One login now opens the whole house

This part of my security class is boring. That's exactly why it's dangerous.

The flashy threats (deepfakes, voice clones) get all the attention. Meanwhile the risk that actually grows every month sits inside a feature you probably already use: connectors.

The upside is real

Modern AI tools let you plug in your other software. Connect your email, your accounting, your CRM, and suddenly the AI can answer questions like "which invoices are overdue and who should I nudge first?" Better inputs, better outputs. I set these up for clients, and I use them myself. This is not a post telling you to avoid them.

The edge you need to see

Draw it as a map. At the top: one login. Under it: the AI tool. Under that: every app you've connected. Under each app: the data inside it. Inbox, contacts, invoices, payroll, customer list.

Before connectors, those were separate doors with separate keys. Now one login opens the whole house. Anyone who gets into that single AI account inherits everything you've plugged into it.

This isn't a fringe worry. Prompt injection, where attackers manipulate an AI into misusing exactly this kind of access, sits at number one on the OWASP Top 10 for AI applications. The security community's main worry about AI is precisely the doors you've connected to it.

Two boring habits

1. Two-factor authentication on the AI account. If one login opens the whole house, that login is the whole ballgame. A password alone is a doorknob lock. Turn on 2FA today; it takes five minutes.

2. Not every key on day one. In your business, a new hire can view records but probably can't delete them. The owner holds more keys than the bookkeeper. Treat the AI like a new hire. Connect what it needs for the job you're giving it, at the lowest permission that works. Viewing is safer than adding, adding is safer than editing, and almost nothing needs delete. The security folks call giving an AI too much power "excessive agency," and it has its own entry on that same OWASP list.

That's it. Not scary, not technical. Lock the front door properly, and don't hand the intern the master key on their first Monday.

Next Thursday: where your data physically goes when you use AI, and the one honest tradeoff underneath every privacy question.

-Thayne