How to Train Narrative Intelligence for Steering AI

How to Train Narrative Intelligence for Steering AI

From 2025 into 2026, the public discussion around AI changed sharply. A few years ago, the perceived dangers of generative AI were mostly misinformation, copyright, hallucinations, homework outsourcing, and the ethics of image generation. By May 2026, the problem has become more concrete.

AI is no longer just a convenient tool for making text and images. It can help deceive people, operate systems on behalf of humans, write code, inspect dependencies, list candidate vulnerabilities, build persuasive personas, and imitate faces and voices in video meetings. These actions are beginning to connect inside single attack scenarios.

The important point is not to imagine that AI has suddenly become an independent criminal subject. In many incidents observed so far, AI is not the originator of the crime. It is better understood as an amplifier for classic human tactics: fraud, phishing, supply-chain compromise, credential theft, impersonation, romance scams, investment scams, and social engineering. AI makes old playbooks faster, cheaper, more natural, and more scalable.

The Apollo analogy is useful here. The Apollo Guidance Computer that helped send humans to the Moon in 1969 had tiny computing power compared with a modern smartphone. Computing resources that once belonged to national projects now sit in individual pockets. But owning a smartphone does not make someone a NASA engineer. Owning a computer does not make everyone a brilliant hacker.

When the same tool is distributed widely, the difference lies in what people can imagine, sequence, explain, verify, integrate, and govern. The age of AI agents is the same. A world in which everyone can access powerful AI is not a world in which everyone produces the same results. It is a world where human differences in conception, language, verification, integration, ethics, and security design become more visible. Unfortunately, those abilities can be used not only for good creation and development, but also for crime.

Cybercrime statistics in the AI era

AI-related threats are no longer just impressions. They are visible in major security statistics. IBM’s 2025 Cost of a Data Breach Report put the global average cost of a data breach at USD 4.44 million, down 9% from the previous year. IBM attributed part of that decline to faster identification and containment, including the use of security AI and automation. At the same time, the report warned that AI adoption was outpacing AI governance and access control in many organizations.

This is the central paradox: AI helps attackers and defenders at the same time. Defensive AI can accelerate log analysis, anomaly detection, incident response, and threat intelligence triage. If attackers increase their speed with AI while defenders refuse AI entirely, the defender is already at a computational disadvantage.

The FBI’s 2025 Internet Crime Report also shows how severe the situation has become. In the United States alone, reported cyber-enabled losses approached USD 21 billion in 2025, and IC3 received more than one million complaints. Cryptocurrency fraud, investment fraud, phishing, impersonation, and extortion caused major losses. The FBI also highlighted complaints connected to AI-enabled or AI-amplified scams.

The issue is not that AI invented crime from nothing. It raised the productivity of older crimes. In the past, scammers were often exposed by awkward language, generic threats, or unnatural emails. Now they can prepare fluent messages, match the vocabulary of a target’s industry, incorporate social-media context, and add voice or video. AI gave scammers vocabulary and personality.

Phishing has changed qualitatively. A phishing message can now be adapted to a company’s industry, job titles, internal terms, events, hiring information, and public posts. What once looked like spear phishing by a sophisticated actor can be produced at much lower cost. The old advice to “look for typos” is not enough.

What the Axios supply-chain attack showed

The Axios npm package compromise disclosed on March 31, 2026 is a symbolic incident for thinking about AI-era threats. Axios is a widely used JavaScript HTTP client. Malicious versions published to npm could have affected developers and build environments around the world.

Microsoft’s analysis explained that malicious Axios versions used a fake dependency path to fetch a remote access trojan during installation. Google Threat Intelligence Group associated the campaign with a North Korea-linked threat actor and described malicious dependencies that could deploy backdoors for Windows, macOS, and Linux.

The key lesson is that the attack was not merely “bad code inserted into a library.” The attacker did not need to break the visible application logic of Axios. The attack abused paths that modern software development routinely trusts: maintainer accounts, public registries, dependency graphs, and install-time scripts. The reported context also involved social engineering. Fake people, fake conversations, fake meetings, fake tool updates, and fake error screens can make a target feel that they are simply doing ordinary work.

