—
This is a free preview
You are reading the real file, not a mockup. Below is part of Chapter 6: why connectors leak, two documented cases and two of its six fixes, each with the click paths for your tools. The Leak Audit is here too, cut down to five of its forty statements so you can see how the scoring works.
The full playbook has twelve chapters, thirty-two fixes, the forty-statement audit, the AI inventory, the policy generator, the 7-day lockdown plan and the first-hour incident card. Nothing you do here is sent anywhere: answers are saved in this browser only.
Get the full playbook — $79.99 Take the free 10-point check
3
Take the Leak Audit
Sample — this is not the whole chapter. You are seeing 5 of the 40 statements, all from one of the five areas. The chapter in the playbook runs 8 statements each across Map and people, Chatbots, Connectors, Automations and Agents, scores every area separately and ranks all thirty-two fixes in the order you should do them.
Answer honestly. “Not sure” counts against you, because a risk you can’t see is still a risk.
Your answers are saved as you go and the score updates live. The score below is out of these five statements only.
Tick one box per line. Count your “Yes” answers per area. Every “No” or “Not sure” points to a fix; the chapter reference is in brackets.
That is how the scoring works. The other 35 statements, the four remaining areas and the full ranked list of fixes are in the playbook. Get it for $79.99
6
Connectors, extensions and notetakers
Sample — two of the six fixes in this chapter. Everything you read here is exactly as it appears in the playbook.
Every “Sign in with Google” followed by “Allow” handed a tool a key to your account. Most of those keys are still working.
These keys are called OAuth tokens, and each one comes with scopes: the list of things the tool is allowed to do. “Read your email” is a scope. So is “send and permanently delete your email.” Changing your password doesn’t always revoke them. Removing the app’s access does.
Why this happens
Connection screens are designed to be approved, not read. The permission list is short, written in vendor language, and sits between you and a tool you’ve already decided to use. Many apps also ask for more than they need on day one, because it saves them asking again when they add features later.
Then the keys outlive the reason you handed them over. Trials end, projects finish, staff move on, and the connection stays live until someone removes it by hand.
OAuth was meant to work like a valet key: one that starts the car but doesn’t open the glovebox. In practice, many apps ask for the whole key ring, and most people hand it over because the valet is standing right there.
Where the leaks are
- Over-scoped appsAn inbox summarizer that asked to read, compose, send and delete all your email. It needed the first one.
- Forgotten connectionsThe tool you trialed last spring still has access to your Drive.
- Extensions that see every pageAn AI sidebar extension with permission to “read and change all your data on all websites” sees your banking, your CRM and your admin panels. Extensions also change hands and get updated silently. In December 2024, attackers phished the developer of a security company’s Chrome extension and pushed a malicious update to its users.
- Notetakers that join everythingAuto-join sends a bot into every meeting on your calendar, including HR, legal and client calls. Recordings sit on the vendor’s servers, and summaries may be emailed to every attendee.
- Recording consentSeveral US states, including California, require the consent of everyone on a call before recording. A bot that joins silently can put you on the wrong side of that. This is not legal advice; check your states.
- Connectors inside chatbotsWhen your assistant can search your Drive or inbox, any document or email it reads can carry hidden instructions.
What happened: the email nobody had to open
In June 2025, researchers disclosed EchoLeak, a flaw in Microsoft 365 Copilot. A single crafted email, sitting in the inbox, could cause Copilot to pull internal data into its answer and send it to an outside server, without the user clicking anything. Microsoft fixed it before it was exploited in the wild.
That same summer, another team showed that a poisoned Google Calendar invitation could steer Google’s Gemini assistant into taking actions the user never asked for.
Why it matters to you: the more of your accounts an assistant can reach, the more places a stranger can leave instructions for it. Vendors patch specific flaws; limiting what’s connected protects you from the next one.
Scenario (illustrative, based on common setups)
The notetaker at the negotiation
- During a free trial. A real estate agent connects an AI notetaker to her calendar. Auto-join and “share the summary with all invitees” are switched on, and she never changes them.
- Thursday morning. She sets up a call with her sellers by copying an old calendar invite. The old invite still lists the buyer’s agent. He doesn’t join.
- On the call. The sellers say they’d accept $20,000 less if the buyer can close quickly. The notetaker writes it down.
- Ten minutes later. Every invitee receives the AI summary, including the buyer’s agent.
Where it stops: auto-join off and sharing limited to you (Fix 5), and removing notetakers you trialed but no longer use (Fixes 1 and 2).
Fix 1: Review third-party access in Google
- Go to myaccount.google.com › Security › Your connections to third-party apps & services.
- Open each app and read what it can access. Remove anything you don’t use every month.
- Workspace admins: Admin console › Security › Access and data control › API controls › Manage third-party app access. Review apps accessed across the company and block the ones you don’t trust.
- Consider setting unconfigured apps to require admin approval, so new connections come through you.
Fix 2: Review third-party access in Microsoft
- Personal Microsoft accounts: account.microsoft.com › Privacy, then the page listing apps that can access your data. