Your AI Isn’t the Liability. Your Data Egress Is.
- Matt Harrison
I’ve been thinking a lot about something obvious – and a little uncomfortable.
AI adoption inside organizations is moving faster than governance. Not because people are reckless and not because they don’t care about security, but because AI is genuinely useful, especially when you’re buried in documents.
If you run a department that lives inside contracts, claims packets, case files, reports, invoices, or internal documentation, you’ve already felt it.
- Summaries that take seconds instead of hours
- Classification that actually works
- Drafting that removes the blank-page tax
So people do what people always do.
They copy.
They paste.
They upload the document to whatever AI tool is closest and fastest.
Most of the time, nothing bad happens.
Until it does.
The Reality We’re In (Whether We Like It or Not)
The status quo nobody wants to say out loud:
AI adoption is happening faster than the controls designed to keep documents safe.
That doesn’t mean organizations aren’t trying. It means the workflows are beating the policies.
From a department leader’s perspective, this makes total sense. You’re measured on throughput, turnaround time, and outcomes, not on how perfectly every document interaction follows a security diagram.
So when an AI tool can summarize a 40-page document, extract structured data, or draft something usable in one pass, the frictionless option wins.
The problem is that in many organizations, the default AI workflow still looks like this:
“Take the document out of the system where it’s governed…
…and move it into a tool that isn’t.”
That’s not theoretical risk. We’ve already seen what happens.
In a widely reported incident, CISA’s acting director uploaded multiple ‘For Official Use Only’ documents to public ChatGPT, triggering internal alerts and governance scrutiny. This wasn’t done maliciously. The tool was simply convenient.
That’s the reality of AI risk today:
It’s driven by well-meaning people trying to get work done.
The Risk Tax Is Usually Paid in Documents
If you zoom out, most organizations don’t actually run on “data” in the abstract. They run on documents.
- Contract
- Pricing sheets
- Claims
- Case files
- Customer records
- Product roadmaps
- Internal strategy decks
These are the highest-value assets in the building, and they’re overwhelmingly document-based.
When something goes wrong, the story almost never starts with:
“The AI model got hacked.”
It starts with:
“Someone put something somewhere they shouldn’t have…
…and the controls we thought existed weren’t really there.”
Take another real-world example.
Security researchers uncovered malicious browser extensions marketed as ChatGPT productivity tools. These weren’t exploiting ChatGPT itself. They were stealing session tokens, allowing attackers to access user accounts and whatever data had passed through them.
It’s important to understand the distinction here.
The model wasn’t the weak point.
The workflow was.
Which brings us to the part most teams still underestimate.
Documents Are No Longer Just Content – They’re an Attack Surface
In modern AI workflows (copilots, RAG systems, agents), documents don’t just store information.
They can carry instructions.
Prompt injection and indirect prompt injection turn documents, URLs, and even metadata into behavior-shaping inputs. A document doesn’t just say something; it can cause something to happen. Trigger an action.
Varonis’ “Reprompt” research demonstrated a single-click attack chain against Microsoft Copilot Personal using indirect prompt injection techniques. No exploit of the model itself. Just carefully crafted inputs that caused unintended data access and exfiltration.
This is the uncomfortable realization:
When AI systems can read documents and take actions, documents become executable.
At that point, this is no longer about “AI hallucinations.” It’s about trust boundaries collapsing.
If the document layer isn’t trusted (and the guardrails are mostly cosmetic), you’ve turned your most sensitive assets into a liability.
The position on this is straightforward: AI is worth it. Full stop. But untrusted document workflows + powerful AI is a bad combination.
The Pivot Most Smart Teams Are Taking
The most capable AI teams aren’t starting with:
“Which model should we use?”
They’re starting with a different question:
“Where does AI run — and what does it have permission to touch?”
That shift matters more than almost any model choice.
Because the fastest way to reduce AI risk isn’t to slow adoption.
It’s to change the architecture.
Two things happen when you do that:
- You move AI closer to the data, instead of moving data out to AI.
- You start treating document AI as an information security system, not a productivity toy.
This isn’t about banning tools or locking everything down. It’s about removing unnecessary egress paths.