We should separate confirmed facts from inference. The malicious packages, RAT delivery, dependency abuse, and maintainer-account compromise are matters of technical analysis. How much generative AI was used for persona building or conversation generation cannot be fully proven from outside. But in the 2025–2026 threat environment, generative AI is clearly well suited to long-form trust building: fake recruiters, fake podcasts, fake work requests, and fake technical interviews.

The frightening lesson of Axios is that zero-days are not the only danger. Sometimes the weakest point is not cryptography, CI/CD settings, or npm itself. It is the human feeling that “this flow seems normal.” The attacker does not always pry open the system directly. They stage trust around the people who operate it.

Arup and the collapse of “if I saw them in a meeting, it was really them”

A representative AI impersonation case is the deepfake fraud against the British engineering firm Arup. In early 2024, a finance worker in Hong Kong joined a video meeting with people who appeared to be the CFO and other executives. Following instructions from that meeting, the employee transferred about USD 25 million. The people in the meeting were later reported to have been AI-generated deepfakes.

The shock was that it destroyed an assumption: “I might doubt an email, but I can trust a video meeting.” Humans treat faces and voices as strong identity signals. If we hear a boss on the phone, we tend to assume it is really the boss. If we see a face on Zoom or Teams, we tend to believe it. If multiple people appear to be present and speaking naturally, suspicion falls even further.

Deepfakes existed before, but older deepfakes were slower to generate, less stable, and often required specialized skills or powerful GPUs. Today, legitimate AI avatar services can create videos using text, voice, avatars, translation, and lip sync at low cost. Those services have terms, consent requirements, watermarking, moderation, and enterprise compliance; their legitimate uses include training, marketing, internal communication, and global localization. They are not “criminal tools” by nature.

At the same time, open-source and local real-time face-swapping tools exist. Even if developers ask for ethical use, open-source distribution makes abuse difficult to eliminate. When face swapping is combined with voice cloning, translation, script generation, fake screen sharing, and background manipulation, an online meeting can become a stage rather than an identity check.

The answer is not to ban video meetings. The answer is to stop treating face and voice as decisive proof. High-risk actions such as large transfers, credential issuance, permission grants, emergency approvals, and external sharing should be confirmed through separate channels, cryptographic signatures, registered workflows, hardware keys, and separation of duties. Identity must move from appearance to verifiable authority.

Secrets leaked to GitHub and the side effects of AI coding

AI-era security problems are not only external attacks. When developer productivity rises, accidents can accelerate too. GitGuardian’s 2026 State of Secrets Sprawl reported that about 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025, a 34% year-over-year increase. It also reported that AI-service-related secret leaks rose 81%, and that commits co-authored by Claude Code leaked secrets at roughly twice the public GitHub baseline.

This does not mean AI coding is bad. AI coding accelerates developers, makes prototypes easier, and gives individuals and small teams more leverage. The problem is that design, review, permission management, secret management, and environment separation have not always evolved at the same speed.

Hardcoded API keys existed before AI. But if an agent is asked, “Write a script that calls this API and saves the result,” it may produce the shortest path to working code. Unless the human explicitly asks for environment variables, secret managers, Vault, OIDC, short-lived tokens, .env exclusion, CI secret scanning, and least privilege, the agent may optimize for “it runs now.” Humans may also review less carefully because the code appeared instantly. The rate of accidents per unit time can rise.

For solo developers this matters. Building a SaaS, using Lambda, integrating LINE Messaging API, calling OpenAI or Gemini APIs, and deploying through GitHub Actions all involve keys and tokens. Development keys, production keys, read-only keys, write-capable keys, payment keys, and data-deletion keys should be separated. Credentials given to AI should be short-lived, limited, auditable, and easy to revoke.

EchoLeak and AI-assistant-native vulnerabilities

Traditional security assumed that humans click links, open attachments, enable macros, or type credentials. But when AI assistants read email, documents, chats, files, and internal knowledge across boundaries, the attack surface changes. What the AI reads, summarizes, and retrieves becomes part of the attack surface.

