x
You connected a calendar app to your AI assistant to save ten minutes a week. Somewhere in the click-through you accepted "read and write access to all files" because that's the only option on the screen. You have no memory of deciding that, because you didn't — you decided to save ten minutes, and the access came bundled with it.
That's not a hypothetical. Gravitee's State of AI Agent Security 2026 report — surveying enterprise security and engineering teams, published February 2026 — found that 88% of organisations confirmed or suspected an AI agent security incident within the year, while 82% of executives said they were confident their existing policies prevented unauthorised agent actions. Separately, Cloud Security Alliance and Token Security research published in April 2026 put it at 65% of organisations experiencing at least one incident caused by an AI agent operating on their network, with data exposure the single largest category.
Read those two numbers together and the finding isn't "AI agents are dangerous." It's that confidence and access are moving in opposite directions, and almost nobody is watching the gap.
Fair challenge, and worth being precise about it rather than borrowing a scary number for a business it wasn't measured on.
Those reports surveyed large organisations with security teams, audit logs and a CISO whose job is to worry about exactly this. You have none of that — which is the argument for taking it more seriously, not less. A big company that grants an agent too much access has a security team that might catch it. A one-person business that does the same thing has nobody else looking. The enterprise numbers describe an environment with more safeguards than yours, and it's still producing incidents at this rate.
The honest version: we don't have a solo-founder-specific incident statistic, because nobody is measuring it. What we do have is a structural fact that doesn't need a survey to be true — every AI tool you've connected this year asked for a permission scope, and most people click "allow" the way they click "accept cookies."
Two things, both from earlier this summer, and both already covered here in different terms.
Agents got file access. In July 2026, most major AI assistants shipped the ability to read, and in some cases write to, a connected drive, inbox or calendar — covered here in the moment it happened. That wasn't a security story at the time. It was a productivity story: agents that could see your files could finally do useful multi-step work instead of guessing from a pasted paragraph.
The access didn't come with a review date. That's the part nobody wrote about, because it's not a launch — it's an absence. A permission you grant once keeps running until you go back and check it, and almost no consumer tool prompts you to.
So the agent you're worried about isn't a rogue one. It's the ordinary one, still running, still holding a scope you granted for a task that finished months ago.
Five steps, done once now and then on a fixed schedule — this week's dailies take each one apart, so treat this as the map, not the whole route. Today's second post decodes the incident numbers above in more detail before the how-to starts.
1. Find every connection. Every major platform — Google, Microsoft, Anthropic, OpenAI, Meta — has a page listing third-party apps and their granted scopes, usually under Security or Privacy settings. Most founders have never opened it. Tuesday's post is that page, step by step, on the accounts you actually use.
2. Write down what each one is for, in one sentence. Not what it can do — what you actually use it to do. If you can't finish the sentence, that's the first candidate for revoking. Wednesday's post is that sentence, written properly, once.
3. Separate "do the task" from "hold the key." A tool that drafts your invoices needs to see your invoices. It does not need standing admin access to your whole accounting system. Thursday's post is the judgement call underneath that distinction.
4. Put a revoke date on the calendar. Quarterly is enough for most solo setups. Friday's post and Saturday's give you the habit and the two-minute kill switch for when a connection stops earning its access.
The week closes on Sunday with the argument underneath all four steps: trust isn't a setting you configure once, it's a habit you keep or lose.
It would be, if the answer were "connect nothing." That's not the argument here, and it wouldn't survive contact with how you actually work — the agents that read your files are the same ones saving you the hours this newsletter exists to help you buy back.
The argument is narrower: access should match the job, and it should have an end date you set, not one the vendor sets. That's not caution for its own sake — it's the same vet-disclose-verify standard this brand applies to every tool it recommends, pointed inward at the tools you've already installed rather than outward at the next one to try.
What happens if this turns out to be overcautious? You lose twenty minutes a quarter and gain an accurate list of what's actually connected to your business — which is worth having regardless of whether an incident was ever coming. That's the same test the last two flagships used: if the advice pays off even when the worst case doesn't happen, it's worth doing anyway.
Start with looking, same as always. Open the settings page today — not this week, today — and see what's actually there. You will find at least one connection you'd forgotten existed.
For the guide that finds every place AI already touches your business — free, 5-min read: The 10-Hour Audit.
Related Decodes
AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.
Not financial or legal advice. The incident and confidence figures cited are enterprise-scoped survey data, not a solo-business measurement; they illustrate a direction of travel, not a probability for your specific setup.
TL;DR: Gravitee's State of AI Agent Security 2026 report found 88% of organisations had a confirmed or suspected AI agent security incident this year, while 82% of executives were confident their policies prevented unauthorised agent action — confidence and access are moving apart, and almost nobody is watching the gap. That data is enterprise-scoped, but the underlying fact isn't: every AI tool you connected this year came with a permission scope, most were accepted without reading, and almost none had a review date attached. The fix is a 20-minute audit, done once and then on a fixed schedule: find every connection your accounts have granted, write down in one sentence what each is actually for, separate tools that need to do a task from ones that were handed standing admin access, and put a revoke date on the calendar — quarterly is enough for most one-person setups. None of this means connecting nothing; it means access should match the job and have an end date you set, not the vendor.
