AI assistants turn ordinary staff into a larger data leak path, often by accident. Common mistakes are pasting sensitive data, indexing documents without per user permissions, giving assistants broad access, and having no rules or logs. Fix them with data rules, scoped access, approval for risky actions and monitoring.
Why is this an insider issue?
Most cases here are not malice. A person pastes a customer list into a chat to summarize it. An assistant connected to a shared drive answers a question using a document the asker was never meant to see. A coding assistant is handed a token with more rights than the engineer needs.
OWASP's sensitive information disclosure entry makes the base point: data users enter may later appear in model output, and sensitive information can exist both in the model and in the application around it. Its excessive agency entry covers the other half, where an assistant given too much power does damage after a bad instruction, whether from the model, a mistake or an injected prompt.
What are the seven mistakes?
1. No rule on what may be pasted. Staff guess. OWASP lists user education and clear policy on retention, use and deletion as controls. Write the rule on one page.
2. Indexing everything. A shared search index over documents with no per user filtering turns every assistant answer into a permission bypass. Retrieval should respect the asking person's rights.
3. Broad connectors. An assistant connected to mail, files and chat with a single high privilege token can read far more than any one task needs. OWASP advises minimal extensions, minimal functionality and minimal permissions, and acting in the user's own context with narrow scopes.
4. Treating the system prompt as a guard. Telling the assistant "do not share confidential data" is not a control. OWASP notes such instructions can be bypassed and must not be the sole control.
5. No human approval for high impact actions. Sending external email, deleting files and changing records should need a person to confirm what will happen.
6. No logs of assistant actions. Without a record of what the assistant read and did on whose behalf, you cannot investigate. OWASP notes logging and monitoring do not prevent harm but they limit damage.
7. Ignoring the data supply chain. A joint CISA, NSA and FBI publication from 22 May 2025 on AI data security highlights the role of data security in the accuracy, integrity and trustworthiness of AI outcomes across the AI lifecycle. We read the summary page and not the full document, so we do not list its individual practices here.
What controls help?
- Data classification that says which classes can go into which assistants.
- Redaction of confidential patterns before data reaches a model, as OWASP suggests.
- Per user permissions on retrieval and on tool calls.
- Approval gates on irreversible actions.
- Central logs of prompts, tool calls and outputs, with sensible retention.
- A vetted list of approved assistants, so staff are not forced to use unapproved ones.
What to do
- Write a one page rule on what data may enter AI tools, with examples.
- List every assistant in use, including browser and coding tools, and what each can access.
- Review connectors and remove access that no task needs.
- Check retrieval permissions with a test: ask as a junior user for a restricted document.
- Add approval to the five or six riskiest actions.
- Turn on logging and decide who reviews it and how often.
- Run a short training session using real examples from your own company.
- Revisit the list each quarter, since new tools appear quickly.
Where Safeguard fits
Tenant admins on Safeguard can switch off any client type, including MCP clients, ChatGPT and Claude, which helps keep assistant access to your security platform deliberate. Secrets scanning can find tokens that ended up in code or configuration. Neither replaces a data policy for the rest of your company.
Quick check
Is banning AI assistants the answer?
Usually not. People tend to move to unapproved tools. A clear rule, approved tools, scoped access and logging manage the risk better than a ban.
What is the first fix?
Write the one page rule on what data may be entered, then check that retrieval and connectors respect per user permissions.
Sources
- OWASP, LLM02:2025 Sensitive Information Disclosure
- OWASP, LLM06:2025 Excessive Agency
- CISA, NSA and FBI, AI Data Security guidance
Last reviewed: 18 October 2026.
