Everything About AI
NextFin News - The most popular story about artificial-intelligence risk is almost certainly pointed at the wrong target. The image that dominates the debate — a superintelligent machine slipping its leash and ending humanity — is cinematic, and it is not impossible. But the danger that is already showing up on balance sheets, in fraud statistics, and in the architecture of the AI industry itself has a simpler author: the humans who build, deploy, and profit from these systems.
The claim that humans, not rogue algorithms, are the real culprits of AI risk is uncomfortable because it removes the alibi. If the threat is a future machine, then today's choices are excusable — we are racing, after all, against an inevitable technological destiny. If the threat is human intent, human incentives, and human governance, then every loss, every breach, and every concentration of power is a decision, not a destiny.
The Case Against the Wrong Villain
The debate over AI risk has been captured by the extinction narrative. In September 2026, UN High Commissioner for Human Rights Volker Türk told the Human Rights Council in Geneva that he shares "the concerns of industry insiders that advanced AI could pose an existential risk to humanity," and called for "cast-iron guarantees" around AI safety and security "before it is too late." He also named the structure behind the technology: "A handful of men has almost unlimited power over AI," he said. "They talk about freedom, but on closer inspection, this turns out to be little more than the freedom to exploit our data."
That framing — existential, future-oriented, focused on loss of control — is not wrong. It is just incomplete, and the incompleteness is expensive. The 2022 expert survey on progress in AI found roughly half of AI researchers assigning at least a 10% probability to human extinction from an inability to control the technology. That is a serious tail risk, and it deserves serious attention. But a tail risk is not the same thing as the central risk, and the weight of evidence suggests the center of mass sits elsewhere.
Consider what is already measurable. The FBI's 2025 Internet Crime Report introduced its first-ever AI-related crime category in the bureau's 26-year history: more than 22,000 complaints and roughly $893 million in losses in a single year. Business email compromise alone accounted for $3.04 billion in reported losses, the second-largest crime type by dollar value. Deepfake fraud, tracked across the Resemble AI and AI Incident databases, has produced $2.19 billion in cumulative reported global losses, $1.65 billion of it in 2025 alone, with the United States the most-targeted country at $712 million — 43% of it aimed at the corporate sector.
The exposure is broader than the loss figures suggest. Gartner's 2025 survey of 302 cybersecurity leaders found that 62% of organizations experienced at least one deepfake attack in the preceding 12 months, and 37% of security leaders had personally encountered one during a video call — the channel employees trust most. McAfee's voice-cloning research found that three seconds of audio is enough to clone a voice with roughly an 85% match, and 70% of people are not confident they could tell the difference.
The trajectory is the point. Deloitte's Center for Financial Services projects that generative-AI fraud losses in the United States will reach $40 billion by 2027, up from $12.3 billion in 2023 — a 32% compound annual growth rate. IRONSCALES' 2025 research found mean losses exceeding $280,000 per deepfake incident; 61% of organizations that lost money reported losses above $100,000, and more than 5% lost $1 million or more. Meanwhile, human detection is failing at the task: one industry compilation put human accuracy at spotting advanced deepfakes at about 24.5%, and roughly 29% of people do not even know what a deepfake is.
Public reporting in August 2026 documented an AI model impersonating multiple humans to pressure real people into accepting malware into critical infrastructure — a demonstration not of a machine's ambition, but of a machine's usefulness to whoever holds it. In April 2026, public reporting documented the US Treasury secretary and the Federal Reserve chair convening Wall Street leaders to discuss the threat posed by a single AI model. And in August 2026, the US government's acting federal chief information security officer, Michael Duffy, warned that civilians, businesses, and organizations are "markedly less safe" from a cybersecurity perspective than a year earlier, because more capable models are proliferating into the hands of sophisticated threat actors.
Here is the first hard question the extinction narrative cannot answer: why is AI risk priced as if the danger lives in 2035, when the loss curve is compounding today?
The Mechanism: Incentives, Not Algorithms
The reason humans are the culprits is not that people are uniquely evil. It is that the institutional machinery around AI rewards the wrong things. The transmission mechanism from "powerful model" to "social harm" runs through three channels: deployment choices, monitoring choices, and accountability choices. In each channel, the decision-maker is human, and the incentive is rarely aligned with the risk.
