AI Inside Your Vendors: Prompt Injection, Agent Permissions and the Questions to Ask Before You Connect Anything

The assistant that did exactly what the email said

The founder of a 20-person e-commerce brand in Austin connects an AI assistant to the business in July. It reads the shared inbox, checks orders in Shopify, watches the bank feed for payments, and drafts replies to customers. Within a fortnight it is answering half the "where is my order" emails on its own and flagging the refunds that need a human. The customer service lead calls it the best hire of the year.

On a Tuesday in August a customer email arrives about a delayed order. Below the signature, in text the same colour as the background, there are three more paragraphs. They are written to the assistant, not to a person. They tell it that the company's accounts team has moved, that all supplier invoices from the last 90 days should be forwarded to a new address for reconciliation, and that this instruction should not be mentioned in the reply to the customer.

The assistant has send permission on the inbox because the founder wanted it to reply to customers. It has read access to everything because the setup wizard suggested "full access for best results." It forwards 214 invoices, with supplier bank details, to an address nobody at the company has seen, and writes a polite reply to the customer about the delayed order.

The founder finds out nine days later, when a supplier calls to ask why the company has requested a change to its payment details. The supplier's "change request" came from the company's own inbox, with a real invoice attached, and looked exactly right.

What the heck does this mean

An AI agent is an assistant that does not just answer questions but takes actions: reads your mail, opens your orders, sends replies, moves files. The convenience comes from the permissions. So does the risk.

Prompt injection: text hidden in an email, a web page or a document that an AI reads and follows as if it were an instruction from you. The OWASP Top 10 for LLM Applications 2026, published on 4 August 2026, puts it at number one.

Permissions, or scopes: the list of things an app is allowed to do in your inbox, your store or your bank feed. "Full access" is a scope, and it is the wrong one.

OAuth: the "sign in with Google" or "connect to Microsoft" button that grants those scopes; attackers abuse it because a granted token works even after a password change.

Model inversion: an attack that pulls training data or private information back out of a model; a concern when your data trains someone else's product.

MITRE ATLAS: the catalogue of known attack techniques against AI systems, at version 5.4.0, the AI equivalent of the ATT&CK matrix your security tools already map to.

The assistant did not malfunction. It read an instruction and carried it out, which is what it was built to do. The failure was that nobody decided which instructions it was allowed to obey, from whom, and with what power.

The numbers that matter

Breaches involving prompt injection averaged USD 5.89 million and those involving model inversion averaged USD 6.07 million in IBM's 2026 Cost of a Data Breach Report. Those are enterprise numbers, but the mechanism scales down to a 20-person brand with a bank feed just fine.

OAuth abuse accounted for 10% of identity attacks in Huntress's 2026 Cyber Threat Report. One in ten attacks on logins now comes through the "connect this app" button, which is the button every AI assistant asks you to press.

Leaks of secrets belonging to AI services surged 81% in GitGuardian's State of Secrets Sprawl 2026. The keys that let assistants into your systems are being lost at a faster rate than any other kind.

What to do this week

1. Open the connected-apps page in Microsoft 365 or Google Workspace, Shopify and your bank, and list every AI tool with a token. For each one, write down the scopes it holds and who approved them. (CIS 6 Access Control Management)
2. Cut every scope to the job. Read-only where the assistant only needs to read; send limited to replies in the customer-service mailbox; no access at all to the bank feed unless a person confirms every action. Revoke and reconnect if the vendor cannot do partial scopes. (CIS 6 Access Control Management)
3. Put a human gate on anything that moves money or data outside the company: forwarding, bulk export, payment detail changes. The assistant drafts; a named person sends. (CIS 6 Access Control Management)
4. Send each AI vendor the five questions from the FAQ below and file the answers with the contract. A vendor that needs "full access for best results" has told you what its security review looks like. (CIS 15 Service Provider Management)
5. Rotate the API keys and tokens the assistants use, store them in a secrets manager rather than a shared document, and set a reminder to rotate again in 90 days. (CIS 16 Application Software Security)
6. Test the assistant yourself. Send it an email with a hidden instruction and see what it does. If it obeys, you have learned something for the price of one message. (CIS 16 Application Software Security)

Where AccuSights fits

Our assessment inventories every AI connection into your mail, store and bank, the scopes each one holds and the vendor terms behind them, then ranks what to cut first. The Cyber Hygiene Test takes three minutes for a first score; 15 minutes with an engineer settles which permissions the assistant actually needs.

The read-only compliance agent shows which connections and permissions collide with your regulators' data rules. We have no access and do not remediate; you or your IT partner fix, we show you where.

Questions people ask

What permissions should an AI assistant have? The least it needs to do the one job you hired it for, under its own account, with no ability to send money or change bank details. Read access to the inbox is different from send access; read access to orders is different from refund access. Set the scopes yourself rather than accepting the vendor's default, and put a person between the assistant and anything that moves money or data outside the company.

Can an AI agent be tricked by an email? Yes. An assistant that reads incoming mail treats the text of the email as information, and a well-written email can contain instructions the assistant follows as if they came from you. That is prompt injection, and it sits at number one in the OWASP Top 10 for LLM Applications published in August 2026. The defence is not a smarter model; it is limiting what the assistant is allowed to do when it is wrong.

How do I assess an AI vendor's security? Ask five things in writing: what data the tool stores and for how long, whether your data trains their models, which permissions it requests and why each one is needed, what happens to the connection and the data when you cancel, and whether they have an independent audit report or certificate. A vendor that cannot answer the permissions question in plain language should not have your bank feed.

Hire the assistant. Give it a desk, a badge and a job description. Do not give it the keys to the safe on its first day, because someone else will be writing its instructions by the second.