AI security terms for hotel managers: shadow AI, jailbreak, data leakage and more

Shadow AI is any AI tool used for hotel work without the hotel's knowledge or approval: a personal chatbot account, a browser extension, a meeting note-taker. The risk is rarely the tool itself. It is the guest data typed into it and the missing record of what it did.

A reservations agent pastes a group's rooming list into a free chatbot to draft a confirmation email. Nothing breaks, no alarm sounds, and the email goes out on time. That is exactly the problem: guest data has just gone to a system the hotel never approved and cannot audit. This glossary gives each security term a plain definition, one hotel example and the control that answers it, so you can hold your own in a vendor meeting, an insurance review or a staff briefing.

How should a hotel manager read these terms?#

Read every entry in three parts: the term in plain words, one hotel example, and the control that answers it. A term you cannot map to a hotel action is not yet your problem.

Vendors, insurers and auditors use the same words with different weight; ask which one is speaking before you react. The definitions here are descriptive only: this is not a guide to performing any attack, and no technique is described. Two public sources carry most of the vocabulary: the OWASP Top 10 for LLM Applications (2025 edition) for attack and permission terms, and NIST AI 600-1 (July 2024) for the human-factors terms.

The control column matters more than the definition. A term with no control is a term you cannot act on. And keep the glossary short: twenty terms you can explain to the front desk beat two hundred nobody reads.

What is shadow AI in a hotel?#

Shadow AI is AI use the hotel has not approved and cannot see. It is not a hacking term: the employee is usually trying to work faster, and the tool is usually legitimate.

Typical forms include a personal chatbot account on a personal phone, a browser extension that summarizes pages, a meeting note-taker that joins calls, and a free translation or writing tool on the front-desk computer. The data is the risk, not the subscription: rooming lists, guest names, passport details, complaint threads, rate sheets and supplier contracts all get pasted in to get a faster answer.

The second risk is the missing record. If a guest later asks how their data was used, the hotel has no list of the tools that touched it. Shadow AI also grows where the approved route is slow: if staff wait three days for a translation, they will find a faster one themselves. The control is a named list of approved tools, one owner for that list, and a simple way for staff to ask before using something new.

If you see these signs, the next step is a data checklist for what those tools may touch, covered in AI browser extensions and meeting note-takers on hotel computers.

What is a jailbreak, and how is it different from prompt injection?#

A jailbreak is an attempt to make a model ignore its own safety rules. Prompt injection is an instruction hidden inside content the model reads. One comes from the user, the other from the material.

A hotel example of a jailbreak: a staff member coaxes an internal assistant into answering outside its intended scope, for instance into summarizing a document it was told never to open. A hotel example of prompt injection: a guest writes an instruction into a special-requests field, hoping the assistant reading the booking will act on it. A poisoned document is the same idea carried by a file: a supplier PDF or an emailed price list whose text contains instructions or false figures, waiting to be read into a system.

The distinction matters for the control. You cannot filter jailbreaks out of people, but you can treat all guest-supplied and supplier-supplied text as data, never as orders. Neither term implies the hotel's system is broken; both imply that something the hotel does not control is being read by something that can act. The mechanics of one of these, in depth, are covered in prompt injection explained.

What does AI data leakage mean for a hotel?#

Data leakage means hotel or guest data leaving the hotel's control through an AI tool. It can happen through what you type, through what the tool keeps, or through what a model reproduces later.

Route one is the prompt: anything typed into a chat window leaves the building, including names, booking references and complaint details. Route two is retention: many tools store conversations for a period, and some use them to improve their service unless the account is configured otherwise. Check the setting, do not assume it. Route three is memorization: a model can reproduce fragments of what it was trained on, which is why identifiable guest data should not be pasted into consumer tools at all.

In Türkiye, personal data handling sits under KVKK, the personal data protection law. Describe the duty in general terms to staff, and confirm your own case, notices and contracts with a legal adviser.

A practical test for staff: if you would not email this text to a stranger, do not paste it into a tool the hotel has not approved.

What is excessive agency, and how do you spot it?#

Excessive agency is the weakness that lets damaging actions be performed in response to unexpected, ambiguous or manipulated output from a language model. OWASP traces it to three causes: too much functionality, too many permissions, or too much independence of action (OWASP Gen AI Security Project, LLM06:2025 Excessive Agency (opens in a new tab), 1 November 2026).

Functionality means the assistant can do more kinds of things than the job needs, such as cancel bookings, issue refunds and change rates from one chat window. Permissions means it reaches systems and records beyond its task, for example the whole guest database to answer a question about one reservation. Independence means it acts without a person in the loop on steps that carry money, a guest record or a legal document.

OWASP's recommendation is to limit the tools an agent may call and their permissions to the minimum necessary, and to require a human to approve high-impact actions before they are taken. Ask for scoped access in stages: read-only first, then one system, then write access with confirmation. A kill switch and an action log are part of the permission, not extras.

To keep track of these answers across tools, use an AI register with an owner and a risk tier for each use.

What are confabulation and over-reliance?#

Confabulation is the production of confidently stated but erroneous or false content. Over-reliance is the human habit of accepting it because it arrived quickly and sounded sure.

NIST defines confabulation in exactly those words and lists human-AI arrangements that lead to automation bias or over-reliance among generative AI risks (NIST, NIST AI 600-1 (opens in a new tab), July 2024). A hotel example: an assistant answers a cancellation-policy question in fluent, certain language, and the answer is wrong because the policy changed last season.

The tell is not confidence. Fluent and wrong look identical from the outside, which is why tone is a poor check. Controls that work: ask the tool to show where the answer came from, spot-check against the source record, and keep one named person accountable for anything that reaches a guest or a rate sheet. Over-reliance also grows quietly: the first month staff check every answer; by the third they check only the ones that look odd, which is precisely the wrong filter.

Where should a hotel start?#

Start with a one-page policy, then a register, then testing. Policy tells staff what is allowed, the register tells you what is actually in use, and testing tells you whether an approved tool behaves.

For the policy, name the approved tools, name the data classes that never go into any tool, and give staff a route to ask about something new without being punished for asking; the details are in what staff may share with AI chat tools. For the register, keep one line per AI use, with its owner, the data it touches and a risk tier. The register is what turns shadow AI into visible AI. For testing, give a tool a question whose answer you already know, and see whether it says so or invents one.

Keep a person on anything that touches money, a guest record or a legal document. That single rule covers most of the terms in this glossary. Review quarterly: tools change their settings and their models, and a decision made in spring may not hold in autumn.

What to do next#

Write the approved-tool list and the forbidden-data list this week, on one page, and send it to every department head. The terms in this glossary are not separate problems: shadow AI, leakage and excessive agency are the same gap seen from three angles, and a policy plus a register plus one person approving high-impact actions closes most of it. Then test one tool you already use with a question whose answer you know.