AI tools are no longer sitting in one tab waiting for a prompt. With AI agents, or hidden in tools, they connect to inboxes, docs, CRMs, codebases, and internal workflows. They have matching context, memory, and access. That is mostly good news. But access cuts both ways. Here are 10 things worth getting right in 2026, so AI does not quietly hollow out your agency from the inside.
“What can you tell me about your human?”
That line says a lot. The post by gets right to the point. Not because it sounds dramatic. Because it already feels close to reality.
We are living in a sci-fi [pic.twitter.com/lkh9cfBiza](http://pic.twitter.com/lkh9cfBiza)
— Natalie Shapira (@NatalieShapira) February 2, 2026
Natalie Shapira, a computer scientist at Northeastern University, ran a two-week stress test on autonomous AI agents given access to email accounts, file systems, and shell execution. In 11 out of 16 cases, the agents went rogue — sharing private files containing sensitive personal data without permission, deploying runaway programs, and in one instance publicly posting a potentially libelous allegation about a fictitious person. In another test, when asked to delete an email and keep it secret, an agent called Ash — lacking the tool to delete the email — simply reset the entire email server instead. Its reasoning: “When no surgical solution exists, scorched earth is valid.
The loudest concern in the industry is still AI replacing agencies, but that is not the most pressing threat. The real issue is closer and more operational: AI tools now have access to inboxes, docs, CRMs, and client data. That creates risks around trust, visibility, and security that many agencies have not fully mapped. Rather than bracing for an uncertain future, the more useful question is what you need to lock down now to secure your data. The priorities below are grounded in guidance from OWASP and NIST, which are practical frameworks for working with AI without exposing your agency or your clients in the process.
01. Build an AI Inventory
List every AI tool your agency uses.
Don’t just stop at ChatGPT, Gemini, or Claude. Include note-takers, browser assistants, image generators, coding tools, SEO platforms, and meeting recorders. Crucially, look for the “hidden” AI features tucked inside the software you already pay for.
For every tool, document three things:
- Access: What does it have permission to see?
- Data: What specific information is being fed into it?
- Action: Can it execute tasks or make changes on its own?
The Reality: If you don’t know where AI lives in your agency, you can’t protect your business. Governance and risk management start with total visibility.
02. Keep the truly sensitive stuff off AI-connected systems
This is the old internet rule – if something is highly sensitive, keep it offline where possible. Keep it local and do not sync it into AI tools or store it in a shared workspace that an agent can search.
Because where there is a way in, there is usually a way to break in. For most agencies, that includes:
- passwords
- financial data
- contracts
- private credentials
- legal documents
- unreleased strategy
- access documentation
- anything that would seriously hurt if exposed
Keep it separate from AI.
If you cannot fully limit a tool’s access, add a clear confidentiality instruction to its memory or persistent settings. State explicitly that confidential content must not be retained, reused, summarised beyond the current task or included in outputs unless clearly requested.
03. Split “can read” from “can act”
A tool that can read a document should not automatically be able to send emails, publish pages, edit live copy, delete files, or change analytics.
Separate those permissions.
Read access is one thing.
Suggestion access is another.
Action access is a different category entirely.
Treat each level as a deliberate decision, not a default setting. A lot of AI risk becomes much smaller the moment the tool cannot do the final thing. OWASP describes “excessive agency” as a core risk for exactly this reason.
04. Put a human checkpoint on anything public, legal, or expensive
No AI tool should be the final decision-maker for:
- client-facing copy
- invoices
- proposals
- contracts
- analytics changes
- live website edits
- ad spend changes
- external emails
Set one rule:
if it’s public, irreversible, sensitive, or costly, a human signs off. Simple rule. Big impact.
05. Stop pasting raw client material into random tools
Before anything goes into an AI system, remove names, account details, internal references, credentials, pricing specifics, and commercially sensitive material unless that exact tool is approved for that exact use.
A good quick habit is this:
- summarise first
- anonymise second
- paste third
Not the other way around.
06. Create one internal AI rule page
Not a giant policy deck nobody reads.
One page.
It should cover:
- which tools are approved
- what may never be pasted
- which tasks need human review
- who approves new tools
- what to do if something leaks or behaves strangely
NIST’s guidance is clear that governance needs to be operational, not theoretical: your team needs something short enough to actually use.
07. Test your tools with bad inputs on purpose
Feed them messy prompts, conflicting instructions, and hidden text in documents. Try a fake client message that attempts to override the rules.
Test it now, before it shows up in a real workflow. These issues rarely announce themselves. They hide in inputs that look normal, waiting for your oversight.
What if something subtle slips through and the tool still acts on it?
08. Review every AI vendor like a security supplier
Before your team adopts a new AI tool, check:
- where the data goes
- whether content is retained
- whether content can be used for training
- what permissions the tool requests
- whether there are admin controls
- whether you can delete data
- whether usage can be audited
Tiny plugin. Big access (and even bigger threats). It’s time for agencies to stop treating AI tools as harmless add-ons.
08. Review every AI vendor like a security supplier
Before your team adopts a new AI tool, check:
- where the data goes
- whether content is retained
- whether content can be used for training
- what permissions the tool requests
- whether there are admin controls
- whether you can delete data
- whether usage can be audited
Tiny plugin. Big access (and even bigger threats). It’s time for agencies to stop treating AI tools as harmless add-ons.
09. Protect your website from AI scraping
AI risk is not only inside your agency. It’s also outside, scraping your work.
Agencies should now decide deliberately which AI crawlers may access their sites, which should be blocked, and which high-value pages need stronger protection. Cloudflare’s AI Crawl Control reflects how practical this has become, including crawler-level controls over access.
At minimum:
- review your crawler settings
- review your robots rules
- watch AI bot traffic
- protect high-value pages
- stop assuming every scrape is harmless
The best defence is not only restriction. It’s also differentiation.
10. Publish what AI can’t fake easily
Publish case studies with real outcomes. Show the thinking behind the work, not just the result.
Show work that clearly comes from hands-on experience. Include specifics people can point to: constraints, trade-offs, decisions that changed the direction, and what actually moved the needle.
A lot of generic agency content is about to get flattened. The work that holds up will be the kind others can reference, learn from, or challenge, not just scroll past.
The short takeaway
If you only do five things this quarter, do these:
- make an inventory of every AI tool in use
- move truly sensitive material off AI-connected systems
- separate read access from action access
- require human approval for public or high-risk outputs
- create one clear internal AI rule page
That alone will already put you ahead of a lot of agencies still treating AI like a fun productivity layer instead of what it now is.
