Three incidents have emerged this week that have nothing to do with the future of artificial intelligence — they concern the present reality of anyone already using OpenAI tools in their firm or business. OpenAI has sent notifications to more than a hundred organisations regarding anomalous activity by their own AI agents. Custom GPTs — the personalised models available in the GPT Store — have been exploited as the first stage of cyberattacks. And agents used in breaches of US government systems made it harder to trace who did what and when.
If you run a professional firm or an SME and have already introduced an AI agent or a custom GPT into your workflow, these incidents concern you too. Not because you are doing anything wrong, but because the speed at which these tools are being adopted often outpaces the speed at which even minimal governance is built around them. And without governance, the risk is not hypothetical — it is already documented.
- OpenAI has alerted more than 100 organisations to real incidents involving their own AI agents' activity
- Malicious Custom GPTs are being used to deliver ClickFix attacks and install malware (RATs) on users' devices
- AI agents can access and transfer data in ways that are difficult to trace, as demonstrated by breaches of US government websites
- For a professional firm, a breach caused by an AI agent can constitute both a violation of professional secrecy and a GDPR data breach
- Before deploying an AI agent, you must define: which data it can access, what actions it can take, who oversees it, and how every operation is logged
- Security is not a feature of the AI tool — it is an organisational responsibility that comes before choosing any tool
In this article
- OpenAI has already alerted over 100 organisations: what actually happened
- What malicious Custom GPTs are and why they pose a concrete risk
- AI agents and traceability: lessons from US government breaches
- What you are exposed to under GDPR and professional liability rules
- How to use AI productively without exposing your firm
- The Ovia view
- Frequently asked questions
OpenAI has already alerted over 100 organisations: what actually happened
Let us start with the facts. According to reporting by AI4Business, OpenAI has sent notifications to more than a hundred organisations regarding anomalous or unexpected activity by their own AI agents. These are not generic precautionary alerts: they are communications tied to specific agent behaviour during real operations.
An AI agent, unlike a traditional chatbot, does not simply answer questions. It can take actions autonomously: access files, send emails, interact with external systems, browse the web, update databases. This capacity to act — when it is not precisely defined and not monitored — produces behaviours nobody anticipated, which can be very difficult to reconstruct after the fact.
For an accountant, a solicitor, or a labour consultant, this scenario has direct implications. If an AI agent — perhaps introduced to automate case management or client communications — accesses shared folders, downloads documents, or sends them to external systems without anyone having explicitly authorised it, the principal of the firm is nonetheless liable. Not to OpenAI, but to the Italian Data Protection Authority (Garante) and to their own professional regulatory body.
- An AI agent with no defined perimeter can access any resource available to the user who activated it: email, network folders, management systems, invoicing platforms. If that user has access to sensitive client data, the agent inherits it automatically.
- If a data breach occurs and no log of the agent's actions exists, proving what it did, when, and why becomes extremely difficult. The absence of an audit trail is an aggravating factor, not a mitigating one — both under GDPR and in disciplinary proceedings.
What malicious Custom GPTs are and why they pose a concrete risk
The second incident concerns Custom GPTs — the personalised models that anyone can create and publish in OpenAI's GPT Store. As documented by Cybersecurity360, these personalised models have been used as the first stage of cyberattacks known as ClickFix: the user interacts with a GPT that appears genuinely useful — a legal assistant, a tax analysis tool, a contract drafting aid — which at a certain point provides instructions or links that lead to the installation of a RAT (Remote Access Trojan), software that gives the attacker remote control of the victim's device.
The technique works precisely because it exploits the trust users place in the tool. People who use ChatGPT every day tend to lower their guard: if the GPT asks them to paste a command into the terminal to 'fix a technical issue', many will do so without checking. The result is a compromised device that can give access to the firm's entire network.
Recognising a malicious Custom GPT is not always straightforward, but there are warning signs that must not be ignored: instructions asking you to copy commands into the terminal or system prompt; links to unverified external sites; requests for credentials or to install software. No legitimate AI tool needs any of these actions in order to function. The practical rule for any firm is to use only Custom GPTs from verifiable sources, and to maintain an approved list of tools outside of which no team member may adopt new ones independently.
How to spot a potentially dangerous Custom GPT
- ✕Unverifiable sourceThe GPT is published by an account with no history, no official website, and no reference to the organisation that created it.
- ✕Requests system-level actionsIt asks you to paste commands into the terminal, the command prompt, or to install an extension to 'complete the process'.
- ✕Links to unrecognisable external sitesIt generates links to domains that do not correspond to known services, or redirects you away from ChatGPT for unclear purposes.
- ✕Asks for credentials or access dataNo legitimate GPT needs your passwords or authentication tokens in order to function.
- ✓Official and documented sourceThe GPT is published by a recognisable organisation, has clear instructions, and requires no actions outside the ChatGPT interface.
AI agents and traceability: lessons from US government breaches
The third incident is perhaps the most underappreciated. As reported by Cybersecurity360, in certain breaches of US government systems, AI agents operated in ways that made it harder to reconstruct the chain of actions taken. In practice, the use of agents reduced the traceability of malicious activity, complicating forensic investigations.
This aspect strikes a raw nerve for Italian professional firms. The GDPR requires that every processing operation involving personal data be documented, that data processors be identified, and that — in the event of a breach — it is possible to reconstruct what happened. If an AI agent operates without leaving readable, verifiable logs, that documentation simply does not exist. And in the event of an inspection by the Garante, or a complaint from a client, the absence of records is not a shield — it is an additional liability.
Liability for AI agents in a professional context is a topic Ovia has been following closely for some time: the tool can make mistakes, but the professional is the one who signs off. This applies equally to what the tool does autonomously, not only to the text it produces.
How it works in many firms today
Without governanceHow it should work
Recommended approachWhat you are exposed to under GDPR and professional liability rules
Let us be clear about the concrete consequences. If an AI agent causes a personal data breach at your firm — because it extracted documents, sent them to an unauthorised system, or granted access to unentitled third parties — this constitutes a data breach under Article 33 of the GDPR. You have 72 hours to notify the Garante and, in the most serious cases, the affected clients as well. GDPR fines can be very substantial, proportionate to the severity of the breach and the size of the organisation.
For members of regulated professions (accountants, solicitors, labour consultants) there is a second layer: professional secrecy. If a client's data is exposed through an AI tool you introduced without taking appropriate precautions, the breach is not merely administrative — it may have disciplinary consequences. Italian Law 132/2025, in force since the beginning of the year, has introduced specific obligations for professionals who use AI in their processes, including a duty to inform clients about the use of automated systems in certain circumstances. If you want to explore this further, we have analysed Italian Law 132/2025 and its implications for professional firms.
The point is not to stop using AI. It is that adoption without governance turns a useful tool into a documented source of risk. And in this case, that risk has already been documented by OpenAI itself through the notifications it sent to more than a hundred organisations.
Which data can it access?Step 1
Map exactly the resources the agent can reach. If you cannot answer this question, do not activate it yet.
What actions can it take autonomously?Step 2
Distinguish between actions the agent executes independently and those that require human approval. Any action involving client data must always have a checkpoint.
Is there a log of its activity?Step 3
Verify that the agent's actions are recorded in a readable, retained format. Without a log, you cannot prove anything if a dispute arises.
Who is responsible for oversight?Step 4
Appoint a named individual — not 'everyone' — who periodically reviews what the agent has done. Diffuse oversight is no oversight at all.
Are your DPA and processing register up to date?Step 5
Introducing an AI agent is a new personal data processing activity. It must be entered in the register and, if you use external providers, an updated Data Processing Agreement is required.
How to use AI productively without exposing your firm
The answer to 'is it safe to use AI?' is not 'no' — it is 'it depends on how you do it'. There are ways of adopting AI agents that deliver real benefits — time savings, fewer errors, more effective client communication management — while keeping control of what happens to data.
The first principle is least privilege: every agent must be able to access only the resources strictly necessary for the task assigned to it. Not the entire client folder because 'it might come in handy', but only the files relevant to that specific function. The second principle is human approval before action: any operation that produces an external effect (sending an email, generating a document, updating a record) must go through a human approval step. The third principle is documentation: every AI system used in the firm must be catalogued, with details of the provider, the data processed, and the security measures in place.
None of this requires a dedicated IT team. It requires an organisational decision and a method. For firms that want to automate the management of internal communications, for example, a system such as Ovia Second Brain is designed to keep control over client information without exposing the entire archive to an unsupervised agent. Equally, for email and document management, there are approaches that separate data access from action execution, maintaining a human checkpoint before every send. If you want to understand better how to build this governance framework, we have already covered the risks of AI agents accessing business data with practical guidance.
Minimum checklist for safe AI agent adoption in your firm
- ✓Access perimeter defined in writingThe agent has access only to the resources it needs, not the entire infrastructure.
- ✓Action log active and retainedEvery agent action is recorded in a readable format and retained for at least 12 months.
- ✓Human oversight before critical actionsNo action affecting clients or external systems takes place without explicit approval.
- ✓Processing register updatedThe AI agent is registered as a new processing activity in the firm's GDPR register.
- ✓DPA signed with the providerIf the provider processes data on your behalf, a signed data processing agreement is in place.
- ✓Approved AI tools list in placeThe team knows which tools it may use and does not adopt new ones without authorisation.
Ovia's perspective: security comes before the tool
At Ovia we work with Italian professional firms and SMEs that want to introduce AI in a way that is genuinely useful, not recklessly risky. The question we are asked most often is 'which tool should I use?'. The right question is a different one: 'what do I want to automate, on which data, with what level of control?'.
