Seven AI agent safeguards for small business owners, drawn from one government breach.
There is a difference between telling someone not to go somewhere and making it impossible for them to get there.
Most of us run our businesses on the first one. We write the policy. We say the words. We assume that settles it.
In June, an AI agent showed a government what that assumption is worth.
The agent had homework
On June 18, OpenAI researchers were testing an internal model by having it research public medicine spending in Australia. A pretty boring assignment.
According to Prime Minister Anthony Albanese, the agent hit repeated barriers. It kept trying. Eventually it found another way into parts of Australia’s Medicare Statistics Reporting Service portal and reached public and non-public information. Services Australia also reported that the agent wrote files to an internal server.
The government says it has no evidence so far that personal Medicare information was accessed. A forensic investigation is continuing, and it will also examine how Australian security agencies missed the breach and whether criminal charges could be brought.
OpenAI said its models took actions it did not intend during an evaluation exercise. That sentence is the whole problem in one line.
Then there is the question of when Australia found out. OpenAI became aware on August 11 during a review of model activity during training.
On September 1, Sam Altman met Australia’s Defence Minister in San Francisco and the breach was not raised. On September 10, OpenAI sent an email to a public disclosures address, the one academics use to report weaknesses. That is how a government learned its portal had been entered.
Transluce, an independent research group, has found other cases of agents trying website exploit techniques when ordinary research tasks hit obstacles. In one case, an agent looking for statistics from the Australian Institute of Health and Welfare got past the site’s anti bot controls, though no non-public data was exposed there.
AI agent safeguards: a rule is not a lock
When I use ChatGPT, I type a request and read what comes back. Agents get more freedom. They search, use tools, open applications and keep going when the first approach fails.
That persistence is exactly why people love them. It is also why I want to know which doors I have left open.
I do not run an AI lab. I run a small business and I like to experiment. So here are the AI agent safeguards I would put in place before letting one roam.
- Give it the keys it needs and none of the others. An agent researching conferences has no business in my bank account. Every extra permission is another door.
- Let it look before it touches. Research, summarize, recommend. Once I see how it behaves, I decide what it gets to do.
- Keep a human checkpoint for anything consequential. Sending, deleting, publishing, buying, sharing outside the company. Those require my yes.
- Write the closed door rule. This is the one I take most seriously from Australia. My version: If a website, app or system denies access, stop. Do not work around it. Tell me what happened and ask what I want next. Where the technology allows, back that up with a technical restriction too.
- Know every connection. Look at each linked account and integration and ask whether the agent truly needs it.
- Keep the logs. I want to know where it went, which tools it used and what it tried.
- Find the off switch before you need it. Know how to disconnect it, revoke its permissions and remove its access.
I write about this kind of thing in my book, Tech-No to Tech-Pro.
Where to start with AI agent safeguards
Start with the tool you already use. Open its settings and read the list of connected accounts. Remove any the work does not require.
Next, write your AI agent safeguards on one page. Share it with everyone on your team who uses these tools.
Review that page every quarter. New features arrive often, and each one can open a door.
Each of the seven AI agent safeguards above takes minutes to set. Good AI agent safeguards are short, written, and shared.
For how leaders are approaching AI inside their organizations, read AI Amplifies Whatever Your Organization Already Is.
The ask inside AI agent safeguards
When I ask a person for something, that person gets to say yes, no or maybe. Our agents need the same understanding built in.
A blocked website is an answer. A denied permission is an answer. A request for credentials is an answer. Sometimes the right response to an answer is to stop and come back to ask.
Your Turn
If your AI agent found its own locked door tomorrow, what would actually keep it closed?
This first appeared in my LinkedIn newsletter, Lead with the Ask. Subscribe at https://www.linkedin.com/newsletters/lead-with-the-ask-7012507581785014272/
About the Author
Leila Kubesch is a professional speaker and photographer who aims to give her clients both voice and visibility, whether she is on the stage or behind the lens. Through her speaking and photography, she helps people tell their stories, make meaningful connections and be seen.
