Thirteen ways attackers break or abuse AI, what each attack defeats, and where internal audit and the audit committee should press. Documented losses, mapped to the controls that hold.