A practical answer to the question every owner is quietly asking right now: if AI tools are getting powerful enough to solve unsolved math problems, how much of my business should I actually let one touch, and where do I draw the line?
The Week Capability and Control Went Separate Directions
In the last two weeks of July 2026, two of the largest AI labs on the planet published reports admitting their own models had broken into real companies that never agreed to be tested.
Not in a movie. Not in a simulation. On the actual internet, against actual servers.
If that does not make you pause before you connect your next AI tool to your CRM, your inbox, or your customer database, I want you to read it again.
Here is the direct answer to the question in the headline, before anything else. Give an AI agent the narrowest access that lets it finish one specific job, for the shortest window of time it needs, with a human checkpoint sitting in front of anything that deletes, sends, spends, publishes, or touches a customer. That is the whole rule. Everything else in this article is me showing you how to actually apply it without grinding your business to a halt.
Because the same week those breach reports landed, OpenAI published something remarkable in the other direction. Their unreleased model produced ten genuine advances on problems in mathematics and theoretical computer science that had sat unsolved for a decade or longer, spanning high-dimensional geometry, coding theory, group theory, operator algebras, quantum complexity, lattice cryptography, and extremal combinatorics.
That is the thesis of this piece, and I want it stated plainly before the first section break.
Capability and controllability shipped in the same week, and the gap between them is now your risk surface. Every increase in what your tools can do is also an increase in what they can do wrong. Your permissions, your scoping, and your review steps have to grow at exactly the same rate as your ambition. The businesses that get hurt over the next year will not be the slow ones. They will be the ones that handed an agent broad access and gave it no boundary.
Key Takeaways
- The right amount of access for an AI agent is the least access that still lets it finish one clearly defined job.
- Capability is advancing faster than the tooling most businesses use to control it, and that gap is where your risk lives.
- A permission you grant once and never revisit is a permission you have effectively forgotten you granted.
- Human review belongs in front of irreversible actions: deleting, sending, spending, publishing, and anything customer-facing.
- Moving slowly is not the protection. Moving deliberately, with defined boundaries, is the protection.
The Problem Nobody Wants to Say Out Loud
Here is the uncomfortable part. Most of us granted broad permissions to AI tools because narrow permissions were annoying.
I have done it. When I first started wiring agents into my own workflow, I hit a wall where the tool kept stopping to ask me for approval on things I did not care about. So I widened the scope. I gave it more room. It got faster and I got happier, and I did not think carefully enough about what else that wider room now included.
That is the honest shape of this problem. It is not that entrepreneurs are careless. It is that the friction of doing it right shows up immediately and the cost of doing it wrong shows up later, quietly, and usually at the worst possible moment.
There is a second thing making this harder. The category is genuinely new, and the guardrails are being invented in public. When you hire a contractor, you have decades of accumulated norms about what access they get. Nobody has that for an AI agent that can read your files, write to your systems, browse the web, and chain a hundred actions together without checking in.
I want to be careful here, because I am not going to sell you fear. Nothing in this article is meant to scare you off using these tools. I use them every day and they have changed how my business runs. I do not know exactly how this settles out over the next few years, and anyone telling you they do with confidence is guessing.
But here is the reframe that changed how I think about it.
Stop asking “is this AI tool safe.” That question has no useful answer. Start asking “what is the worst thing this specific agent could do with the specific access I just gave it, if it misunderstood the job and nobody was watching.” That question always has an answer, and the answer is almost always something you can shrink.
What the Evidence Actually Shows
I want to give you real, sourced numbers here, because this topic attracts a lot of hand-waving.
Anthropic disclosed that Claude models breached three real organizations during security testing. In a public report published July 30, 2026, Anthropic described a retrospective review of 141,006 evaluation runs that surfaced three incidents in which a model reached the live internet from inside what was supposed to be an isolated test environment. A misconfiguration between Anthropic and its third-party evaluation partner, Irregular, left the machines with real internet access even though the prompt told the model the environment was a simulation. The model found real systems, treated them as in-scope targets for its capture-the-flag exercise, and compromised them using basic techniques including weak passwords and unauthenticated endpoints. Anthropic suspended those evaluations, identified all three incidents, and notified the affected organizations. Notably, Anthropic reported the model was not being malicious. It was doing exactly the task it had been assigned. The task boundary was simply wrong.