The incidents that emerged this week — OpenAI's alerts to more than a hundred organisations, Custom GPTs used as attack vectors, the reduced traceability of agent activity in government breaches — confirm what we have been saying for some time: AI is the tool, but strategy and security are what actually deliver value. An AI agent operating without boundaries and without oversight is not an accelerator — it is an operational risk with a name and a face.
That is why every system we build starts with a mapping of data and permissions, defines human checkpoints before critical actions, and produces auditable logs. Not because we are cautious on principle, but because it is the only way to use AI in a manner that will stand up to a Garante inspection, a client complaint, or a question from your professional regulatory body.
Frequently asked questions
Can AI agents access my firm's confidential data without my knowledge?
Yes, technically it is possible. An AI agent inherits the permissions of the user who activates it: if that user has access to folders containing client data, the agent can access them too. Without a defined perimeter and without an action log, this activity can go unnoticed until an incident occurs.
What are malicious Custom GPTs and how do I recognise them?
Malicious Custom GPTs are personalised models published in OpenAI's GPT Store by bad actors. They disguise themselves as useful tools — legal assistants, document drafters — but provide instructions or links that lead to malware being installed on the user's device. Warning signs include requests to paste commands into the terminal, links to unverifiable sites, or requests for credentials.
Has OpenAI really alerted organisations to incidents involving their own AI agents?
Yes. According to AI4Business, OpenAI has sent notifications to more than a hundred organisations regarding anomalous activity by their own AI agents. These are not theoretical alerts — they are communications tied to specific agent behaviour during real operations.
How do I know whether an AI agent is operating safely in my firm?
You need to verify three things: that the agent has access only to the resources strictly necessary for its task; that a readable log of all its actions exists; and that there is a named person who periodically reviews what it has done. If any one of these three elements is missing, the agent is not operating under minimum security conditions.
What rules must I follow before adopting an AI agent that handles client data?
Before adoption you must define the agent's access perimeter, establish which actions require human approval, update your GDPR processing register, and sign a Data Processing Agreement with the provider if they process data on your behalf. Italian Law 132/2025 adds disclosure obligations towards clients for certain types of automated use.
What are my GDPR and professional liability exposures if an AI agent causes a breach?
In the event of a data breach caused by an AI agent, you are required to notify the Garante within 72 hours and, in the most serious cases, the affected clients as well. GDPR fines can be very substantial, proportionate to the severity of the breach and the size of the organisation. For members of regulated professions, there is the additional risk of disciplinary consequences for violation of professional secrecy.
How can I use AI productively without exposing my firm to security risks?
Apply the principle of least privilege (the agent accesses only what it needs), always maintain a human checkpoint before any external-facing action, and register every AI tool in your GDPR processing record. These three steps do not eliminate every risk, but they drastically reduce your exposure and put you in a position to demonstrate that you acted with due diligence.
Conclusion
This week's news does not signal a future crisis — it documents one already under way. OpenAI has already alerted more than a hundred organisations. Custom GPTs are already being used as attack vectors. Agents already in production have already reduced the traceability of malicious activity in government environments. For a professional firm handling sensitive client data, professional secrecy obligations, and GDPR duties, ignoring these signals is not caution — it is exposure.
The good news is that AI agent governance does not require extraordinary investment or advanced technical expertise. It requires method: deciding what to automate, on which data, with what oversight, and documenting it. This is exactly the work that must be done before adopting any tool that touches client data.
If you are considering introducing an AI agent into your firm, or want to check whether the ones you already use respect a minimum security perimeter, the starting point is always the same: strategy first, tool second.
Ovia systems for this topic
Tailor-made solutions that solve exactly the problem discussed in this article.
Ovia Second Brain
Enables firms to manage knowledge, decisions, and client information in a controlled environment, with a defined access perimeter and without exposing the entire archive to an unsupervised agent.
Discover Second BrainEmailOvia Inbox
Automates email management while maintaining a human approval checkpoint before every client-facing response, reducing the risk of an agent sending unauthorised communications.
Discover InboxDocumentsOvia Documents
Handles document collection and review with full traceability of every operation, so that every action on client files is logged and verifiable in the event of a GDPR audit.
Discover DocumentsSources
- Agenti OpenAI, è escalation di incidenti: che succede ora — Cybersecurity360
- OpenAI avvisa oltre cento organizzazioni per le attività dei propri agenti AI — AI4Business
- Custom GPT malevoli: così ChatGPT diventa il primo anello di un attacco ClickFix — Cybersecurity360
- Agenti di OpenAI: nascoste le attività di hacking nelle violazioni governative USA — Cybersecurity360
An article by the Ovia editorial team, written with the support of artificial intelligence tools from the sources cited, which remain the property of their respective authors. Translated from the Italian original. This information is for general guidance and does not constitute legal or tax advice. Corrections: oviaitalia@gmail.com.