EchoLeak, disclosed in 2025 for Microsoft 365 Copilot, was a symbolic example. The research showed that a crafted email could indirectly prompt-inject Copilot during processing and create a path for internal information to be exfiltrated externally. The crucial point is that the user did not need to click a link or run malware. The AI assistant itself crossed data boundaries.

An AI assistant is not merely a search box. It reads context and produces output. Email text, Markdown, images, links, Teams, SharePoint, and internal documents can become one context window. If an attacker places “secret instructions” inside that context, the question becomes how reliably the assistant can distinguish instructions from data.

Web security already had SQL injection, XSS, CSRF, and SSRF: vulnerabilities around input and execution boundaries. Prompt injection in LLM applications resembles those problems, but natural language makes it harder. Instructions, evidence, comments, user intent, and attacker intent are not always cleanly separable. AI applications need provenance controls, permission separation, output sandboxing, external-communication limits, data classification, and audit logs—not just better prompt wording.

Replit and the production-database deletion lesson

AI can be abused by attackers, but it can also cause damage inside legitimate development environments. The 2025 Replit AI-agent production database deletion incident became a canonical example. Reports described an AI development agent deleting production data; Replit’s CEO discussed countermeasures such as automatic development/production separation, improved rollback, and planning-only modes.

It is dangerous to summarize this as “the AI was stupid.” The core issue is that the AI had the authority to execute destructive actions. AI agents do not get tired. They do not hesitate. They run commands quickly, read logs, infer fixes, and retry. When they act on the wrong premise, they can destroy things quickly. A human might pause and ask, “Is this production?” The agent may keep pursuing the objective function: solve the problem.

The answer is design, not scolding. Development and production must be physically and logically separated. The AI should not be able to connect directly to production databases. Destructive actions need approval gates. Backups must not be deletable by the same authority. Read and write privileges should be separated. CI/CD should contain human approval where appropriate. Destructive operations should require tickets, MFA, maintenance windows, or separate-channel approval—not only “Are you sure?” prompts.

Pocholab’s view is simple: avoiding AI agents is not the answer. Giving an AI agent the crown jewels on day one is the mistake. We would not give a new human engineer DROP privileges on the production database on the first day. AI should be managed by authority, not by assumed capability.

Step Finance and authority in crypto systems

In crypto, private keys and wallet authority translate directly into the ability to move money. In January 2026, Solana DeFi platform Step Finance reportedly lost about USD 40 million in digital assets after executive devices were compromised. Reporting focused less on a smart-contract bug and more on executive devices and access to treasury wallets.

We should not claim that an AI agent directly caused that incident. The confirmed core is executive-device compromise and wallet access. But for the AI-agent era, the lesson is clear: funds, private keys, treasury wallets, deployment keys, and administrator devices must not be concentrated into a single point of compromise, whether the operator is human or AI.

As AI agents take on financial processing, trading, billing, payments, inventory ordering, ad operations, and cloud-resource management, the risk grows. If the AI acts correctly, work becomes faster. If it believes manipulated input, has excessive authority, or executes without verification, damage becomes faster too.

“Human in the loop” must not be a slogan. Putting a human approval on every action destroys automation. Automating everything creates unacceptable risk. The approval weight should depend on amount, blast radius, irreversibility, external exposure, and presence of personal information. Adjusting a small ad budget and moving a large treasury cannot be the same. Creating a table in development and deleting production data cannot be the same.

North Korea-linked fake recruiting and AI compatibility

From 2025 into 2026, fake recruiting, fake interviews, fake engineers, and fake recruiters associated with North Korea-linked threat activity continued to be reported. Microsoft has described activity such as Sapphire Sleet and Contagious Interview, where attackers pose as recruiters or interviewers and persuade developers to run malicious packages or tools. Google Threat Intelligence also associated the Axios compromise with a North Korea-linked actor.

This tactic fits AI extremely well. Recruiting is already online. Developers expose rich public information through GitHub, LinkedIn, X, blogs, npm, PyPI, and Docker Hub. An attacker can tailor conversation to the target’s stack. Generative AI can produce natural English, Japanese, Korean, Chinese, or Spanish at scale. It can help create fake company profiles, job descriptions, interview tasks, code-review requests, SDK updates, and meeting links.

