Passive delegation is the practice of letting an AI system make judgments or choices without active human review. Instead of using AI as an assistant, the user accepts its output as if it were the decision itself. In cybersecurity, that shift matters because confidence can hide uncertainty, errors, or missing context.
It often appears in workflows such as phishing triage, alert handling, code review, or access decisions, where a model recommendation is accepted without checking the evidence. Attackers can benefit when defenders trust AI too quickly, because persuasive but wrong output can drive unsafe actions. Defenses against passive delegation include human approval for high-risk steps, clear limits on what AI may decide, audit logs, and confidence thresholds that force review when the model is uncertain.