Your AI Assistant Might Be Your Biggest Security Risk
Your AI assistant can be your biggest security risk because it combines three things attackers love: access to your data, the ability to act on it, and a habit of following instructions it reads, including instructions planted by someone else. The fix is not to ban AI but to treat every assistant, plug-in and agent like a new employee with limited access, supervision and a logbook.
This post explains the four risks we see Singapore businesses underestimate (prompt injection, data leakage, over-permissioned connectors and shadow AI), what the OWASP Top 10 for LLM Applications and the Cyber Security Agency of Singapore (CSA) recommend, and where tools such as a Fortinet FortiGate-60F firewall, Microsoft Purview and a local ASUS Ascent GX10 fit.
What are the main AI assistant security risks?
| Risk | What it looks like in an office | OWASP 2025 entry | First control |
|---|---|---|---|
| Prompt injection | An email, web page or file contains hidden instructions the assistant obeys | LLM01 Prompt Injection | Least privilege and human approval for actions |
| Data leakage | Staff paste customer records or contracts into a consumer AI tool | LLM02 Sensitive Information Disclosure | Business AI plans, data loss prevention, clear policy |
| Over-permissioned connectors | An assistant can read every mailbox and send email or move files | LLM06 Excessive Agency | Narrow tools, read-only by default, approval to send |
| Shadow AI | Unapproved AI sites, browser extensions or agents nobody in IT knows about | No single entry; closest is LLM02 | Discovery, an approved-tools list, firewall web filtering |
Why is prompt injection so hard to stop?
OWASP ranks prompt injection first in its 2025 list. It distinguishes direct injection, where a user's own input changes the model's behaviour, from indirect injection, which "occur[s] when an LLM accepts input from external sources, such as websites or files". The second kind matters most at work: an assistant summarising your inbox reads every email, including one written by a stranger.
OWASP is candid that no foolproof prevention is currently known, so the defences aim to limit damage. Its advice includes restricting "the model's access privileges to the minimum necessary", clearly labelling untrusted content, and implementing "human-in-the-loop controls for privileged operations". In plain terms: an assistant that reads untrusted content should not also be able to send money, delete files or email customers without a person clicking approve. We will not go into how attacks are built; the point for managers is that any AI reading outside content must be assumed to be influenced by it.
How does company data leak through AI tools?
Mostly through good intentions. Someone wants a faster summary of a tender or a cleaner customer email, and pastes the whole thing into whichever chatbot is open. Whether that data is kept or used for training depends on the plan. OpenAI states for its business products: "By default, we do not use your business data for training our models," and ChatGPT Enterprise admins control how long data is retained. Consumer accounts work differently, which is why our sibling post Your Company Data Is Feeding AI. Do You Even Know Where It Goes? compares plans in detail.
Technology can back up policy. Microsoft documents that Windows devices onboarded to Microsoft Purview can use Endpoint data loss prevention policies that "warn or block users from sharing sensitive information with third-party generative AI sites", for example stopping credit card numbers being pasted into ChatGPT. The Microsoft Purview Suite Annual Subscription is S$185.00 per year as listed on 23 Oct 2026; confirm which Purview features your licences include before you plan around them.
Why are AI connectors and agents a bigger risk than chatbots?
A chatbot that only answers questions can leak what you give it. An assistant connected to email, file shares, CRM and calendars can act. OWASP calls this Excessive Agency (LLM06) and lists its root causes as excessive functionality, excessive permissions and excessive autonomy. Its mitigations read like a good IT access policy: give only the tools needed, prefer narrow tools to general ones, act with the user's own permissions, enforce authorisation outside the AI, and require a person to approve high-impact actions. The same logic applies to spending money, which we explore in Would You Trust an AI Agent With Your Company's Credit Card?
An AI assistant should get the access of a new hire on day one, not the keys of the IT manager.
What is shadow AI and how do you find it?
