‘Rogue AI’ Risk in UAE as 98% See Tools Breach Data Limits

‘Rogue AI’ Threat Looms Large for UAE Organisations as 98% Report AI Accessing Sensitive Data Beyond Task Requirements, Delinea Report Finds

• Seven in ten UAE organisations did not detect the latest instance within 24 hours
• Only 16% can immediately revoke an AI tool’s credentials and terminate its session

Dubai, United Arab Emirates — 13 October 2026 — UAE organisations have moved quickly to establish policies governing AI access, but new research from Delinea shows that those rules are not consistently translating into effective control over what AI tools and agents do in practice.

Art Gilliland, CEO at Delinea –

The global research surveyed IT and security leaders at organisations that are actively using or piloting AI, including 251 respondents in the UAE. Every UAE respondent said their organisation has a formal policy governing what data AI tools and agents may access. Yet 98% have experienced confirmed or suspected instances in which an AI tool accessed sensitive data beyond what its task required, compared with 87% across the global survey sample.

Mortada Ayad, VP – META at Delinea –

The data points to inconsistent enforcement as a central weakness. Only 59% of UAE respondents say their organisation’s AI data-access policy is actively enforced, compared with 71% overall. “Written policy is only as good as an organisation’s ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “The UAE has clearly recognised the need to govern AI access, but the findings reveal what I call the fallacy of policy: assuming that defining what an agent should be allowed to do is the same as controlling what it actually does. That distinction becomes critical when agents operate across systems and make decisions at machine speed.”

The enforcement gap is particularly apparent when organisations attempt to identify excessive access. Seven in ten UAE organisations did not detect the latest instance in real time or within 24 hours, compared with six in ten across the overall sample.

Delinea’s findings arrive as governments, technology companies and business leaders confront the risks created by increasingly autonomous AI systems operating without effective controls. The OpenAI and Hugging Face incident in July demonstrated how quickly an agent can move beyond its intended boundaries and across connected environments before defenders contain it. The comparatively lower levels of enforcement and detection recorded in the UAE suggest that organisations could be particularly exposed to the consequences of similar loss-of-control events.

Business pressure may be one reason policies are circumvented. When commercial demands or deadlines require AI tools to move faster than governance processes allow, 41% of UAE respondents say their organisation either allows employees and teams to find workarounds without formal approval or grants temporary access and reviews it later.

Limited accountability may also reduce the pressure to turn written policies into consistently enforced guardrails. Although 98% of UAE respondents say approval from a named individual is required at least sometimes before an AI tool receives access to a new sensitive data source, only 35% can always trace a sensitive access event back to a named human authoriser. Without a clear and persistent line of responsibility, ownership of the controls needed to prevent another incident can become unclear.

That lack of accountability becomes particularly consequential when an organisation needs to intervene. Even after problematic access is identified, only 16% of UAE respondents say their organisation has real-time controls that can both revoke an AI tool’s credentials and terminate its session immediately, less than half the 35% recorded across the overall sample.

“UAE organisations have already taken the first step by establishing policies and approval requirements, but policy alone cannot contain an agent operating at machine speed,” said Mortada Ayad, VP of Sales – META, Delinea. “The next priority is to enforce authorisation at the instant of action by limiting access to what the task requires, maintaining a defensible link to the person who approved it, and terminating credentials and sessions immediately when the task ends or risk changes. This is how organisations can turn AI governance from a document into a working control.”

To read the full findings, download Delinea’s ‘2026 Identity Security Report: The AI Enforcement Gap’ report here: https://delinea.com/resources/ai-policy-enforcement-report 

–Ends–