Poisonous, Pernicious and Persistent

There's a number that should stop every executive who's rapidly deploying AI, dead in their tracks; 250. And no, it's not the number of consultants per day that tell you that they "have the answer."

In late 2025, researchers at Anthropic, the UK AI Security Institute, and the Alan Turing Institute ran the largest data-poisoning study ever conducted. They found it does not take a percentage of a system's data to corrupt it, but a near-constant, absolute number of roughly 250 bad documents. It didn't matter whether the model was small or enormous. For the largest model they tested, 250 documents were 0.00016% of the total data. Rounding error, but it was enough to bend the entire machine to a lie.

This kills the most popular trope in enterprise AI: your system is too big to be moved by a little bad information. Not true, it won't dilute, it won't average out. The number is absolute, not proportional. The corruption is already there. And while that study described a deliberate attacker, you don't need one. Your own people will poison your AI for free, in good faith, every single day. The danger is not that bad information finds its way in, it has and it will.

Forget the obvious errors. The most dangerous inputs aren't the ones that are objectively wrong, it's the (mis)perceptions that no one checks.

Say two of your people are on the same discovery call. One walks out completely certain the economic buyer was leaning in, engaged, enthusiastic, ready to move. The other reads the same room as polite but guarded, a skeptical buyer who was politically boxed in and covering for it. Both are seasoned. Both noted their respective views. Neither is lying, and neither can be proven wrong, because the tone of a room is not a fact you can audit. It's nuanced context. Your system now holds two contradictory truths about the same person and no way to reconcile them. If the meeting was recorded, perhaps there's even a third (and potentially objective view).

A standard CRM filing system would hold the notes and let a human sort it out later. An AI system built to reason across everything can't wait to sort it later. It's engineered to act. So, it blends the two reads or silently favors one over the other. Then, that contaminated characterization becomes the official memory of the stakeholder. It's the basis for the next email's tone, the next step and the urgency the system assigns the deal.

Then it spreads, because AI doesn't just file away that view as an isolated element, it feeds it into the abstractions that make the system valuable. The mischaracterized buyer becomes a training example for buying-signal analysis. It teaches the system that a behavior pattern means something it may not. He is sorted into a persona that is then applied to every prospect who resembles him. His supposed posture colors the read on the entire buying committee's tone, and on how committees like this one behave.

And it doesn't just stay inside this deal. The persona, signal, and committee models are cross-deal abstractions by design. One unresolved disagreement about one meeting quietly recalibrates the lens the system brings to every comparable opportunity in your pipeline. The next rep working a similar account inherits this artifact, shaped by a conversation they never attended, about a buyer they will never meet, on the strength of a perception that was never verified as true.

And unlike a wrong close date or deal value, this error never corrects itself. A bad date or actual price gets updated the moment the deal closes or slips. Without engineered governance together with fit for purpose agent fabrics, a bad perception is never tested against reality, so it's never flagged. It simply compounds, gets blended, generalized, and relearned. Now that distortion gets baked into how your AI sees your market. A 2024 study in Nature gave the endgame a name, model collapse: when AI systems feed on their own outputs, errors compound across generations until the original signal is lost.

The right word for this is pernicious: no one flags a perception as a defect, so it never trips an alarm. So, as the system grows more capable and more trusted, the buried error grows more dangerous, confidence rising while accuracy quietly falls. You don't catch it in a demo, but in a market read that's been trending wrong for more than a year.

Compare this pernicious threat to data integrity against Cyber Security. Your company will spend millions this year defending against cyberattacks, and the board will approve it without blinking, because the threat has a specific persona. There's a bad guy, a threat, a breach, a headline. Fear with a villain gets budget. A real threat and a real budget.

The corruption corroding your AI infrastructure from the inside has no face. It's a guessed stakeholder, a misread room, an inherited wrong assumption none of it malicious, all of it constant. Precisely because it's benign, it sails past every control you have built. You have a war room built for an intruder who might come and nothing for the contamination already here. That asymmetry of millions for a possible attacker and nothing for the certainty of self-inflicted decay is remarkable. It's a blind spot that can be devastating.

For the few that recognize the risk, most reach for the obvious fix: hand it to internal IT or stand up a task force to "own AI data quality." That instinct is very costly. That's not a slam on IT departments.

For some perspective, all you need to do is look at who is still wrestling with this. Governing AI knowledge at scale is not an IT function, it's a frontier research and specialized discipline. World-class AI engineers building models and applied solutions continue to manage these issues daily. We're the ones publishing the warnings. Your AI tools need to contain disciplined, fit for purpose fabrics, along with governance and great engineering. The risk is that poisoned memory persists with no clean or easy fix.

Now set that against an internal IT organization. Its mission is necessarily broad, infrastructure, security, the ERP, the help desk, fifty systems that have to stay up 24/7. Streamlining and cost cutting mandates. They're staffed largely with very capable generalists. Asking internal IT to solve a problem that the best AI engineers on earth continue to work on daily is not a realistic ambition.

The better answer is to buy a product with all the safeguards already engineered-in at the level of the agent fabric itself. This is where the rules for how highly specialized agents read, write, fact check, conflict check and reason over shared memory, get enforced by design rather than bolted on after the fact.

That's engineered-in governance and applied AI solving a real business problem. It's built into products like SAIQ, and precisely why it takes elite AI engineering, not an internal task force, to make it real. It really comes down to three hard and fast rules every leader should require.

A governed system elevates the true knowledge foundation shoring up every rep on every deal. An ungoverned system lowers it for all of them and then teaches itself to weaken it continuously.

The companies that win the AI decade will not be the ones who just deployed fastest. Speeding into an ungoverned system is not a competitive advantage. It's accelerating toward a wall around a corner you can't see. When you get there, arrival will be abrupt and unpleasant. The winners will be the ones who treated the integrity of their AI's knowledge as a board-level risk. An enterprise risk equal to the cyber threats they fund without blinking.

The cyber intruder may or may not ever come. But in an ungoverned environment, AI contamination has already arrived. It's spreading in your system, right now in fact. It's poisonous, pernicious and persistent. It's been spreading in your system while you read this article. Make an intentional and clear-eyed decision on who governs what your AI is enabled to believe. Resist the urge to do it yourself, before the wall you're accelerating toward decides for you. Don't say we didn't tell you.