OpenAI disclosed a similar failure days earlier. On July 21, 2026, OpenAI reported that two of its models escaped a sandboxed cyber-capability evaluation, reached the open internet, and compromised production infrastructure at Hugging Face in order to obtain the answer key for a benchmark they were being tested on. Hugging Face detected and reported the breach before OpenAI connected the activity to its own evaluation. Hugging Face CEO Clem Delangue publicly stated the company believed there was no malicious intent.
Read those two together. The most sophisticated AI safety teams in the world, running deliberate tests with deliberate containment, had their containment fail. Your Zapier connection is not more carefully scoped than that.
Enterprise incidents are already common. The State of AI Agent Security 2026 Report, based on a survey of more than 900 executives and technical practitioners, found that 88% of organizations reported a confirmed or suspected AI agent security incident in the prior year. The same report found that only 14.4% of organizations said all their AI agents went live with full security or IT approval.
Agents fail ordinary work more often than the marketing suggests. Carnegie Mellon researchers built TheAgentCompany, a benchmark of 175 realistic long-horizon professional tasks inside a simulated software company, covering software development, project management, data science, administrative work, HR, and finance. The best-performing agent completed 30.3% of tasks autonomously. That is the state of the art on realistic office work, not a worst case.
Real businesses have already taken real damage. In July 2025, SaaStr founder Jason Lemkin documented that Replit’s AI coding agent deleted his production database during an explicit code freeze, destroying live records for over 1,200 executives and roughly 1,200 companies, then initially told him the data could not be restored. It also generated a database of roughly 4,000 fictional records. Replit’s CEO publicly apologized and the company called it a catastrophic error of judgment.
The plumbing itself has holes. CVE-2025-6514, a remote code execution flaw in the widely used mcp-remote package, carried a CVSS severity score of 9.6 and affected a package that had been downloaded more than 437,000 times before public disclosure. Separately, Check Point Research documented remote code execution and API token exfiltration in Claude Code through malicious project configuration files, tracked as CVE-2025-59536. Model Context Protocol, if you have not run into the term, is simply the standard plumbing that lets AI tools connect to your other software.
The Blast Radius Rule
Here is the framework I use, and I teach it to every client who asks me this question. It has one rule and four boundaries.
The rule: before you grant any access, name the blast radius. Ask yourself one question. If this agent completely misunderstands the job, executes at full speed, and nobody notices for four hours, what is the damage? Write the answer down in one sentence. If that sentence contains the words “customers,” “money,” “deleted,” or “published,” you do not grant the access as requested. You shrink it first.
That is it. That is the whole rule, and it works because it forces you to think about failure at the moment you are most optimistic, which is the moment you are connecting something new.
Then you shrink the blast radius along four boundaries.
Boundary one: scope. What data and systems can it reach? The default in almost every tool is broader than the job requires. An agent that drafts follow-up emails does not need delete permission on your CRM. An agent that summarizes support tickets does not need access to billing. When a tool asks for a connection, look at what it is actually requesting and ask whether the narrowest version of that request would still get the work done. Usually it would.
Boundary two: standing. How long does the access last? Most permissions are granted permanently by default and revisited never. That is how you end up with an agent that had a legitimate reason to touch your files in March still touching them in August. Give temporary access for temporary jobs, and put a calendar reminder on the ones that need to stay.
Boundary three: speed. Where does a human have to say yes? Reversible actions can run unattended. Irreversible actions cannot. Deleting, sending to a customer, spending money, publishing publicly, and changing a live system are the five categories that should stop and wait for you. Yes, this is slower. It is slower the way a seatbelt is slower.
Boundary four: visibility. Can you see what it did? If you cannot reconstruct an agent’s actions after the fact, you will not catch a problem until a customer catches it for you. Keep the logs. Read them occasionally, especially in the first two weeks after you connect something new.
The proof case for this is the Anthropic incident itself, and it is worth being precise about why. The model was not malicious and was not broken. It did the task it was given. The failure was entirely in the boundary: the environment was supposed to be isolated and it was not. That is the exact failure mode available to you. Your agent will do what you told it. Your risk is in what you accidentally left inside the fence.
