Your team's AI assistants are already signed in to work

· · AI Security

Somebody at your firm has probably already given an AI assistant access to their work email. Not through IT, and not through a policy. They clicked Allow on a screen that asked whether a new app could read their mail, see their calendar, and open their files, the same way they would connect a calendar app or a mileage tracker. Nothing about that click is unusual, and in most Microsoft 365 setups nothing stops it.

That matters more this autumn than it did last year. Personal AI agents, assistants that do not just answer questions but take actions for you, have gone from a hobby to a product category in under 12 months. They book things, chase things, summarise inboxes, and post messages. People are connecting them to work because that is where most of their tasks live.

What one connected agent did

Shane Mac, the chief executive of a software company, described what happened when he set up a personal "CFO" agent to give him a monthly report on his own bank accounts. He gave it read-only access to his personal accounts and told it to report only to him, in a group chat of his agents he had named "My Personal Exec Team".

On its first monthly run, it posted the report into his company's Slack, in a channel also called "Exec-team". His head of product messaged him to say he thought Mac had meant to post the company bank balance. It was his personal balance, his savings, and his biggest expenses of the month.

Nobody attacked anything. The agent did what it was told and picked the wrong destination, because Mac had connected his work Slack to one of his agents, and underneath, all of his agents shared the same connections. His response afterwards was to disconnect everything: Google, calendars, banking, payments.

Reverse the direction and you have the version a business should worry about. An agent connected to a work mailbox can carry work information into a personal channel just as easily. It also reads every email that arrives, including ones written for it. Malwarebytes, drawing on research by Barracuda, describes phishing emails carrying hidden instructions aimed at AI assistants: invisible to the person, readable by the software. In one example, the hidden text told a summarising assistant to add a fake priority task: change a supplier's bank details.

How the access is granted

Most of these agents reach work systems in one of a few ways: an Allow button on a consent screen, the person's saved passwords, a long-lived access key the person creates, or simply running on the person's laptop and seeing whatever they can see. The first is the most common and the easiest for you to check.

In Microsoft 365, that consent screen is governed by a setting in Microsoft Entra (the identity system behind your Microsoft 365 accounts). Microsoft's own documentation on user consent is plain about the default: "by default, a user can consent to allow an app to access their mailbox". If nobody has changed that setting since your tenant was created, any colleague can give any app, including an AI agent, access to their own email and calendar.

Google Workspace works differently but has the same question underneath: whether people can authorise third-party apps to reach Gmail, Drive, and Calendar without an administrator agreeing first.

What to do

You do not need to ban AI assistants to get this under control. Blocking everything mostly pushes people to forward work email to a personal account instead, which is worse. The aim is to know what is connected and to put a person in the loop for new connections.

First, look at what is already connected. This takes about ten minutes and tells you whether you have a problem.

  • Microsoft 365: in the Microsoft Entra admin centre, go to Enterprise apps, then All applications. Microsoft's guide to reviewing app permissions shows how to open any app's Permissions page and its User consent tab, which lists what individual people have granted.
  • Google Workspace: in the Admin console, go to Security, then Access and data control, then API controls, and open Manage Third-Party App Access. The Accessed apps list shows each app, how many people use it, and which services it reaches, such as Gmail or Drive. Google's guide to third-party app access walks through it.

Look for anything that reads or sends mail and that nobody recognises.

Then change who can say yes. In Entra, the user consent settings offer three choices: do not allow user consent, allow it only for apps from verified publishers asking for permissions you have marked low-risk, or allow it for any app. The middle option is a sensible default for most small firms. Pair it with the admin consent workflow, which lets someone request an app you have not approved and sends the request to a named person instead of a dead end. In Google Workspace, you can restrict Gmail and Drive so that only apps you have trusted can reach them. Be aware that restricting a service stops untrusted apps that are already connected, so do it after the review, not before.

Finally, tell people what the rule is. Something short works: personal AI assistants are welcome, connecting one to a work account needs a request first, and nothing an assistant suggests about payments or bank details gets acted on without checking the original message. That last rule is the one that stops the hidden-instruction email from turning into a payment.

If you have an IT provider, these are fair questions to send them: what is our current user consent setting, which third-party apps have access to mailboxes today, and who approves new ones?

How Steelwise can help

Working out which AI tools already have access to your accounts, and setting a policy that people will actually follow, is the kind of AI review we do. Get in touch.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.