20 ghost contacts named x***xx: what happens when AI writes to a CRM with no framework

What we came across. About 20 contacts appeared in a HubSpot portal, with first and last names like x***xx. They had been imported by an AI. Nobody could say where they came from or whether they were safe to use.

What happens behind the scenes

A record that looks real but isn’t is worse than a missing one. Ghost contacts distort lists and scoring, and they can slip into a workflow and trigger real emails. Cleaning them up is not a five-minute job: you have to trace every import, work out which records are real, and check what they touched.

What we did

We traced the import back to its source, then put data governance in place: what may be imported, who validates it, and how every import is tracked and reversed. It took two extra days of work, days the team would not have needed with a framework set up before the first import.

The framework, up front

1. What may come in. Required fields, and a refusal of masked or placeholder values.
2. Who validates. A human checks a sample before an import goes live.
3. Traceability. Every import carries its source and date, so it can be reversed.

HubSpot already gives you part of this: imports are listed with their name, source and author, their records can be reviewed or deleted, and the record creation source field lets you build a view of everything that came from an import or an API.

Takeaway: the AI wasn’t the problem, the missing framework was. Two days of cleanup is the price of skipping a short setup.

Want to know if your CRM has this kind of gap? The 5-minute diagnostic shows where your tools, data and automations stand.

Read next: The AI built the lead scoring. Nobody can say why a lead is a 78 · Vibe-coded CRM, first security test: anyone could read the client data