AI data poisoning is when someone corrupts the information an AI uses to answer questions, causing it to return wrong or harmful results without any warning. It is happening to businesses right now — including businesses right here in the Triangle — and most of them will not know it until something goes wrong.
Here is what it looks like in real life.
In May 2024, a man in Winnipeg asked Meta AI to verify a Facebook customer service number. Meta AI confirmed it was a legitimate support number. He called it. By the time it was over, a $500 gift card had been charged to his PayPal and his bank had blocked a bitcoin purchase attempt. CBC News reporters called the same number and had the same experience.
A neighbor of ours needed tech support. She searched for the company’s phone number, found one, called it, and spent forty-five minutes giving a very helpful stranger access to her computer and her bank account. The number she found was fake. Someone had put it on the internet specifically to be found by people in exactly her situation.
Dottie had a version of the same experience last February. She was trying to return a blouse. The number she got came not from a search but from an AI assistant. She got suspicious thirty seconds in, asked the man a question he could not answer, and hung up. (She has excellent instincts about people. It is one of the primary reasons I married her. The other reasons are classified.)
The attack in both cases was identical. Someone planted a fake phone number where people would find it. Our neighbor found it by searching. Dottie nearly called it because an AI found it first and handed it to her like a trusted source.
That is AI data poisoning. And it does not stop at phone numbers.
What Is AI Data Poisoning?
There are three ways bad actors corrupt AI tools. None of them require breaking into your systems.
They plant bad information where your AI will find it. AI tools do not know things on their own. They pull information from the internet, from your documents, from databases. Attackers flood those sources with false information, fake phone numbers, bad websites, and wrong guidance, until the AI retrieves it and hands it back like a trusted source. The AI hands it to you with complete confidence because it has no way to know it was planted. Research published in December 2025 found a 36 percent mismatch rate between phone numbers AI tools returned and the actual verified numbers for those businesses. AI tools provided a phone number 91 percent of the time when asked.
They slip bad files into your system. If your AI has access to your documents or records and someone quietly changes one of those files, your AI learns from the changed version. It does not know anything was altered. It just does its job. Everything it produces from that point forward is built on a bad foundation.
They hijack what your AI does mid-task. By hiding instructions inside documents or data your AI is reading, attackers can quietly redirect what the AI does next. No dramatic takeover. Just a small redirect that sends the output somewhere useful to them.
Digit’s Rule 4: The confidence of your AI’s answer is not proof the answer is correct.
The Story That Took Four Months to Find
A small professional services firm connected their AI assistant to their internal files, templates, compliance documents and client forms. The AI was helpful and confident the entire time, and it had no idea anything was wrong. Nobody did.
Someone got in through a convincing phishing email. Before you think “our people would not fall for that,” this employee had been with the firm for nine years. It was a good email. Good people fall for good emails. The attacker changed two documents, just slightly, and left. The AI learned from the changed versions. Started quietly producing wrong guidance. Three months later a client failed an audit. The firm spent weeks figuring out where it went wrong.
The AI was confident and helpful the entire time. It had no idea anything was wrong. Neither did anyone else.
(My cats operate with this exact quality. Completely calm, treat bag inexplicably lighter than it should be, and three innocent faces arranged in separate corners of the room. I mention them because the parallel is exact and I find it equally irritating in both cases.)
The government agencies that track cyberthreats for a living – including the NSA, CISA, the FBI, and their counterparts in Australia, New Zealand, and the United Kingdom – issued a joint warning in 2025 specifically about this type of attack. Six agencies from five countries do not coordinate on paperwork because things are fine.
Why AI Data Poisoning Affects Small Businesses
I hear this from business owners regularly, including plenty here in the Raleigh area: “We’re too small to be a target.”
That assumes someone made a list of businesses worth attacking and left you off it. Nobody makes that list. Attackers go after whatever is accessible. Accessible is not about size. It is about gaps in your setup. Whether you run a dental practice in Cary or an HVAC company in Garner, you have those gaps. Every business does. The only question is whether you find them before someone else does.
Digit’s Rule 11: “Probably fine” is a threat waiting for a timeline.
How to Protect Your Business from AI Data Poisoning
Write down every AI tool you use. Every app, every plug-in, every piece of software that says “smart” or “AI-powered” anywhere in its description. You cannot protect what you have not identified.
Know what files your AI can access. If your AI pulls from your documents or records, check those files regularly for anything that does not look right. Keep the list of people who can add or change those files short and know who is on it.
Verify any phone number or contact your AI gives you. Go to the company’s official website and look it up there. Do not ask the AI to double-check its own answer. That is like asking a witness to confirm their own alibi. Dottie does this every time now. She has also told approximately everyone she knows to do the same, which is honestly better reach than most of our marketing.
Put a human check on anything important. Anything involving money, contracts, compliance, or customers should have a person reviewing it before it becomes final. AI is a tool. Tools need operators.
Ask your AI vendors direct questions. Where does the AI get its information? Who controls what it learns from? What happens if something goes wrong? If the answer sounds like a brochure, that is your answer.
Digit’s Rule 7: The vendor who cannot answer a direct question about security has already answered your question about security.
One Thing Worth Clearing Up
When your employees paste sensitive business information into a public AI tool, that information can be exposed or used in ways you did not intend. And if they act on a wrong answer without checking it, one bad output is all it takes. This is happening in businesses across the Triangle every day by people trying to work faster, not trying to cause problems.