Why This Matters More Today Than Ever Before
Three forces are colliding, and department leaders are stuck in the middle.
Convenience Beats Policy – Even at the Top
The CISA example matters because it wasn’t an intern or a rogue user. It was leadership. High-trust roles are just as susceptible to convenience-driven decisions.
If it can happen there, it’s already happening quietly everywhere else in your organization.
Attackers Are Targeting the Workflow Layer
Browser extensions. Session tokens. OAuth scopes. Connectors.
It’s easier to compromise how AI is accessed than to attack the model itself. Once that layer is compromised, the blast radius is defined by where your documents flow, and the damage by how critical those documents are to you.
Prompt Injection Is Becoming Practical
Indirect prompt injection is no longer academic. It’s repeatable. It works. It specifically targets systems that combine documents, retrieval, and action-taking AI.
“We don’t store anything” is no longer a sufficient answer.
What Actually Lowers Risk (Without Killing Momentum)
I like to keep things practical.
Architectural Guardrails: Keep Sensitive Docs Inside
If a document is sensitive, regulated, or business-critical, processing it inside a governed environment matters.
That might be on-prem.
It might be a tightly controlled private environment.
The key principle: Eliminate unnecessary document egress to unmanaged, public, or consumer-grade AI surfaces.
If the AI needs the document, bring the AI to the document, not the other way around.
Permission Guardrails: Default-Deny for Agents
Agentic AI collapses boundaries:
documents + credentials + actions in one loop.
That’s powerful and dangerous.
Smart teams apply default-deny permissions: narrow file access by role and workflow, restrict connectors and external browsing, require human confirmation for sensitive actions, and log everything.
This isn’t about trusting the tool.
It’s about not trusting anything by default.
Input Trust Guardrails: Treat Docs as Untrusted
This part gets overlooked constantly.
Inbound documents and URLs should be treated as untrusted inputs because they can carry instruction-like payloads.
Controls include content sanitization, retrieval constraints, allowlists, clear separation between “read” and “act,” and auditability.
If you don’t know why the AI did something, you don’t control it.
A Quick Word on Agents As They Dominate The News
Agent frameworks are exploding, and for good reason. They’re incredibly capable.
They also create a “keys to your life” dynamic.
Security researchers analyzing tools like MoltBot / OpenClaw highlighted issues like plaintext credential storage, broad access scopes, and supply-chain risks. In some deployments, exposed interfaces and leaked tokens have been observed.
The takeaway: agents collapse boundaries. Once documents and actions are linked, security becomes identity, permissions, deployment, and auditability, not model safety.
If an agent can read your documents and act on your systems, you need to be absolutely certain where it lives and what it can touch.
What This Unlocks When You Get It Right
When AI runs where your data already lives, and permissions are real, a few things change.
Tangible Outcomes
Fewer paths for sensitive document egress. Smaller blast radius if endpoints or sessions are compromised. Faster adoption without the “we paused AI because of one incident” cycle.
Intangible (But Very Real) Benefits
Confidence to move beyond pilots and experiments. Less friction between Security and the Business. A defensible position when peers experience public AI incidents.
And maybe the most underrated benefit:
You stop asking people to choose between getting work done and doing the safe thing.
The Question Worth Sitting With
If one well-meaning leader can upload sensitive documents to a public AI tool, what’s happening quietly across the rest of your organization?
What would change if you moved AI to where your documents already live, instead of moving documents to wherever the AI happens to be?
Because at this point, your AI probably isn’t the liability.
Your data egress is.
Matt Harrison
Matt's expertise in software, data modeling, and business development underpin dependable and successful project completion. Whether developing and taking new products to market or solving complex business problems, Matt's vision, wisdom, and insight cultivate extraordinary innovation. Matt is an intense learner of cutting-edge data science technologies, trusted by peers and customers alike.
Related Posts
How to Digitize and Index Decades of Old Records
See how real organizations digitized and indexed decades of old records, handwritten and damaged ones included, with two paths to get there.
Agentic Document Processing and MCP: How AI Agents Are Changing Document Capture
See how agentic AI and MCP let Grooper build document processing workflows in hours, not days, then run extraction without ongoing AI costs.