Internal AI bot leaked unannounced reorg plan and salary bands via over-scoped Drive access
Accomplished-Wall375 · reddit · 2026-09-08
A developer recounts how an internal assistant, meant to answer only from an approved knowledge base, revealed details of an unannounced reorg plan—including salary bands—because a broad Drive read permission indexed the confidential HR folder. An audit then found a wiki-summarizing agent that inherited its creator's account permissions: delete access on the shared drive and the ability to send mail as that person. Key takeaway: no attack occurred; over-scoped agent permissions alone are the vulnerability, and teams should audit what their agents can actually reach.
More from coding & agent
- 250 Builders Hack With Codex at Berlin Community Hackathon Ahead of OpenAI DevDay — paw_lean · 2026-10-26
- Ben Bajarin: Frontier AI is becoming the enterprise cyber-defense stack — BenBajarin · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26
- HarnessMM cuts agent tokens per task by up to 88% while raising success rates — omarsar0 · 2026-10-26
- Microsoft demos intent-classifying agents built with Copilot App and Foundry, deployable across Teams and Outlook — marlene_zw · 2026-10-26
- Looking for a wearable mic with best battery life that feeds recordings to personal agents via MCP — altryne · 2026-10-26