A US bank’s SEC filing: customer data put into an AI app it had not approved.
The law firm Wilson Sonsini called it the first such filing triggered by an unauthorized use of AI.
19 October 2026
the bank became aware of the incident
it judged the incident material
it filed a Form 8-K with the SEC
CB Financial Services, Inc., Form 8-K, 11 May 2026
On 11 May 2026, CB Financial Services, the Pennsylvania company that owns Community Bank, filed a Form 8-K with the US Securities and Exchange Commission under Item 1.05, the item for material cybersecurity incidents.
The bank became aware on 5 May of an internal incident in which non-public customer information was handled with an unauthorized AI-based software application. Customer names, Social Security numbers and dates of birth were among the information involved. The filing does not name the application.
On 7 May the company judged the incident material because of the volume and sensitive nature of the information. It said the incident had not had, and was not expected to have, a material effect on its financial condition or results.
American Banker reported in June that an employee had put the data into a tool the bank had not approved, using a personal account, while preparing a presentation.
In an alert of 29 May 2026, the law firm Wilson Sonsini called it the first Form 8-K filed under Item 1.05 because of an unauthorized use of AI.
What Mandate does
Mandate checks each message to eight AI websites, such as ChatGPT, Claude and Gemini, against your rules before it leaves, so a message with an ID number can be refused. Visits to 25 other AI websites are refused or recorded, as you choose, and the signed record shows each decision.
Sources
-
CB Financial Services, Inc.: Form 8-K, Item 1.05 (11 May 2026)
Source for the dates, the information involved and the company’s statements on materiality and on its financial results.
-
American Banker: “A bank breaks its silence on its shadow-AI breach” (June 2026)
Source for how the employee used the tool.
-
Wilson Sonsini: “Shadow AI” Triggers First SEC Form 8-K for Unauthorized AI Use (May 2026)
Source for the description of the filing as the first of its kind.
More reading notes
-
EY 2026: 47% say their AI governance process was skipped for urgent deployments
18 October 202698% of the 202 US senior AI executives EY surveyed say their company has formal AI governance policies in place, and 47% say the process was skipped for urgent deployments.
-
OWASP 2026: misuse of an AI agent’s identity and access is a top threat
9 June 2026The OWASP security project lists misuse of an agent’s identity and access among the ten highest-impact threats to AI agents, and recommends each agent get its own identity.
-
NTT DATA 2026: what the companies furthest ahead with AI prioritize in governance
9 June 2026Of the companies furthest ahead with AI in NTT DATA’s survey of 2,567 executives, 59.4% named data privacy or sovereignty across countries a top governance concern, against 49.6% of those furthest behind.
-
University of Queensland and MIT 2026: which sectors are most exposed to AI risk
8 June 2026A panel of 272 experts judged information, finance and national security the sectors most exposed to AI risk, and the authors write that the standards and enforcement AI needs are still forming or missing.
-
Schrems II and the CLOUD Act: which law reaches your data
18 May 2026Under the US CLOUD Act, a US court can order a provider under US law to hand over data it controls, wherever that data is stored.
-
IBM 2026: 18% of Canadian organizations say they have systems to govern AI across everyday operations
8 May 2026In an IBM Institute for Business Value study, 18% of Canadian organizations said they have systems to coordinate and govern AI across everyday operations.
-
United States v. Heppner: documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged
30 April 2026A US federal court found that documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged.
A free AI acceptable use policy template, written for Canadian privacy law and ready for your lawyer to adapt wherever you operate. Get the template