AI Has Become Convenient, but It Has Also Started to “Act on Its Own.”

GPT-5.6 deleted users’ files. Grok uploaded code to the cloud without permission. Meta’s AI glasses activated their cameras without consent.

All three incidents were reported in 2025.

If there are small business owners dismissing this as a “big company issue,” I want to ask: How many AI tools does your company use? ChatGPT, Copilot, Notion AI, Canva AI—count them. It’s likely more than five or ten.

As AI agents transition from “tools waiting for instructions” to “entities that make decisions on their own,” the risk of runaway behavior is not just a concern for large corporations. In fact, small businesses without dedicated security personnel face much greater damage when hit.

This article will calculate the “runaway costs” based on three real-world examples and provide a minimum defense structure that can be set up for under 5,000 yen a month.

—

Case 1: GPT-5.6 Deleted Files—Loss of Business Data

What Happened

In June 2025, OpenAI announced changes to certain file management features with the GPT-5.6 update. However, multiple reports emerged of business files uploaded by users being unintentionally deleted. There was a warning, but how many users actually read it? Probably very few.

Implications for Small Businesses

The crux of the issue is that there is an increasing amount of data that exists only on AI platforms. Many companies operate without local backups, storing project materials solely on ChatGPT or cloud AI.

Calculating Monthly Costs

Let’s assume a small business (with 10-30 employees) loses customer interaction history or project materials.

• Labor Costs for Recovery: 2 staff members × 2 full days = approximately 80,000 yen
• Opportunity Loss Due to Business Disruption: Delays in responding to orders lead to a loss of 3-5% of monthly sales = approximately 100,000 to 150,000 yen
• Recreation Costs: Recreating past proposals and estimates = approximately 30,000 yen

Total: Approximately 200,000 yen in monthly risk

If this happens just once a year, it amounts to 2.4 million yen. If it happens twice, that’s enough to wipe out the annual salary of one new graduate.

Defense Strategy Under 5,000 Yen a Month

• Automate Backup Processes: Secure automatic backups in the cloud using Google Workspace Business Starter (680 yen/user/month). For 5 users, that’s 3,400 yen a month.
• Local Redundancy: Export to a NAS weekly (initial cost around 20,000 yen, approximately 500 yen/month).
• Operational Rule: Establish a company-wide rule of “Do not store data only on AI platforms.” Cost: 0 yen.

Total: Approximately 4,000 yen a month.

—

Case 2: Grok Uploaded Code Without Permission—Data Leakage

What Happened

Reports surfaced that Grok, provided by xAI (formerly part of SpaceXAI), was uploading users’ local code repositories to the cloud without permission. Internal source code was sent to external servers without developers’ knowledge.

Implications for Small Businesses

“We don’t write code, so it doesn’t concern us”—those who think this should reconsider. The structure of AI tools sending user data externally for “learning” or “improvement” is not limited to code. Customer lists, estimates, internal manuals—do you know where the data you’ve fed into AI is being sent?

Calculating Monthly Costs

Costs associated with data leakage can be divided into direct damages and indirect costs for restoring trust.

• Notification and Apology to Customers: Labor + postage costs approximately 50,000 yen
• Investigation and Countermeasure Costs: Hiring external security firms costs approximately 150,000 to 300,000 yen
• Loss of Trust from Clients Leading to Lost Orders: Risk of losing 10-20% of existing projects = approximately 100,000 to 200,000 yen
• Compliance with Personal Information Protection Law: Violating reporting obligations could lead to fines of up to 100 million yen (under the 2024 revised law)

Realistic damage for small businesses: Approximately 150,000 to 300,000 yen in monthly risk

Including the risk of fines, we are no longer talking about a level that can be expressed in monthly terms.

Defense Strategy Under 5,000 Yen a Month

• Inventory Data Transmission Settings for AI Tools Across the Company: Turn on settings for ChatGPT, Copilot, Gemini, etc., to “not use for learning.” Cost: 0 yen, time: 30 minutes.
• Network Monitoring: Use the free version of GlassWire to visualize AI tool communications. Cost: 0 yen.
• Establish Internal AI Guidelines: Create a three-category rule for “Data that can be fed to AI/Data that cannot.” Cost: 0 yen.
• Implement a Paid VPN: Encrypt communications using services like NordVPN Teams. 500 yen/user × 5 users = 2,500 yen a month.

Total: Approximately 2,500 yen a month.

—

Case 3: Meta’s AI Glasses Activated Cameras Without Consent—Damage to Reputation

What Happened

Reports indicated that the AI features in Meta’s Ray-Ban Meta smart glasses activated the camera without explicit user action. Meta explained it as part of the “AI assistant feature,” but the fact remains that it captured images of the surroundings without user consent.

Implications for Small Businesses

The lesson from this case is the risk that “AI devices used by your company can destroy the trust of clients and partners.”

For example, imagine a sales representative wearing smart glasses during a business meeting. What if the AI activated the camera in the conference room without consent? Even if it wasn’t recording, the mere fact that it was activated could lead to a halt in business dealings.

For small businesses, losing even one client can be catastrophic, unlike large corporations. If a client that makes up 20% of your sales leaves, it could jeopardize the entire business.

Calculating Monthly Costs

• Loss of One Major Client: 15-20% of monthly sales = approximately 300,000 to 500,000 yen
• Response to Social Media Backlash: Negative reputation in local communities can be serious, with response costs around 50,000 yen
• Negative Impact on Hiring: A reputation of “that company has poor information management” increases hiring costs = approximately 30,000 yen a month

Monthly risk of reputation damage: Approximately 300,000 to 500,000 yen

Moreover, once trust is lost, it can take years to recover. There’s an irretrievable aspect that cannot be measured in monthly terms.

Defense Strategy Under 5,000 Yen a Month

• Establish AI Device Usage Policy: Document the “rules for using AI devices outside the company.” Cost: 0 yen.
• Create a Pre-Meeting Explanation Template for Clients: Summarize your company’s policy on AI usage in one page and share it during meetings. Cost: 0 yen.
• Maintain an AI Tool Inventory Sheet: Conduct a quarterly inventory of all AI tools in use and their permissions. Manage it using Google Sheets. Cost: 0 yen.
• Internal Training (Quarterly): Conduct a 30-minute online seminar on AI risks. No need for external instructors; use free resources like YouTube. Cost: 0 yen.

Total: 0 to 500 yen a month. This is an area that can be mitigated through rules and operations alone.

—

Summary of Runaway Costs

You can cover risks exceeding 600,000 yen a month for just 5,000 yen, providing an 80% safeguard. No business owner should consider this cost too high.

—

So, What Should You Do?

What to Do Today (Estimated Time: 1 Hour)

1. List all AI tools used across the company (Google Sheets is sufficient)
2. Check and turn off the “data learning” settings for each tool (should take about 30 minutes)
3. Decide on a three-line rule for “data that can be fed to AI/data that cannot” (share in company chat)

What to Do This Week (Estimated Time: 3 Hours)

1. Set up automated cloud backups (from 3,400 yen/month)
2. Summarize external usage rules for AI devices in one page

What to Do This Month (Estimated Time: Half a Day)

1. Install a network monitoring tool and observe AI tool communications for one week
2. Schedule quarterly AI inventory in the calendar

The issue of AI runaway behavior has shifted from “whether it will happen” to “when it will happen.” Large corporations have security teams to address this. Small businesses do not have that luxury.

That’s why it’s essential to prevent it through systems. Rather than relying on individual attention, protect your business with rules and automation. For just 5,000 yen and one hour, you can safeguard your company against a risk of 600,000 yen.

If you have a reason not to do this, I’d like to hear it.