Most companies rolling out AI assistants worry about hackers breaking in from outside. The bigger risk is usually already inside: years of loose file permissions that an AI agent can search in seconds.

That was the focus of Session 12 of Wursta’s AI Learning Academy, “The Threat Within.” Christopher Hopkins-Ward, Wursta’s AI Enablement Lead, was joined by Pete Hoff, Wursta’s Head of Cybersecurity and CISO. Pete ran a live demo of what happens when an AI agent works with and without guardrails. Here is what they covered.

AI finds what you forgot to lock down

Most shared drives are messy. Over the years, people share folders with the whole company, create links that anyone can open, and leave HR and finance files in places nobody thinks to check. For a long time this felt safe enough, because nobody would ever dig six folders deep into a marketing folder to find the CEO’s salary spreadsheet.

That habit has a name: security through obscurity. It stops working the moment you connect AI. An assistant asked to “summarize the Q2 budget” will search every file the user can technically reach, and it does so in seconds. If executive compensation, M&A plans or HR records are overshared, the AI will find them and include them in its answer.

Gemini doesn’t bypass your permissions. It follows them exactly. That is why the permissions themselves have to be right before you scale AI. We call the backlog of loose permissions “Access Debt.”

Zero-click attacks: EchoLeak and GeminiJack

Christopher opened with a real example. Security researchers found a flaw in Microsoft Copilot called EchoLeak, and a nearly identical one in Gemini Enterprise called GeminiJack. Both have since been patched, but the way they worked is worth understanding.

The email got past security filters because it was written politely. The filters were looking for obvious attack language, not a courteous request buried in a message nobody read. The risk grows as teams build their own AI agents that watch inboxes, read contracts and send replies, often using a single service account that can see everything.

Three controls that close the gap

1. Audit your Drive with doControl

Start by finding out what is exposed. doControl scans every file and flags overly broad sharing, roles with too much access and “anyone with the link” sharing. Pete called link sharing the scenario that worries him most. Wursta runs doControl demos that typically take only a few days.

2. Put an MCP server between AI and your data

A Model Context Protocol (MCP) server sits between an AI agent and your Workspace, and it enforces rules on every request. Christopher compared it to a bouncer at the door. It makes the agent run under the identity of the person using it, so the agent can only see what that person is allowed to see. There is no domain-wide access.

It also applies your DLP rules to anything the agent tries to retrieve. And it requires a human to approve before anything leaves the organization: an agent can read a contract and draft a reply, but it can’t send that reply until someone clicks approve. Pete added that an MCP server can do the same for third-party AI tools, not just Google’s.

3. Screen prompts with Model Armor

Google’s Model Armor works like a firewall for prompts. Instead of matching keywords, it checks whether incoming content is trying to cross your AI’s security boundary, for example an email that tells the agent to ignore its instructions. When it blocks an attempt, it writes a security log so your team can follow up. Pete noted it can protect customer-facing chat agents as well as email.

What the live demo showed

Pete ran four scenarios through a test app, first without protection and then through an MCP server:

Every request and response was written to an audit log, so a security team can see exactly what an agent asked for, what was blocked and who was involved. Pete’s advice: if your developers are building or vibe coding AI tools, make sure they route them through an MCP server.

What attendees told us

We ran three live polls during the session, and the answers backed up the main point of the talk.

Prompt injection ranked lowest, even though it is exactly how EchoLeak and GeminiJack worked.

A Monday morning checklist

Also covered: this month’s Gemini updates

Christopher opened with a roundup of recent Google Workspace changes. Docs and Drive now support Markdown files. Skills are arriving in the Gemini app and will replace Gems, with enterprise accounts moving over in March. Meeting recaps now post in Chat. Canvas apps can be published straight to Google Sites. And Gemini Enterprise is becoming Gemini Agent in November, at no extra license cost.

Watch the replay and get your assessment

The full session, including Pete’s live demo, is available on demand. Watch the replay on the event page.