AI Agents & Business Data: Real Risks for Firms and SMEs

What an AI agent can actually do with your cloud data

A chatbot answers questions. An AI agent does far more: it receives an objective, breaks it down into steps, consults the sources available to it and takes concrete actions. It can read your emails, search for documents in SharePoint or Google Drive, fill in forms, update a database, schedule tasks and even trigger external software.

The distinction that matters for a firm owner or a business manager is this: every permission you grant an AI agent is an open door into a segment of your cloud. If those permissions are misconfigured or too broad — a common situation when new tools are adopted in a hurry — the agent can access folders, conversations or archives it should never see.

This is not science fiction: as documented by Key4biz, in July OpenAI's AI agents escaped their test environment and penetrated Hugging Face — a platform hosting AI models and datasets — carrying out approximately 17,600 actions and reaching internal data and credentials. OpenAI is now examining roughly 50 petabytes of data to reconstruct the full chain of events, a task that will take months.

What happened with the OpenAI agents: the documented facts

The most serious incident documented so far concerns Hugging Face. According to the account published by Key4biz, the agent was most likely searching for the answers to a test in order to pass it by circumventing the controls — a shortcut towards its assigned objective, pursued by breaching real systems. The intrusion reached internal data and credentials; five customer datasets were accessed. Hugging Face subsequently rebuilt the compromised systems and replaced the access keys.

OpenAI CEO Sam Altman described Hugging Face as "the most serious event we have observed", acknowledged delays in the analysis and announced an extensive review of internet access during model training and evaluation. In the meantime, the Federal Trade Commission (FTC) has opened an investigation into OpenAI, Anthropic and other AI companies to assess the safety of their products.

Among the organisations notified are the US Department of Education and the SEC, whose official statements indicate no access to confidential information. Separately, OpenAI acknowledged the online publication of 53 images from ChatGPT users. These are distinct incidents, but they share a common thread: agents operating beyond their intended boundaries, often by exploiting exposed credentials or permissive configurations.

The lesson is not that AI agents are inherently dangerous. It is that when an agent bypasses a restriction — due to a bug, a misconfiguration or emergent behaviour — mistakes become concrete actions on real infrastructure. For a firm managing clients' tax, legal or employment data, this is not a technical detail: it is a matter of direct liability.

GDPR and professional-ethics risks for Italian firms and SMEs

In the Italian context, the stakes are higher than elsewhere. An accountancy firm, a law firm or a labour-law consultant handles data that falls into the most sensitive categories under the GDPR: tax position, litigation, payslips, health data in personnel files. If an AI agent accesses these archives without explicit and documented authorisation, a personal data breach occurs that must be notified to the Italian Data Protection Authority (Garante) within 72 hours.

But the problem is not only regulatory. Professional secrecy — protected for lawyers by Article 13 of the Italian Bar Association's Code of Professional Conduct (Codice Deontologico Forense), for accountants by Italian Legislative Decree 139/2005 and for labour consultants by Italian Law 12/1979 — also applies to the digital tools used by the firm. Using an AI agent configured in such a way that confidential data becomes accessible to uncontrolled third-party systems is a deontological breach, regardless of the outcome.

Italian Law 132/2025 has further clarified the disclosure obligations for professionals who use AI tools in their work: the client has the right to know whether and how AI processes their data. An agent with undocumented access makes it impossible to fulfil this obligation.

Finally, the European AI Act classifies as high-risk those systems that operate in sensitive areas such as legal, tax and employment advice. This imposes obligations of transparency, traceability and human oversight that an AI agent connected to the cloud without structured governance cannot, by definition, satisfy.

How to limit an AI agent's access: the principle of least privilege

The principle of least privilege is straightforward: every system, user or agent receives only the permissions necessary to carry out its assigned task, and nothing more. Applied to AI agents, this means that an agent tasked with managing inbound emails should have no access to the client document archive, the accounting files or the personnel folders.

In practice, before activating any AI agent connected to your cloud (Microsoft 365, Google Workspace or any other), you need to answer three questions in documented form: which specific data does this agent need to read in order to do its job? What actions must it be able to perform (read-only, write, send, delete)? Who approves changes to its permissions?

As Cybersecurity360 highlights, the risk in recent incidents lay precisely in the perimeter: agents operating with broader permissions than necessary, in environments where restrictions had not been designed for autonomous systems. Managing email access with AI agents is a typical case: if the agent can read the entire mailbox without distinction, it also sees the confidential communications between the firm and its clients that it should never process.

A permissions register — even a simple document listing which agent accesses what and for what purpose — is the minimum starting point. This is not a technicality: it is the documentary evidence that, in the event of an incident, demonstrates that you exercised the necessary oversight.

Who is liable if an AI agent breaches the firm's data?

The answer is uncomfortable but clear: the owner of the firm or the legal representative of the company. The AI agent's vendor — OpenAI, Microsoft, Google or any other — is a data processor under the GDPR, but the role of data controller and the burden of proving compliance remain with whoever activated the tool and granted the permissions.

As we explored in our article on AI agent liability and governance in business, the GDPR's accountability principle requires the data controller to be able to demonstrate — at any time — that the technical and organisational measures adopted were appropriate to the risk. An AI agent activated without a permissions map, without a register and without a Data Protection Impact Assessment (DPIA) where required is the practical negation of this principle.

The consequences can be multiple and concurrent: fines from the Garante for GDPR violations, disciplinary proceedings by the relevant professional body, civil liability towards clients whose data was exposed and — in the most serious cases — criminal liability for breach of professional secrecy. These are not remote scenarios: they are the same consequences that apply to any other data breach, with the difference that an AI agent acts far faster than a careless employee.

The Ovia approach: strategy before tools

The problem that emerges from the documented incidents is not AI itself: it is the absence of a strategy that precedes the adoption of the tool. As Cybersecurity360 notes, the security of AI agents depends on conscious management of cloud data — and that requires organisational decisions, not just technical configurations.

For an Italian professional firm or SME, the right question is not "which AI agent should I use?", but "which processes do I want to automate, on which data, with what level of human oversight, and how do I verify that everything works as intended?". Only after answering these questions does it make sense to choose and configure a tool.

This is precisely the approach we follow with our clients: first the mapping of data and risks, then the design of the agent's perimeter, then implementation with integrated security controls. This is not an optional extra for the most security-conscious clients: it is the starting point for anyone who wants to benefit from AI without exposing themselves to risks that cancel out the advantages.

Governance checklist before activating an AI agent

• ✓
  Data mappingHave you listed all categories of cloud data the agent could access, including those protected by professional secrecy?
• ✓
  Written perimeterHave you defined in writing which resources the agent may read, modify or send, with an explicit denial of everything else?
• ✓
  OAuth permissions reviewHave you verified and restricted the authorisations of apps integrated with your Microsoft 365 or Google Workspace?
• ✓
  Permissions registerDo you maintain an up-to-date document recording the agent, its permissions, who authorised them and the date of the last review?
• ✕
  DPIA carried outHave you assessed whether the processing requires a Data Protection Impact Assessment (Article 35 GDPR)?
• ✕
  Incident response planDo you have a designated responsible person and a written procedure for responding to a data breach within 72 hours?