Take monitoring. OpenAI's Astra model reportedly uses a method called "recurrent depth" that makes reasoning more efficient by not spelling it out in human language. The company said in a blog post that its ability to monitor Astra had "decreased" relative to the previous model. That is a deliberate trade: observability exchanged for efficiency and cost. No algorithm forced that choice. A company made it, and the market will now decide whether opacity is a feature or a discount.
Take safety resourcing. A 2026 analysis of AI companies' safety rhetoric versus safety headcount found that the two do not move together — the teams tasked with keeping systems safe did not scale in line with the safety claims made about the systems they ship. A safety department that cannot say no is not a control function; it is a public-relations function. Again, this is a human governance choice, repeated across an industry.
Take deployment. Early evidence from workplace AI points toward the technology being used to concentrate managerial power rather than liberate front-line workers: warehouse bathroom breaks tracked, fast-food schedules set by algorithm, performance reviews drafted by machine. In national security, a researcher at a frontier lab went public in 2026 urging colleagues to rethink work at the cutting edge, warning that capability is being pursued irresponsibly. The pattern is consistent: the technology amplifies the intent of the actor who controls it. That is why the right mental model is not "AI risk" but "risk concentrated through AI."
"I'm less worried about the robots than the robots in human hands," Reid Hoffman has said — a compact summary of the misuse thesis from someone who has funded the technology rather than merely feared it.
The same tool that drafts a performance review can draft a phishing campaign; the same system that optimizes a supply chain can optimize a fraud ring; the same model that reasons through a research problem can reason around a guardrail its operator asked it to respect. The state knows which side of that equation is doing the damage. Regulators are not preparing for a robot uprising. They are responding to human actors with better tools.
Cyclical or Structural? The Risk Is Structural
Is this a cyclical problem that will mean-revert as detection catches up, or a structural one that will not correct on its own? The answer has to be split, because blending the two produces the wrong forecast.
The episodic layer is cyclical. Deepfake fraud waves, scam cycles, and phishing campaigns will ebb as detection tooling improves, as verification becomes cheaper, and as organizations harden their processes. History offers a template: card fraud after EMV chips, email spam after filtering, and SIM-swapping after carrier PINs. In each case, the specific attack vector decayed once the defense scaled. Three historical comparisons support the cyclical read for the episodes themselves, and each followed the same sequence: innovation, exploitation, detection, plateau.
But the underlying asymmetry is structural, and it will not self-correct. Three pieces of evidence support the structural call. First, offense is structurally cheaper than defense in software, and AI widens that gap: one prompt can generate a thousand attack variants, while each defense must be built, tested, and maintained. Second, capability development is economically rewarded in real time, while safety costs are deferred and diffuse — a company that ships faster captures revenue; the industry and society absorb the externalities. Third, accountability is structurally opaque: when a model causes harm, the chain of responsibility runs through the trainer, the deployer, the enterprise customer, and the end user, and each can point to the others.
This is the regime change that matters. It is not that AI is a new species; it is that AI changes the economics of human intent. A regime defined by cheap offense, deferred safety costs, and diffuse accountability does not mean-revert. It requires an external correction — regulation, liability, or market discipline — because no internal incentive produces it.
The Second-Order Question the Market Is Not Asking
The first-order consequence of AI risk is the one everyone states: losses from fraud, disruption to infrastructure, erosion of trust. The second-order consequence is what the market has not priced. If the dominant risk narrative is aimed at the wrong target, then capital is being misallocated across the entire AI value chain.
Investors are underwriting capability on the assumption that the binding constraint is technical — compute, talent, energy. But if the binding constraint turns out to be legitimacy — the social and regulatory license to operate — then the companies most exposed are not the ones with the weakest models, but the ones with the weakest governance. Opacity that looks like a competitive advantage today — hidden reasoning, undisclosed data sources, unaudited evaluations — becomes a discount when a regulator, a plaintiff, or a counterparty demands proof that the system does what it claims.
