Employees Are Building AI Agents on Their Own, and 93% of Unneeded Connections Have Full Access

Imagine this: a chief financial officer spends an evening building an agent that pulls from reporting and answers questions. It's convenient, so he shares it with colleagues. Nobody hacked anybody, but now anyone who writes to this agent in chat is effectively working with CFO permissions. That is exactly the case Business Insider described, and it is arguably the biggest corporate AI risk right now.

The Problem Isn't Hackers, It's Enthusiasts

AI assistants such as Copilot, ChatGPT, Claude and Gemini are already installed in almost every large company. But in parallel, marketers, accountants and lawyers are building their own agents through vibe coding or low-code builders. For them the result is obvious: attach a spreadsheet, connect a couple of tools, share it with the department. Nobody worries about access rights, and a non-technical employee often simply has no means of understanding them: they are not a DevOps engineer.

The scale, according to the startup Opsin, is striking. 93% of connections that an agent does not need for its task had full access to the entire system. A classic example: an agent helps process vacation requests but has access to the payroll database. And only one connection in 200 required human confirmation before acting. The figures come from the vendor itself, so they should be treated as a guideline rather than an independent audit. But the direction is clear.

The reason is simple: by default, an agent inherits the permissions of its creator. The higher the author's position, the more dangerous the homemade tool. And sharing turns a personal assistant into a shared back door.

How Opsin Is Tackling It

The company's founders came from Abnormal Security, where anti-phishing is built not on signatures but on behavior: an email is suspicious if it doesn't resemble the sender's usual manner. They carried the same approach over to agents. Opsin connects to corporate Copilot, ChatGPT, Claude and Gemini, finds all the homemade agents and creates a dossier on each: who created it, why, which tools are connected, what data the agent can see, and who it is shared with.

The system then monitors behavior. If a "vacation assistant" suddenly reaches into financial reporting, it is sent to quarantine and the owner receives a notification. The company's CEO reasons that you can't look inside an agent's head, so you have to judge it by its actions. Last week Opsin announced a $21M round.

What to Do in Practice

For developers and security teams, the takeaway is unpleasant but useful. First, take inventory: how many agents already exist in the company and who created them. Almost certainly more than you think. Second, forbid agents from running under their author's personal permissions: you need separate service accounts with a minimal set of access rights for the specific task. Third, for actions involving writing, deleting and sending data outside, require human confirmation, even if it slows down the magic of automation.

Product teams building no-code platforms and corporate agent builders should think about defaults. If an agent gets all of the user's permissions by default, that is your bug, not the marketer's fault. Show what the agent is connected to and warn users when they share it.

The approach has limitations too. Behavioral monitoring catches anomalies after the fact and requires a learning period, and an agent that has excessive permissions from the start and does things familiar to it can go unnoticed. So monitoring complements the principle of least privilege but does not replace it.

Bottom line: the main threat from AI in the office so far looks not like a machine uprising but like a diligent employee with a shared link. Agents really do need their own "HR department," and a market for it is already taking shape.