What to Ask Before You Let an AI Agent Touch Company Data

Somewhere in your company, an AI agent is about to get connected to the inbox, the CRM, or the payment tool. Someone on your team is excited about it, and it probably should get built.

But before it goes live, ask a few questions you can't delegate entirely to IT, because the answers determine how much damage a bad day can do. You don't need to understand the code. You need to know what the agent can touch, who's watching it, and how fast you can shut it off. That's the short list that separates a well-run rollout from next year's incident report.

What the latest data shows (as of October 2026)

The security research community spent 2026 cataloguing exactly how AI agents go wrong in production, and one failure mode keeps showing up more than any other: the agent gets tricked by something it reads, not something it was told. Security researchers call this prompt injection, and it's the reason "what data can this agent see" and "what can it do once it sees something bad" have become the two most important questions in the room.

Key Facts

• The OWASP Top 10 for Agentic Applications maps prompt injection to six of its ten risk categories, and Help Net Security's coverage of the framework calls it the single technique tying most real-world agent security failures together.
• Unit 42, Palo Alto Networks' threat research team, found hidden instructions embedded in live webpages that AI agents read, including attempts to trigger unauthorized payments and data-destroying commands once an agent visited the page.
• EchoLeak, a zero-click flaw in Microsoft 365 Copilot, let an attacker pull internal data out of the system from a single crafted email with no click, download, or approval from the victim required (analysis by George Washington University researchers; tracked as CVE-2025-32711, CVSS 9.3).
• In a Cloud Security Alliance survey of 445 security professionals, 53% said an AI agent had exceeded its intended permissions, and 47% had experienced a security incident tied to an agent in the past year (Cloud Security Alliance, 2026).
• A Cloud Security Alliance research note on MCP security, the connector standard many agents use to reach outside tools, reported that a 2025 internet scan found at least 1,862 publicly reachable servers answering requests with no authentication at all, plus confirmed cases of malicious connectors reaching real companies.

Here's why that matters to you, not just your security team. A prompt injection attack doesn't need to break into your network. It just needs the agent to read something, a webpage, an email, a shared document, that contains hidden instructions. If the agent can act on what it reads without a human checking in, the attacker never has to touch your systems directly. They just get the agent to do it for them. EchoLeak proved this isn't hypothetical: no one clicked a link or opened an attachment. An email arrived, Copilot processed it as part of its normal job, and that was the entire attack.

Why this is different from a normal software bug

Traditional bugs get patched and stay patched. Prompt injection is harder to fully close because of how large language models work: they process instructions, your request, and any text pulled from outside sources (a webpage, an email, a document) as one continuous stream of words. There's no reliable way to mark some words as trusted commands and others as data to read carefully. A well-crafted sentence hidden in a webpage can look, to the model, exactly like an instruction from you. You can't eliminate that with one patch. You manage it by limiting what the agent can do with what it reads, especially content from outside your organization.

A useful mental shortcut, borrowed from security researcher Simon Willison's widely cited framing: watch for any agent that has all three of the following at once. Access to private data. Exposure to outside content (web pages, incoming email, shared documents). And the ability to take an action that leaves the building: sending a message, moving money, posting publicly. An agent with all three should not run unsupervised. Remove one of the three, or add a human checkpoint before the risky action, and the threat mostly loses its teeth.

Supply chain risk compounds this. Many agents reach outside tools through connectors or plugins (the Model Context Protocol, or MCP, is becoming a common standard for this). The Cloud Security Alliance research cited above found thousands of these connectors running with no authentication, plus at least one malicious connector already installed by hundreds of organizations before it was caught. Every connector is a new vendor relationship, whether anyone framed it that way when it got approved or not.

Treat the agent like a new hire with a badge

The framework that works for most leadership teams is one you already understand: hiring. A new employee with broad access goes through vetting, gets only the access their role requires, needs a manager's sign-off for certain actions, and has an offboarding process the day they leave. Most AI agents get none of that. They get built fast, connected to whatever the integration needed, and left running with no one clearly accountable.

The eight questions below are what a CEO can ask a vendor or internal team proposing the next agent. You need the plain-English version, with a name attached.

A vague answer isn't cause for panic, but it's the item to fix before the agent goes further into production. The AI agent security guide and how prompt injection works against agents cover the technical detail behind these answers, and where to place human-in-the-loop approval gates helps with the second question specifically.

What to do in the next 30 days

You don't need a security overhaul to make real progress. Four moves, in order, close most of the gap.

Week 1: Find out what's actually running. Ask every department head, not just IT, which AI agents or automated assistants are connected to company systems. The real number is almost always higher than what IT has on file.

Week 2: Sort by what each agent can do, not what it's for. An agent that drafts internal summaries is low risk. One that can send external email, touch customer records, or move money is high risk, regardless of how simple it seems. Run the high-risk agents through the eight questions first.

Week 3: Put a human checkpoint on every irreversible action. For each high-risk agent, write down the specific actions that need approval, and confirm someone is actually reviewing those requests, not auto-approving out of habit a month in.

Week 4: Assign an owner and a kill switch to each agent. One name per agent. One documented way to disable it fast. If your team runs CRM or workflow automation on a unified platform like Rework, the system that already logs activity and gates approvals for your human team can often double as the audit trail and off switch for an agent working inside it, so you're not building a separate control layer from scratch.

None of this requires pausing an agent that's running well. It requires knowing, in plain language, what it can touch and who's accountable if it goes wrong. The AI governance gap most companies are running with right now, the machine-identity access problem flagged in the 2026 Verizon breach report, and a template for the department-level policy that makes these rules stick sit right alongside this one.

Source: OWASP Top 10 for Agentic Applications, OWASP GenAI Security Project (2025) | Help Net Security, "Why prompt injection is the top AI security failure mode" (2026) | Unit 42, Palo Alto Networks (2026) | CVE-2025-32711, National Vulnerability Database | Cloud Security Alliance, AI agent scope violation survey (2026) | Cloud Security Alliance, MCP security research note (2026)