Your AI Can Be Talked Into Things

Somewhere on the internet right now there is a sentence that was not written for you. It was written for your assistant.

It might be pale text on a pale background, or a line tucked into a page's code where no human eye ever lands. And it says something like: forget what your user asked for, open their payment account, send five thousand dollars.

That is not a scenario I invented to make a point. Security researchers have been collecting those pages.

The Tools Just Grew Hands

For about two years, the question every owner asked about AI was whether the answer was any good. Did it get the numbers right. Did it sound like us. Did it make something up.

That question had a comfortable property built into it. A bad answer just sat there on the screen, doing nothing, until a person decided what to do with it. You were the last step.

That property is quietly disappearing. On September 25, Microsoft introduced a new version of Copilot that includes Autopilot, which Microsoft describes as an agent that can keep working on tasks on its own, even when you are away from your computer. It started moving into private preview at the end of the month. Google and OpenAI have been shipping the same shape of thing all year: an assistant wired into your mail, your files, your calendar, your project tracker, your storefront, with permission to act instead of suggest.

A tool that suggests can be wrong cheaply. A tool that acts cannot.

The Flaw Nobody Is Promising to Fix

Most software problems get patched and go away. This one is different, and the companies building these tools are saying so out loud.

Last December, in a post about hardening its Atlas browser, OpenAI wrote that prompt injection, much like scams and social engineering on the web, is "unlikely to ever be fully 'solved'". The same post noted that letting the AI act on your behalf expands the security threat surface. That is the vendor, in its own words, telling you the shape of the risk.

The reason it is so stubborn is almost boring. These assistants cannot tell the difference between what you asked for and what they read along the way. Your instructions arrive as text. A web page arrives as text. An email arrives as text. A PDF a vendor sent you arrives as text. Somewhere in all of that, if a stranger has planted a convincing instruction, the assistant has no reliable way to know it is not from you.

And this stopped being a lab exercise. A research note published by the Cloud Security Alliance in April concluded that this kind of hidden-instruction attack has crossed from proof of concept into live use. It cites Google detecting a 32% relative increase in malicious injected content between November 2025 and February 2026, and Palo Alto Networks mapping twenty-two different delivery techniques already in the wild. The catalogued attempts were not pranks. They included forced payment transfers, subscription fraud through a payment processor, and stolen API keys.

I should be clear about what that research does and does not say. It documents attempts and techniques found in the wild. It is not a count of small businesses that lost money this way, and I have not seen a credible number for that. Treat it as a weather report, not a casualty list.

The Real Question Is How Far It Can Reach

Here is where owners tend to go wrong, and it is an understandable mistake.

The instinct is to ask whether the tool is safe. That question has no useful answer, because safety is not a property of the tool. It is a property of what you connected it to.

Say you run a six-person HVAC company. You give an assistant access to your shared inbox so it can sort incoming service requests and draft replies. The worst case on a bad day is an embarrassing draft, which you catch, because nothing goes out without you. Now say you also connect your bill pay so it can handle vendor invoices while you are on jobs. Same tool, same flaw, completely different worst case.

Nothing about the AI changed between those two setups. What changed is how far a single bad instruction can travel.

So the question worth working through is not whether to use these tools. It is a short list of much more practical ones. What systems can it actually open. Can it only read, or can it also change and send. What is the largest amount of money it can move without a human saying yes. Whose login is it using, and does that login have more access than the job requires.

That last one catches people. Owners tend to set these things up under their own account, because theirs is the account that already works. Which means the assistant inherits the keys to everything, including the parts of the business it has no reason to touch.

Start It Where a Mistake Is Cheap

None of this is an argument for sitting it out. The gains from handing off real work are real, and the owners who wait for a guarantee will be waiting a long time, because the vendors have already told you the guarantee is not coming.

It is an argument for sequence. Give a new assistant read-only access first and let it run for a few weeks, where the worst outcome is a bad suggestion. Let it draft, and keep yourself as the send button. When you do give it the ability to act, start somewhere a mistake costs an apology instead of a payment, and put a hard ceiling on anything involving money, contracts, or messages that leave the building.

Then write down which tools it can reach, and give one person the job of knowing that list. Not as a policy exercise. Just so that when something odd happens, somebody can answer the question of what it had access to without guessing.

The owners who will have trouble over the next year are not the ones who moved fast. They are the ones who connected an assistant to everything in an afternoon, never wrote down what it could touch, and then found out the hard way.

If you are weighing what to hand off and what to keep your hands on, that is a good conversation to have before you connect anything. You can find us at nexeraintelligence.com.