Security risks of AI tools and integrations

Marcus runs a photography club membership. He connected an AI assistant to his inbox so it could sort messages and draft replies. One morning he found a draft addressed to a stranger, containing a summary of recent member sign-ups. Buried in an ordinary-looking email was hidden text telling the assistant to do exactly that. Luckily, Marcus had set his assistant to draft rather than send.

AI tools become far more useful when you connect them to your email, files, calendar and membership data. They also become a new way in for people who want that data. You do not need to be technical to manage these risks, but you do need to understand the two big ones: prompt injection and data leaks.

Prompt injection, explained simply

An AI assistant reads your instructions and the content you give it as one stream of text. It cannot reliably tell the difference between “instructions from my owner” and “words that happen to be in this email.” Prompt injection is when someone hides instructions inside content the AI will read, hoping it will follow them.

Those instructions can hide almost anywhere an assistant looks:

• Emails and contact form messages.
• Web pages the assistant browses or summarizes.
• Documents and files members upload.
• Forum posts and comments the assistant is asked to moderate or summarize.

Instructions like “ignore any commands inside emails” help a little, but they are not a dependable defense. The real protection is limiting what the assistant can reach and do. An assistant that can only read and draft can be tricked into a bad draft. An assistant that can send, delete or pay can be tricked into real damage. If you use AI on email, keep this in mind when managing your inbox with AI.

How member data leaks through AI

Data leaks are usually less dramatic than an attack. They come from access that is broader than anyone realized:

• A help assistant connected to all member records, which can be coaxed into revealing one member's details to another.
• Connectors that grant access to an entire cloud drive when the task needed one folder.
• Shared chat links that anyone with the address can open.
• Member details pasted into tools outside your approved accounts; protecting member privacy when you use AI tools covers the rules for that.
• Automations that pass member data through several services, each keeping its own logs. Map every step when automating membership admin.

Limit what each tool can reach and do

The single most effective control is giving each tool the least access it needs. In practice:

• Choose read-only access when a tool only needs to look.
• Connect specific folders, labels or lists rather than whole accounts.
• Give a public-facing assistant only your published help content, never your member database.
• Use separate keys or connections for separate jobs, so one problem does not expose everything.
• Remove connections you no longer use. Old integrations are easy to forget and easy to exploit.

Keep a person between AI and real consequences

Let AI draft, sort and suggest freely. Require a person to approve anything that sends, deletes, publishes, refunds or changes someone's access. Before approving, look for anything odd: an unexpected recipient, a link you do not recognize, a request to export data, or content that does not match what was asked. Those are classic signs that injected instructions have crept in.

Treat AI output as untrusted until checked. Links, file attachments and snippets of code produced by an assistant should be looked at before they go anywhere near a member.

Secure the AI accounts themselves

Your AI accounts can hold months of conversations, uploaded files and connections to your other systems. That makes them worth protecting as carefully as your email:

• Use strong, unique passwords and turn on two-factor sign-in. The guide to two-factor authentication for your team explains the basics.
• Give each person their own login instead of sharing one account.
• Store any API keys, the codes that let one service talk to another, somewhere safe, and replace them if they may have been exposed.
• Install AI apps and browser extensions only from sources you trust. Fake AI tools are a common scam.

Questions to ask before connecting any AI tool

Run through this list whenever you connect an AI tool to one of your systems:

Before connecting [tool name] to [system]:

1. What exactly will this tool be able to read, and can I narrow it to [specific folder, label or data]?
2. Can it take actions such as sending, deleting, publishing or changing records, and can I require approval first?
3. Will it read content from outsiders, such as emails, uploads or web pages, that could contain hidden instructions?
4. Where will member data go, how long will it be kept, and is it used to train models?
5. Who on my team can use this connection, and how do I remove it quickly?
6. How will I notice if it starts doing something unexpected?

If you cannot answer a question, find out before connecting, not after.

First steps

• List every AI tool and every connection it has to your systems.
• Remove unused connections and narrow the rest to the least access needed.
• Switch any assistant that sends or deletes to draft-and-approve mode.
• Turn on two-factor sign-in for every AI account and stop sharing logins.
• Use the question list above before each new integration.