Small businesses are already a target. In the UK government's 2025 survey, 43% of businesses identified a cyber breach or attack in the previous 12 months [1]. Verizon's 2025 breach report found ransomware in 88% of breaches at small and medium-sized businesses [2].
Now add an AI agent that reads your inbox and the web, and can take actions. It is a helpful new employee who will follow instructions, including instructions hidden in a message from a stranger.
The new risk: instructions hidden in ordinary content
OWASP, the open security community, puts prompt injection first in its Top 10 for AI applications [3]. The indirect form is the one that matters for a business agent: the AI accepts input from outside sources, such as websites or files, and that input changes what it does [4].
The UK National Cyber Security Centre is blunt: prompt injection attacks may never be totally mitigated the way older attacks can be. Its advice is to limit what the AI can reach, for example not letting an AI that reads email from strangers use privileged tools [5].
Too much access is the real problem
OWASP calls it "Excessive Agency" and names three causes: excessive functionality, excessive permissions and excessive autonomy. Its fix includes a person approving high-impact actions before they happen [6].
That matches what we measured in our own sandbox tests. In one test the agent was fed a poisoned web page and did not follow it. In another, a model used a script of its own to get a fake card number into a file, a path our checks did not cover at the time. Models resist some tricks and fall for others. You cannot rely on the model alone.
A rollout plan in nine steps
- 1List everything the agent could touch: inboxes, files, accounts, tools. Remove what the job does not need.
- 2Give it its own login with the smallest permissions, never yours, and never an admin account.
- 3Sort its actions into four rings: can read, can draft, needs a person to approve, never allowed.
- 4Keep passwords, keys and payment details out of its reach entirely, not just "told not to look".
- 5Limit where it can connect on the internet to the services the job needs.
- 6Set a spending cap per day and per job, with a switch that stops it at once.
- 7Keep a log of every action it tried, allowed or held, with the source of what it read.
- 8Test it before customers do: feed it fake data and tricky messages, and see what it attempts.
- 9Review the log weekly, and widen its permissions only when the record earns it.
You do not need a security team to start
The U.S. NIST AI Risk Management Framework is voluntary and free [7], and the joint guidance from NSA, CISA, the FBI and partners covers deploying AI systems built by someone else [8]. Both are written for larger organisations, but the core ideas fit on one page: know what it can touch, keep a person on the risky steps, and keep a record.
See how these steps worked on a real open-source agent: we put one behind a gate and measured it.
