Why Do We Share Secrets with AI? The Cybersecurity Dimension of Human–AI Trust
Does the person we share a secret with have to be human?
Sharing secrets has traditionally been a behavior based on trust between people. Who we open up to, how much we share, and what kind of information we disclose have been shaped by relational and psychological factors such as closeness, trust, privacy, and the possibility of being judged. However, as artificial intelligence has become part of our everyday communication, one of the parties in this relationship has changed.
Today, people do not only ask AI for information. They seek advice from it, share their thoughts, talk about their problems, and sometimes include personal or sensitive information in the conversation. And all of this happens even though they know that the entity they are interacting with is not human.
This raises an interesting question: Does the feeling of trust require the other party to actually be human, or is it enough for it to communicate like a human?
Why Do We Humanize Artificial Intelligence?
One of the concepts through which we can approach this question is anthropomorphism, a concept that has long been studied in psychology. Derived from the Greek words anthrōpos, meaning human, and morphē, meaning shape or form, anthropomorphism refers to attributing human qualities to another entity. Assigning human emotions and thoughts to animals, natural phenomena, and inanimate objects is one of the ways people make sense of and relate to their environment.
This tendency is not new. Anthropomorphism can be observed across different periods, from gods depicted in human form in ancient mythology to the personalities we attribute to objects in everyday life. Today, however, we are faced with a technology that takes this tendency to a very different level: artificial intelligence that can talk to us.
Research in the field of human-computer interaction shows that even when people know they are interacting with a machine, they may still display some of the social behaviors they use when communicating with other people. Users have been observed to follow rules of politeness even when interacting with computers. Researchers explain this by suggesting that the social rules shaping human-to-human communication can also be carried over into our interactions with technology.
These findings were obtained before generative AI became part of our lives. Today, however, we are communicating not only with machines that receive commands, but with systems that talk to us, answer our questions, and respond by taking previous messages into account. This change places anthropomorphism on a much more realistic ground.
The Security Cost of a “Can You Summarize This?” Prompt
What does this tendency to humanize AI mean from a security perspective? The more we perceive the other party as human-like, the more comfortably, and sometimes more openly, we communicate with it. Yet every piece of information we enter into a chat interface is not only part of a conversation, but also data transferred to the relevant system.
The secret in question does not always have to be personal. In the workplace, customer information, internal company documents, financial data, source code, or contracts shared by an employee in order to get help from AI may also be considered sensitive information from the organization’s perspective. From the user’s point of view, a simple prompt such as “Can you summarize this document?” may, from a security perspective, mean that corporate data is being shared with an AI system.
This is not a theoretical risk. LayerX’s 2025 Enterprise AI and SaaS Data Security Report shows that approximately 45% of employees use AI tools in their work processes and that 77% of users copy and paste data into GenAI tools. Moreover, 82% of paste activities take place through accounts that are not managed by the organization. The issue is not only that employees use AI, but that corporate data may move beyond the organization’s boundaries of visibility and control.
At this point, the trust relationship between humans and AI goes beyond being a psychological phenomenon and becomes a cybersecurity issue. This is because security in the use of AI is not limited to protecting the model against external attacks. What data users transfer to the system, where that data is processed, who can access it, and how sensitive information is protected are also important parts of AI security.
For companies operating in Türkiye, this issue also intersects with obligations under the Personal Data Protection Law, or KVKK. The transfer of personal data relating to customers or employees to AI tools may, depending on the nature of the data and the way it is used, require an assessment of personal data processing and transfer processes.
However, the solution here is not to prevent employees from using AI systems or to avoid trusting these systems altogether. The aim should be to ensure that AI is used within the organization’s security boundaries.
From Psychological Trust to Technical Trust
While trust between the user and AI is largely shaped through experience, at the organizational level, the boundaries of this trust need to be defined technically. The way to achieve this is to make interactions with AI visible, manageable, and auditable when necessary.
The main areas organizations should focus on in order to achieve this visibility can be listed as follows:
Data classification: Clearly defining which information is considered sensitive and being able to identify such data before it is transferred to AI tools.
Access control: Defining which employees can access which AI tools and with what scope of data.
Authentication and account management: Ensuring that corporate use takes place through accounts managed by the organization rather than through unmanaged personal accounts.
Model and system testing: Regularly testing the AI systems in use against possible data leakage scenarios.
Continuous monitoring: Logging model interactions and continuously monitoring security requirements.
An AI Security approach helps establish these boundaries by addressing model, data, and user security together. In this way, security stops being a barrier that prevents the use of AI and becomes a natural part of secure AI use.
Secrets Are No Longer Told, They Are Uploaded
Perhaps the concept of a secret itself is changing in the age of artificial intelligence. Secrets are no longer simply told; they are written, uploaded, processed, and moved between systems. Therefore, protecting them depends not only on questioning whom we trust, but on making the journey of information secure.
The other party may not need to be human for us to share a secret with it. But when it comes to protecting that secret, trust alone is never enough.