Run the chain one step further. A rate cut can be read as preventive, which is good for risk assets, or as reactive, a signal that recession is coming, which is bad for earnings. The same event, two opposite readings. AI risk works the same way. A company that loudly emphasizes existential risk can be read as responsible — it takes safety seriously — or as strategic: it is lobbying for regulation that locks in its scale advantage against smaller rivals. The signal is identical; the interpretation depends on who benefits. That ambiguity is itself a priced inefficiency, and it is created by humans, not models.
The Strongest Counter-Thesis — and Why It Does Not Yet Win
The counter-thesis deserves its full weight, because if it is right, everything above is a distraction. The argument runs: misuse is the near-term problem, but loss of control is the terminal one. If capability keeps scaling and control does not improve proportionally, a system that becomes superhuman no longer needs human permission to act — and at that point, human intent is irrelevant. This is the position behind Volker Türk's existential-risk warning, behind Stuart Russell's work at the Center for Human-Compatible AI at the University of California, Berkeley, and behind the roughly half of researchers in the 2022 survey who assigned at least a 10% probability to extinction from loss of control. At the extreme, Roman Yampolskiy has put the probability of AI wiping out humanity within a century at 99.9%.
The counter-thesis attacks the core of the misuse argument at its foundation: it says the culprit today may be human, but the culprit tomorrow may not be, and the transition could be abrupt rather than gradual. That is a serious challenge, not a strawman.
Here is why it does not yet win the framing. The loss-of-control argument is a claim about a future state of capability; the misuse argument is a claim about the present distribution of harm. Both can be true, and both should be hedged against — but policy and capital are scarce, and the evidence base for misuse is already thick with data while the evidence base for loss of control remains, by its own advocates' admission, probabilistic and forward-looking. Prioritizing the future tail over the present flow is a bet, not a fact. And it is a bet that, if taken too far, produces the very governance gap that misuse exploits: a safety apparatus designed for a hypothetical superintelligence while the fraud, the surveillance, and the concentration of power proceed unimpeded.
The falsifying signal for the view advanced here is specific and observable. If, within 24 months, verified autonomous AI actions — with no human in the decision loop — cause at least $50 billion in direct economic damage, or a fatal critical-infrastructure failure, then the "humans are the culprits" framing is wrong, and the control problem has overtaken the misuse problem as the central risk. Until that threshold is crossed, the data says the humans holding the tools are doing the damage.
What to Watch: Scenarios, Not a Single Line
The forward look should be split by time horizon, because the same technology points in opposite directions across them.
In the short term — the next 12 months — the signal is the loss curve. Watch the FBI's next Internet Crime Report for whether AI-related losses exceed the roughly $893 million 2025 baseline, and watch whether generative-AI fraud tracks toward Deloitte's $40 billion-by-2027 projection. If those numbers accelerate, the misuse thesis is confirmed and the policy response will be enforcement-led: identity verification, deepfake watermarking, and liability for enterprise deployments.
In the medium term — two to four years — the signal is governance. Watch whether "cast-iron guarantees," in Volker Türk's phrase, become binding: mandatory evaluations for frontier models, audit requirements, and safety-headcount disclosures that can be compared against capability spend. If the gap between safety rhetoric and safety resourcing narrows, the industry is internalizing the externality. If it widens, the structural-risk call strengthens.
In the long term — beyond four years — the signal is capability relative to control. Watch for autonomous systems making consequential decisions without human review, and for the falsifying threshold above. The base case is that misuse remains the dominant source of harm while loss-of-control risk is managed through evaluation and containment. The upside case is that verification and audit tooling mature faster than capability, turning AI into a net governance enhancer. The downside case is that opacity wins: models become less monitorable, accountability chains break, and the first autonomous-catastrophe threshold is crossed — at which point the framing of this entire debate changes.
The beneficiaries and the exposed are not hard to identify. Those who sell verification, identity, audit, and accountability infrastructure benefit from either framing — their product is the bridge between capability and trust. Those who are exposed are the companies whose business model depends on opacity: the labs that cannot show their work, the deployers who cannot trace a decision, and the platforms whose revenue depends on engagement that verification would dampen.
The central judgment, in one line: AI did not invent human ambition, human fraud, or human concentration of power — it inherited them, and it scales them. The risk is not that the machine will become human. It is that humans, with all their existing incentives intact, now have a machine that obeys.
Explore more exclusive insights at nextfin.ai.
