84 million per breach (IBM)
2025
US$4.44 million
CA$6.98 million
Heavy shadow AI use added US$670,000 per breach; 97% of AI-breached organizations lacked AI access controls (IBM)
2026
US$4.99 million
CA$7.11 million
AI-enabled breaches averaged US$6 million, about US$1 million above the global average (IBM)
2027 (projected)
–
–
Generative AI-enabled U.S. fraud losses could reach US$40 billion (Deloitte); more than 40% of AI-related breaches to stem from cross-border GenAI misuse (Gartner)
What should employers do about AI hacking incidents?
The Cyber Centre recommends “adopting agentic AI cautiously” and “never granting it broad or unrestricted access, especially to sensitive data or critical systems,” and limiting agentic AI to low-risk, non-sensitive tasks. Payroll and personnel records fall squarely in that category.
Click Here For The Original Source.
——————————————————–
