Blog · AI and security

An AI agent is not a chat window. It acts.

As long as your AI answers questions, the worst it can do is say something silly. The moment it reads your mail and may also send something, every incoming text is a possible instruction.

AI and security 31 August 2026 James Doeland 7 min read

Most companies use AI today as a sharp colleague who reads along. It summarises calls, drafts replies, finds something in the archive. That works, and it is the right order. The step after that is where it gets interesting: it may also do things. Send a mail, raise an invoice, write a file, book a meeting.

At that moment something fundamental changes, and almost nobody stops to think about it. An assistant that only talks can at worst say something silly. An assistant that acts carries out what it reads. And it does not only read what you ask it. It also reads that mail from a stranger, the PDF attached to it, the text on a page it looks up for you.

To the model that is all the same thing: text. The difference between "this is an instruction from my boss" and "this is a piece of text I was asked to summarise" is not something a language model keeps sharp by nature. That is how the technology works, and it will stay that way for a while. Which is exactly why you build something around it.

Three things that are only dangerous together

What counts here is the combination. Once these three sit in the same environment, the question is not whether something goes wrong but when.

1

Data that matters

The assistant can reach your mailbox, your client files, your quotes, perhaps your bookkeeping. That is exactly why it is useful. It is also what there is to lose.

2

Text from outside

A mail from a stranger, an attachment, a page it looks up, a message in a group chat. Anyone may write there, and the assistant reads it as text like any other text.

3

A way out

Sending mail, sharing a file, posting a message, preparing a payment. Without this third one a misled assistant is annoying. With it, it is a leak.

Isometric plate: on the left a pale island where text arrives from outside through mail, chat and attachments, in the middle a gate with four checks the agent walks through, on the right the dark island holding client data, keys and the channel to the outside.
The gate that rarely gets built. On the left the text anyone may write into, on the right what there is to lose, and in between the place where a message only becomes an instruction once it passes four checks.

This is no longer theory

In February 2026 Check Point Research published its work on Claude Code, Anthropic's coding assistant. Two vulnerabilities, and neither is about the model. Both are about the environment around it. In the first (CVE-2025-59536, severity 8.7 out of 10) code from a project folder could run before the user had accepted the trust dialog: you cloned a repository, you opened it, and that was enough. In the second, a project could redirect the API address and read along with the key.

Both are fixed. What they show weighs more: the attack ran through configuration files and settings nobody read, rather than through a clever conversation with the model. With an agent, the weak spot is rarely where you look for it.

With an assistant that only talks, being misled is embarrassing. With an assistant that has permissions, it is an action.

For smaller companies this matters more than it sounds. You do not have to be a target to be hit. You only need an assistant that reads your mailbox, and one sender who knows it.

The gate: four checks

You do not have to leave AI alone for this. What you need is a gate between the text that comes in and the permissions the assistant holds. Four checks, and none of them is complicated.

1 · Who sent this?

Limit to known senders where you can. An assistant that only reads mail from clients and colleagues has a far smaller problem than one that reads everything that arrives.

2 · Strip the invisible

An attachment or pasted text can hold characters a person never sees and a model reads perfectly well. Filter them out before the assistant gets the text, and log that you did.

3 · Irreversible? Ask first

Looking things up, summarising and drafting may run on. Sending, paying, deleting and publishing ask a person. That line runs along whatever you cannot undo.

4 · Kill switch within reach

One action that stops the assistant and withdraws its access, and someone who knows the button exists. Test it, otherwise it is an assumption.

The minimum bar

  • Its own identity. The assistant works under its own account with its own access, not under the director's.
  • As few permissions as possible. Only what the task needs, with an expiry date. No keys that are there "just in case".
  • Drafts instead of sends. Outgoing contact with clients passes a person. Always.
  • Traces. Every action is traceable: when, what, with which data. An incident you only notice a week later must still be reconstructable.
  • Recovery. Nothing the assistant does is beyond repair within a day.
  • A rehearsed kill switch. Present, and actually used once.

How we set it up for ourselves

We work with agents all day, so this bar is not theoretical. With us, local and reversible work simply runs on, without anyone approving every step. Four kinds of action always ask for confirmation: anything touching production, anything going outside, anything that deletes, and anything touching keys or settings. That judgement sits in code, not in an agreement, because an agreement is what you forget on a busy Tuesday.

Alongside that: new services sit on a test environment for months before they reach clients, recordings are transcribed on the device itself rather than at a cloud service, and internal environments stay out of every search engine by default. None of those choices is exciting. Together they are the difference between a quiet year and the cases you read about.

What this means for you

If you use AI today to write and summarise, your exposure is small and you can leave this for later. The moment the step is taken towards acting, sending mail, updating files, preparing invoices, the question changes. It becomes a design choice, and you make that at the start.

We walk through that choice with you in half a day: what text comes in, what the assistant can reach, where the way out sits, and which of the four checks is missing. You end up with an overview you can show your insurer or your client. Want to look for yourself first? Our quickscan is the place to start.

More reads

Also published.

Questions after reading this? Mail hello@bravio.nl. You get an answer within a working day.