Shadow AI is any AI tool, extension or agent used for work without IT knowing. It is rarely malicious; it is usually someone solving a problem quickly. The risk is that nobody has checked where the data goes or what the tool can access. Discovery comes first. Microsoft Purview groups third-party tools detected through browser activity as "Other AI apps", and Microsoft Agent 365 keeps a registry of agents so admins can quarantine unsanctioned ones; the Microsoft Agent 365 Annual Subscription is S$230.00 per year as listed. At the network edge, a firewall with web filtering lets you decide which AI services are reachable. Then publish a short approved-tools list so people have a safe alternative. Over-reliance on any single service is a separate risk, covered in Are Businesses Becoming Too Dependent on ChatGPT?
What does CSA Singapore recommend for securing AI?
CSA published its Guidelines and Companion Guide on Securing AI Systems on 15 October 2024, stating that "AI should be secure by design and secure by default, as with all digital systems", across the whole AI lifecycle. In October 2025 CSA released a draft Addendum on Securing Agentic AI for public consultation, and law firm Baker McKenzie reports that CSA announced the finalised addendum on 17 June 2026, with voluntary measures. The draft's controls include applying least privilege, not sharing credentials with the agent directly, sandboxing AI-generated scripts, continuous monitoring and logging, and human-in-the-loop oversight. None of this is exotic; it is the same discipline that protects against ransomware, as in our guide to preventing ransomware in Singapore.
Practical controls for a Singapore SME
- Approve a short list of AI tools on business plans with clear data terms, and say what may never be pasted in (NRIC numbers, customer records, passwords).
- Connect assistants read-only first. Add send, delete or pay permissions one at a time, each with human approval.
- Log and review. Keep records of what agents accessed and did, and check them monthly.
- Filter at the edge. A FortiGate with a UTM bundle gives web filtering and application control across the office network.
- Keep sensitive work local where it matters. Running models on your own hardware keeps prompts and documents on premises.
For the edge, the Fortinet FortiGate-60F with 24x7 FortiCare and UTM Protection is S$1,535.00 with 1 year of UTM (S$2,735.00 for 3 years, S$3,955.00 for 5 years), and the smaller FortiGate-40F with 1 Year UTM is S$1,065.00; both are available to order. See the FortiGate firewalls for small businesses collection and our post on choosing a FortiGate for a small business. For local AI, the ASUS Ascent GX10 (128GB / 1TB) is S$7,200.00 and in stock; read when running AI locally beats the cloud first.
The SourceIT verdict
AI assistants are worth having, and banning them mostly pushes people towards shadow AI. But an assistant with broad connectors, no logging and a consumer data policy is a bigger exposure than most firewalls are designed to see. Limit what each assistant can touch, require approval for anything that changes or sends data, and know which tools your staff actually use. Do that, and the assistant stops being your biggest risk and becomes one more well-managed system. For the people side, see AI Agents Are Getting Smarter. Are Your Employees Getting Lazier?
Buying AI security tools in Singapore
SourceIT supplies Fortinet firewalls, Microsoft subscriptions and ASUS AI systems for Singapore businesses; prices are as listed on 23 Oct 2026. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page. Government buyers can reach us through GeBIZ and Vendors@Gov.
Frequently asked questions
What is the biggest security risk of AI assistants? OWASP ranks prompt injection first in its 2025 Top 10 for LLM Applications. In offices, the damage is usually amplified by assistants that have too much access, which OWASP calls Excessive Agency.
What is indirect prompt injection? OWASP defines it as instructions arriving through external content the AI processes, such as websites or files, rather than from the user. An assistant reading email or web pages is exposed to it.
Does ChatGPT use my company data for training? OpenAI states that by default it does not use business data from its business products for training. Consumer accounts follow different terms, so check which plan your staff use.
What is shadow AI? AI tools, browser extensions or agents used for work without IT approval. Discovery tools, an approved-tools list and firewall web filtering help bring them under control.
Does Singapore have guidance on securing AI? Yes. CSA published Guidelines and a Companion Guide on Securing AI Systems in October 2024 and an Addendum on Securing Agentic AI, released in draft in October 2025.
Can a firewall stop AI data leaks? A firewall with web filtering controls which AI services are reachable from the office network, but it should be combined with data loss prevention, access limits on connectors and a clear AI use policy.