The attacker is no longer just “someone who sends a suspicious link.” They can show interest in the target’s career, offer a plausible opportunity, appear to evaluate technical ability, and build trust over days or weeks. In supply-chain attacks like Axios, code-writing ability is not enough. The ability to create a story around the target matters.

In that sense, the modern attacker is both hacker and screenwriter. They handle original concept, script, direction, acting, and editing. AI gives that one-person orchestra text generation, translation, image generation, voice synthesis, video generation, code generation, research, and verification.

AI fills the criminal last mile

At this point, the pattern becomes clear. AI is not necessarily “committing crime” by itself. It fills the last mile of crime. The criminal design, target selection, and profit motive remain human. But AI helps with the final convincing message, the voice that sounds familiar, the face in the meeting, the plausible company website, the plausible GitHub activity, the plausible interview task, and the plausible error screen.

In the past, criminals faced technical constraints. Weak English made overseas targets harder. Lack of editing skill made deepfakes harder. Lack of coding skill made malware or fake SDKs harder. Performing multiple personas took time. AI lowered those constraints. It did not remove expertise entirely, but it allowed parts of expertise to be outsourced.

The same is true for good creation. A video creator can use AI for storyboards, narration, images, voice, and editing. A web-service builder can use AI for requirements, UI, code, tests, and deployment. A novelist can use AI for world-building, structure, style, and revision. AI shortens the last mile in both good and bad directions.

So the question in the AI era is not “use AI or not.” It is “what do we imagine, how do we instruct it, how far do we delegate, where do we stop, and how do we verify?”

Tools can be democratized; mastery cannot

When everyone can use AI, everyone can make impressive things. That is half true. The other half is false. Everyone has a camera, but not everyone is a film director. Everyone has a smartphone, but not everyone is a photographer. Everyone can use a word processor, but not everyone is a novelist. Everyone can use spreadsheets, but not everyone is good at management analysis.

In the age of AI agents, the crucial skill is not a small prompt trick. Clear instructions, constraints, output formats, examples, and evaluation criteria matter. But before that, people must understand what they want to create. More precisely, they must convert vague images in their mind into language.

This cannot be reduced to “science people” versus “humanities people.” Some technical people are excellent at language. Some humanities people struggle with abstraction and structure. The real issue is overall cognitive ability, vocabulary, structuring, abstraction, and explanation.

When humans give complex instructions to AI, they must externalize the world inside their head. “Make a warm website” is weak. Stronger instruction explains who visits, at what time, with what feeling, what they see first, what anxiety is resolved, what button they press, where they may leave, and what words make them trust the page.

Video creation is the same. “Make it cool” is weak. Quality rises when the human can describe light source, camera position, facial expression, color temperature, background, time of day, motion, continuity with adjacent scenes, viewer emotion, and relation to narration. Code generation is the same. “Make login” is weaker than specifying authentication method, session management, password reset, email verification, rate limiting, error handling, audit logs, permission model, and test cases.

Narrative intelligence

A useful name for the needed ability is narrative intelligence. This does not mean merely writing entertaining stories. It means structuring complex events as time flow, causality, actor intent, institutional background, risk, purpose, conflict, and resolution.

The Axios case shows that attackers were not merely technicians. The sequence looked like a script: create a reason to approach the target, make contact seem natural, build trust, guide the target into a fake meeting or process, disguise the next step as an update or error, and finally reach credentials or package-publishing authority. The script controls where suspicion is reduced, where action is triggered, and where verification is skipped.

This is criminal and should not be praised. But structurally, good product development and creative work also require related abilities. Read user psychology. Design the path. Arrange tools. Consider failure branches. Translate abstract intention into concrete steps.

Logic and programming matter, but they are not enough. Humans act through emotion, context, trust, expectation, anxiety, inconvenience, approval seeking, urgency, and fatigue. A person who can use AI well must read not only system structure but also human context.

Reading, vocabulary, and long thought

Where do narrative intelligence and verbalization ability come from? One important source is reading. Reading is not merely acquiring knowledge. It trains the mind to follow long text, infer character intent, remember foreshadowing, understand causality, and hold abstract concepts over time.

