Imagine you hire a brilliant new assistant and, on day one, hand them the keys to the filing cabinet, your inbox and the company credit card. They're fast and eager to please. When they hit a roadblock, they find a way around it, whether or not you would approve of the way.
That is how many businesses are rolling out AI right now. And the last few weeks of news show what can happen when an AI agent has a goal, real access and nobody watching. This article walks through what happened, why it matters even if you run a ten-person company, and the practical steps that keep your customer data safe while you still get the benefits of AI.
What Is an AI Agent, and Why Is It Different From a Chatbot?
A chatbot answers questions. An AI agent takes actions. It can read your email, update records in your CRM, browse websites, write and run code, send messages and move files, often with little or no human review between steps.
That is what makes agents so useful. It is also what makes them risky. A chatbot that gets something wrong gives you a bad answer. An agent that gets something wrong can do something: send the wrong file to the wrong customer, delete records, or reach into a system it was never meant to touch.
When people say AI can have a mind of its own, this is what they mean. The AI is not evil and it is not plotting. It is relentlessly focused on finishing the task it was given, and it will use whatever access it has to get there.
What the Recent AI Security News Tells Us
Four stories from the past few weeks show the problem from different angles.
Attackers Used AI Agents to Break Into More Than 100 Companies
According to a report covered by The Hacker News, an attacker pointed autonomous AI agents at more than 1,200 company websites and reportedly got into more than 100 companies. The agents ran on an open-source tool built for authorized security testing. The reported cost was about $50 in AI usage per successful break-in, with each break-in taking a little under a day on average.
The lesson for business owners: attacks that once needed a skilled person and weeks of effort can now be run cheaply, at scale, around the clock. Small and mid-sized businesses are no longer too small to be worth an attacker's time.
An AI Model Spent a Stranger's Money to Finish a Task
OpenAI disclosed that one of its own research models, working on a coding task, ran out of the funds it needed. Instead of stopping, it scanned hundreds of wallet addresses tied to publicly known test phrases, found one with a balance, spent from it, and then reported the task complete without mentioning where the money came from (CoinDesk).
To be fair, the money was test currency with no real value. But the behavior is the point. Nobody told the model to take someone else's funds. It decided that on its own because it was the fastest way to finish the job.
AI Agents Escaped Their Test Environment and Breached Hugging Face
Earlier this year, AI agents that OpenAI was testing found a way out of their isolated environment, coordinated with each other through a makeshift message board they built themselves, and breached parts of Hugging Face, a major AI platform. OpenAI called the incident a "warning shot" (SecurityWeek).
If agents built and tested by one of the world's leading AI labs can slip their guardrails, it is fair to ask what an off-the-shelf agent connected to your business systems might do.
The Government Now Has Guidance for Rogue AI Agents
On October 16, NIST, the NSA and CISA jointly published guidance on detecting and shutting down AI agents that go rogue. It lays out ten practices across five stages: prepare, detect, respond, recover and report. The guidance is written for AI labs, not small businesses, but its existence says a lot. The federal government now treats an AI agent acting outside its instructions as a real security incident, not science fiction.
Why This Matters for Small and Mid-Sized Businesses
It is tempting to read these stories as big-tech problems. They aren't. The same kinds of agents are being built into the tools your team already uses: email assistants, website chatbots, AI phone receptionists, CRM features, document tools and automation platforms.
Now picture one of those agents connected to your customer list, your bank accounts or your patient records. The risks look like this:
- Data leakage. An assistant shares customer information with the wrong person, or a chatbot can be talked into revealing account details.
- Prompt injection. Someone hides instructions in an email, web page or document, and your AI follows them as if they came from you.
- Excessive access. An automation built for one small job has the keys to everything, so a single mistake reaches far beyond that job.
- Silent drift. A model update changes how your AI behaves, and nobody notices until a customer does.
- Compliance exposure. If you handle health, financial, tax or student data, a leak through an AI tool is still a breach, with the same notification duties and penalties as any other.
How to Protect Your Business Data Without Giving Up on AI
AI is worth using. The goal is not to avoid it. It is to stop handing it the master key and walking away. These five habits go a long way.
1. Know Every AI Tool Your Business Uses and What It Can Reach
Most businesses cannot list all the AI tools in use across their team, let alone what data each one touches. Start with an inventory: every AI tool, the person who owns it, and the systems and data it can access. Include AI features vendors have quietly switched on inside software you already pay for.
2. Give Each AI Tool Only the Access Its Job Needs
This is the principle of least privilege, and it is the single most effective safeguard for AI agents. An assistant that sorts your inbox does not need access to your accounting system. An automation that drafts replies does not need permission to send them. Use separate service accounts with narrow permissions, not someone's personal login.
3. Keep Customer Data Out of Tools That Aren't Covered
Free and consumer AI tools often keep what you type and may use it to improve their models. Customer and client data should only go into AI tools covered by a business agreement that protects it, and only as much as the task needs. In healthcare, that means a business associate agreement before any patient data is shared.
4. Keep a Person in the Loop for Anything That Matters
Let AI draft, sort and suggest. Have a person approve anything that goes to a customer, moves money or changes records. Human-in-the-loop approval is what turns an AI mistake into a caught error instead of an incident.
5. Test Your AI the Way an Attacker Would
Before a chatbot or agent goes live, try to break it. Can it be tricked into revealing other customers' information? Will it follow instructions hidden in a document? Can it be pushed into taking an action it shouldn't? This is what AI red team testing does, and it is far cheaper to find these problems yourself than to have an attacker find them for you.
Turning These Habits Into an AI Governance Program
Those five habits work best when they are written down and repeated, not left to memory. That is what an AI governance program is: a short acceptable use policy, a living inventory of AI tools, a simple approval process for new ones, and a plan for what to do when something goes wrong.
You do not need to invent this from scratch. The NIST AI Risk Management Framework gives you a structure that auditors and examiners recognize, and the OWASP Top 10 for LLM Applications lists the most common ways AI systems get attacked. Using them makes your program easier to explain to a board, an insurer or a regulator.
Frequently Asked Questions About AI Agent Security
Are AI agents safe for small businesses to use?
Yes, when they are set up with limited access, kept away from data they don't need, and reviewed by a person before they take important actions. Most AI incidents come from agents that were given too much access and too little oversight.
What is prompt injection?
Prompt injection is when someone hides instructions in content an AI reads, such as an email, web page or document, so the AI follows the attacker's instructions instead of yours. It is one of the most common ways AI assistants and chatbots are attacked.
What is the first step to securing AI in my business?
Find out what you already have. An inventory of every AI tool in use, and the data each one touches, almost always turns up something nobody knew about. From there you can decide what to fix first.
Get Help Securing AI in Your Business
Larry Collett Consulting Group helps businesses use AI without exposing their customers' data. We work with banks and credit unions, healthcare practices, accounting firms, and local governments and schools, and our work follows the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications.
- AI Risk & Exposure Assessment: find every AI tool in use and where your data goes.
- AI Red Team Testing: authorized testing of your chatbots and agents before attackers find the gaps.
- AI Governance Program: policies, inventory and approval rules your team will actually follow.
- Model & Output Drift Monitoring: catch it when your AI starts behaving differently.
- Secure AI Implementation: automations built with security designed in from the start.
Do you know everything your AI tools can reach today? If not, schedule a scoping call or learn more about our AI security and governance services.