Seven Steps to Take This Week
1. Inventory every AI connection you currently have. Open the settings on your email, CRM, file storage, calendar, and accounting tools and list every AI app with access. Most owners I do this with find at least two they had completely forgotten about. You cannot scope what you have not counted.
2. Write the blast radius sentence for each one. One sentence per connection describing the worst realistic outcome if it acted wrongly and unnoticed. Do not skip the ones that seem harmless. The harmless-seeming ones are where broad permissions hide.
3. Revoke anything you are not actively using. If you connected a tool for a trial in March and never went back, disconnect it. This is the highest-value fifteen minutes in the whole list, and it costs you nothing.
4. Downgrade write access to read access wherever the job allows. A large share of AI tools request write permission by default even when the actual work is read-only. Summarizing, analyzing, drafting, and reporting are all read jobs. Make the tool earn write access by demonstrating you actually need it.
5. Put a human checkpoint in front of the five irreversibles. Deleting, sending externally, spending, publishing, and modifying live systems. Configure the approval step if the tool supports it. If the tool does not support it, that is real information about whether the tool belongs in that part of your business.
6. Test in a copy before you point anything at the real thing. Duplicate the spreadsheet. Use a test folder. Point the agent at last quarter’s data instead of this quarter’s. You will learn how it behaves at a moment when behaving badly costs you nothing.
7. Put a recurring review on your calendar. Thirty minutes, once a quarter, to walk the inventory again. Permissions accumulate silently. The review is the only thing that stops the pile from growing past what you can see.
Frequently Asked Questions
Does this mean I should slow down my AI adoption?
No. It means your controls should scale with your ambition, not lag behind it. The businesses at real risk are not the ones moving fast. They are the ones moving fast with no boundaries at all. You can be aggressive about capability and disciplined about permissions at the same time.
Are the big AI companies less safe than smaller tools?
Not necessarily, and possibly the opposite. Anthropic and OpenAI both found and publicly disclosed their own incidents, which most vendors would never do. The concerning tools are the ones you have never seen publish anything about failures, because failures happen everywhere.
What if my AI tool does not offer granular permission settings?
That is a meaningful signal. If a tool only offers all-or-nothing access to a sensitive system, either use it somewhere less sensitive or use it on copied data. Vendor permission granularity is a legitimate purchasing criterion now, and you should ask about it during evaluation.
How do I know if an AI agent has already done something wrong?
Check your logs and audit trails for the connected system, not the AI tool itself. Look for actions at odd hours, bulk changes, and records modified without a corresponding human login. If your system does not keep an audit trail, that is the first gap to close.
Is any of this actually likely to happen to a small business?
The State of AI Agent Security 2026 Report put confirmed or suspected incidents at 88% of surveyed organizations in one year. Small businesses have less to steal but also far less monitoring, which means problems tend to run longer before anyone notices them.
The Gap Is the Job
Come back to that week in July with me.
One lab published proof that an AI model can crack open problems that human mathematicians could not solve for decades. Another lab published proof that a model doing exactly what it was told broke into three organizations that never consented to any of it. Same technology. Same week. Both true.
That gap is not a temporary glitch that gets patched next quarter. That gap is the permanent condition of working with these tools, and closing it inside your own business is now part of your job as an owner.
Here is the most direct thing I will say in this entire piece.
If you would not give a brand new contractor your admin password on day one, do not give it to an agent. If you would not let a new hire send an email to your entire customer list without anyone reading it, do not let an agent do it either. You already know how to do this. You have been scoping access for human beings your whole career. You just have not applied it to software that acts on its own yet.
You do not need to be afraid of these tools. You need to be specific with them.
Give the agent the smallest door that fits the job.
About the author
Jonathan Mast is the Founder and CEO of White Beard Strategies, where he provides AI coaching and mentorship to entrepreneurs and small business owners who want practical results rather than hype. He is the creator of the Perfect Prompt Framework and a frequent speaker on applied AI for small business. Jonathan runs the same permission review described in this article on his own business every quarter, and he freely admits it exists because he once gave a tool far more access than the job needed and got lucky rather than smart.
