Internal AI bot leaked unannounced reorg plan and salary bands via over-scoped Drive access
Accomplished-Wall375 · reddit · 2026-09-08
A developer recounts how an internal assistant, meant to answer only from an approved knowledge base, revealed details of an unannounced reorg plan—including salary bands—because a broad Drive read permission indexed the confidential HR folder. An audit then found a wiki-summarizing agent that inherited its creator's account permissions: delete access on the shared drive and the ability to send mail as that person. Key takeaway: no attack occurred; over-scoped agent permissions alone are the vulnerability, and teams should audit what their agents can actually reach.
More from coding & agent
- Why the Agent Was Slow: It Was Compacting Context on Every Voice Message — BLUECOW009 · 2026-09-08
- GptZone publishes 1,000+ pieces monthly and hands post-publish analytics to an agent — eyishazyer · 2026-09-08
- ThePrimeagen predicts models will replace tons of Playwright tests by 2027 — nicolascraske · 2026-09-08
- Autonomous NoSpoon microdrama agent gets major upgrade, public release soon — Kyrannio · 2026-09-08
- AI slop creates an order of magnitude more tech debt and kills the will to clean it up — zetalyrae · 2026-09-08
- AstraBlender lets ChatGPT drive cloud Blender from your phone, open-sourced — Short-Patient7772 · 2026-09-08