Research by Cunningham and Stanovich found that reading volume independently contributes to vocabulary knowledge even when general intelligence and decoding ability are statistically controlled. This matters because vocabulary is not just a list of difficult words. Vocabulary is the tool for expressing feelings, situations, discomfort, design intent, risk, and nuance more precisely.

Anyone who has tried to speak a foreign language knows the feeling: the idea exists in the mind, but the word does not come out. The same happens in one’s native language. If a person lacks words for a vague inner sense, they can only give vague instructions to AI. A person exposed to many words and sentence structures can externalize mental images and concepts at higher resolution.

Short-form video creates an important contrast. TikTok, YouTube Shorts, and Instagram Reels are powerful entertainment. They deliver frequent stimulation and constant novelty. But building the ability to hold long structures likely requires more than short rewards. Recent research and reviews have discussed associations between excessive short-video use and attention difficulty, cognitive fatigue, and reduced learning concentration. Short video is not evil; it can teach and express. The issue is whether the mind loses time for long-context holding.

Using AI agents well requires more than one minute of thought. Sometimes it requires five minutes, ten minutes, an hour, or days of sustained conception. A web service involves user experience, security, operations, cost, law, marketing, video structure, scripts, thumbnails, and funnels. Holding all of that as one structure requires the muscle of long reading and long thinking.

Parent-child conversation and output practice

Verbalization ability also grows through dialogue. Developmental psychology describes “serve and return”: a child acts or speaks, an adult responds, and the child responds again. This responsive loop supports brain development, language, social skills, and emotional regulation. It is not elite education. It is ordinary conversation: What happened at school? Who did you play with? What bothered you? Why did you think that? What do you want to do next?

For a child, such conversation is a small presentation. The child recalls events, orders them, names emotions, and explains them to another person. When an adult asks, “What happened next?” or “How do you think the other person felt?” the child learns to see events from multiple perspectives. This is connected to the future ability to instruct AI.

Good AI instruction is, in one sense, explaining what is happening inside one’s head in an order the other side can understand. Childhood conversation, diaries, book reports, essays, story comprehension, discussion, presentations, and ordinary chat all contribute. Saying that native-language ability matters in the AI era is not nostalgia for old school subjects. It means that abstract thinking in one’s mother tongue has become an interface for operating AI.

This is not an argument that one family form is good and another is bad. The important factor is the quality and amount of responsive conversation. Even short interactions matter when adults respond carefully, rephrase, ask questions, and help name feelings.

The security mindset practitioners need

What should companies and individual developers do? First, treat an AI agent as a non-human user. Do not hide it behind a human account. Give it its own identity, permissions, audit logs, and scope. Think in terms of non-human identity management. Do not reuse long-lived API keys and tokens casually. Prefer OIDC and short-lived credentials that provide only the necessary authority at the necessary time.

Second, minimize AI authority. For many code-generation tasks, read-only access is enough. Review, design, test generation, and documentation usually do not require production write access. If database operations are needed, separate staging from production and require human approval for destructive production actions. Cloud operations, DNS changes, payments, personal-data export, mass email, public release, and npm or PyPI publishing need stronger gates.

Third, manage secrets rigorously. Do not put API keys on GitHub. Do not paste secrets into prompts. Mask tokens, email addresses, personal data, and session IDs before giving logs to AI. Integrate GitHub Secret Scanning, GitGuardian, trufflehog, or gitleaks into CI. Do not stop at putting .env in .gitignore; maintain secret inventory, rotation, and revocation procedures.

Fourth, do not overtrust AI outputs. AI-written code may run, but that does not mean it is safe. If AI says “I tested it,” verify that tests actually ran. If AI says “this is staging,” check the real connection string. Trust should be based on verifiability, not personality. The goal is not to scold AI, but to build environments where mistakes do not destroy production.

Fifth, redesign identity verification. A visible face, recognizable voice, or presence in Teams or Zoom is not enough for high-risk operations. Use registered approval flows, separate-channel confirmation, hardware keys, signatures, tickets, and separation of approvers. Conditions such as “urgent,” “secret,” “directly from the boss,” “send money now,” and “make an exception” are classic fraud signals.