AI Data Poisoning: Quick Reference
| What Happens | What Happens What It Means for You | How You Catch It |
|---|---|---|
| Bad info planted online | Your AI returns fake numbers or wrong guidance | Always verify contact info at the source |
| Files changed in your system | Your AI learns from corrupted documents | Audit files regularly, limit who can change them |
| Hidden instructions in documents | AI is quietly redirected mid-task | Monitor AI outputs, question unusual results |
| A vendor tool gets compromised | Every business using that tool is affected | Ask vendors hard questions before you commit |
The Short Version
Clean data is to an AI what bacon is to me: Non-negotiable and foundational. Everything downstream depends on it.
The threat is real. It is active right now. It has hit people we know personally –including a neighbor and nearly Dottie. And it hits hardest the businesses that did not know they were exposed.
2 Dog Digital works with small businesses across North Carolina and beyond – from trades and contractors to dental practices and law firms, to build practical cybersecurity programs that fit the way you actually run your business.
Download the free AI Data Poisoning Defense Checklist and see where you stand today. If you want to talk through what you find, we are at 919-341-4686.
Schedule an appointment with the dogs!
About the Author: Digit is a Great Dane, a retired Marine, and the one who writes the blogs. Dottie the Scottie handles everything else. Behind the keyboard is Ami DePierro, former U.S. Marine intelligence analyst and co-owner of 2 Dog Digital. She and Rich DePierro built this company together. The dogs just do the talking.
FAQ
Q: What is AI data poisoning?
A: AI data poisoning is when someone corrupts the information an AI uses to give you answers- through its source data, its training files, or instructions hidden in documents it reads. The AI has no warning system. It returns the bad information with the same confidence as accurate information.
Q: How does AI data poisoning actually work?
A: The most common version does not require hacking your systems. Attackers flood the internet with false information – fake phone numbers, fake websites, wrong guidance-until AI tools find it and repeat it as fact. Research from December 2025 found a 36 percent mismatch rate between AI-provided phone numbers and verified business contact pages.
Q: Can AI data poisoning affect a small business?
A: Yes. The examples in this post are not large corporations. They are a neighbor, a business partner, and a small professional services firm. Size is not the determining factor. Gaps in your setup are.
Q: What is an example of AI data poisoning?
A: A neighbor searched for a tech support number, found a fake one planted by an attacker, and lost access to her computer and bank account. A family member nearly called a fake number returned by an AI assistant while trying to return a purchase. In both cases the attacker planted bad information online and waited for someone to find it.
Q: How do I verify information my AI gave me?
A: Go directly to the company’s own website or the vendor’s verified contact page and look it up there. Do not ask the AI to check its own answer. That is asking the same source to confirm itself.
Q: What is the first step to protect my business?
A: Write down every AI tool your business uses, including features built into software you already have. Then identify what data and files each tool can access. You cannot protect what you have not identified. Call 2 Dog Digital for a free 30-minute AI Readiness and Security Assessment at www.2dogdigital.com.
Q: How do I know if my small business is ready for Microsoft Copilot?
A: Run this checklist: (1) Is your M365 data organized with proper permissions? (2) Do you have security policies in place? (3) Can you afford $30/user/month plus deployment costs? (4) Does your team actually use Microsoft 365 daily? If you answered “no” to any of these, you’re not ready yet. Fix the foundation first.
Q: What’s the difference between Copilot and ChatGPT for business use?
A: ChatGPT is trained on public internet data and knows nothing about your specific business. Copilot accesses your company’s Microsoft 365 data-emails, documents, Teams chats. ChatGPT is like asking a stranger for advice; Copilot is like asking someone who’s read every document in your filing cabinet. Security and privacy implications are completely different.
Q: Can Copilot access all my company data automatically?
A: No. Copilot only accesses data the individual user already has permission to see. If Sarah in accounting can’t access HR files, Copilot won’t show her HR files. This is why proper permission management is critical=if your SharePoint permissions are misconfigured, Copilot will expose that problem immediately.
Q: What are the biggest security risks with Copilot for small businesses?
A: Three main risks: (1) Exposing sensitive data through poor permission configurations, (2) employees using AI to generate content that violates compliance requirements, and (3) data leakage through improperly configured third-party integrations. All preventable with proper governance, which is why you need qualified IT support before deployment.
Q: How much does Microsoft Copilot actually cost for a small business?
A: Base licensing runs $30/user/month, but you need Microsoft 365 Business Premium ($22/user/month) as a prerequisite. For a 20-person company, that’s roughly $12,000/year just for licenses. Add training ($2,000-$5,000), deployment configuration, and ongoing management—budget $15,000-$20,000 first year. Smaller organizations should carefully evaluate ROI before committing.
Q: Do I need special IT expertise to manage Copilot?
A: Yes. You need someone who understands Microsoft 365 security, data governance, and AI-specific risks. This could be an internal IT person, but most small businesses benefit from working with a managed service provider who specializes in cybersecurity and AI governance. DIY deployment often leads to security gaps you won’t discover until they become expensive problems.
2 Dog Digital | Raleigh, NC | www.2dogdigital.com | Serving clients in North Carolina and 27 states