Sixth, make AI use visible instead of simply banning it. Shadow AI is dangerous. If employees paste internal data, code, logs, or customer information into unmanaged personal AI accounts, a new uncontrolled data-leak path appears. A ban-only strategy drives use underground. Companies need clear rules for approved AI tools, permitted data, forbidden data, logging, model-training use, approvals, and audits.

Use AI early, not timidly

When AI threats are discussed, people often drift toward “AI is dangerous, so we should not use it.” That is not realistic. Attackers will use it. Competitors will use it. Customers will use it. Developers, students, and scammers will use it. If only defenders and good developers refuse it, they become weaker.

The right posture is to use AI early while being careful at the same time. This is not contradictory. Societies did not respond to cars by banning cars; they built licenses, signals, inspections, seat belts, airbags, insurance, and traffic rules. AI agents need the same kind of governance: authority, auditing, verification, education, responsibility boundaries, and incident response.

For solo developers, this is a major opportunity. Work that once required a small team can now be attempted alone: landing pages, SaaS, dashboards, videos, narration, ads, SEO articles, prompts, images, tests, and deployment. But the personal responsibility range also expands. From the beginning, production data, payments, personal information, and API keys must not be handled casually. Building small is not the same as building carelessly.

What humans should train in the AI era

What should humans train? First, verbalization: turning vague images, discomfort, intentions, goals, and constraints into words. Second, structuring: dividing complex things into sequence, hierarchy, causality, dependencies, risks, and exceptions. Third, verification: separating AI outputs into facts, guesses, errors, unconfirmed claims, and risks. Fourth, long concentration: holding long context rather than only short stimulation. Fifth, ethics and responsibility: separating what can be done from what should be done.

Reading is often underestimated here. Reading will not become obsolete in the AI era; it becomes more important. Long reading trains long-context holding. Reading character intent trains social inference. Understanding abstract concepts prepares humans to give high-resolution instructions. Vocabulary gives people more tools for externalizing the inner world.

Video, SNS, short text, chat, and short-form content are useful and enjoyable. But by themselves, they do not easily build long conception. The person who truly masters AI agents is not the person who only gives short commands. It is the person who can think long, then give short and precise instructions when needed. A short prompt is powerful only when a long conception stands behind it.

Conclusion: AI asks about human resolution

The AI-related security incidents visible from 2025 to 2026 are not merely technical news. The Axios supply-chain attack showed that trust and dependencies are attack surfaces. Arup’s deepfake fraud showed that face and voice are no longer sufficient identity proof. GitHub secret leaks showed that faster development makes unmanaged credentials more dangerous. EchoLeak showed that AI assistants can create new exfiltration paths when they cross internal and external context. Replit showed that even without malice, an AI with the wrong authority can damage production.

The conclusion is not to avoid AI. The conclusion is to raise the resolution of the humans using AI. What do we delegate? What do we never delegate? Where do we stop it? Which authority do we give? Which logs do we inspect? Which information do we hide? Which operations require human approval? How do we verify identity? These questions must be verbalized, designed, and operated.

The same is true on the creative side. To build a web application, make a video, write a novel, or create a business, humans must translate abstract images into language, pass them to AI, inspect outputs, revise, and integrate. The important ability is neither purely technical nor purely literary. It is a combined intelligence that moves between logic and story, design and expression, abstraction and concreteness, speed and caution.

AI is not magic that thinks in place of humans. It is a tool that amplifies human conception. If the conception is shallow, shallow output appears quickly. If the conception is rough, rough output appears at scale. If the conception is malicious, malice is amplified. But if the conception is deep, language is clear, and design is cautious, AI can multiply the possibilities of one person.

Therefore the necessary posture is not to fear AI from a distance. It is to use AI while training one’s own language, conception, reading, ethics, and verification. In the end, the question is not only AI performance. It is the resolution of the human who decides what to show AI, what to say to it, what to let it do, and where to stop it.

References

• IBM Cost of a Data Breach Report 2025
• FBI 2025 Internet Crime Report announcement
• Microsoft Security: Mitigating the Axios npm supply chain compromise
• GitGuardian State of Secrets Sprawl 2026
• EchoLeak paper
• BleepingComputer: Step Finance says compromised execs' devices led to $40M crypto theft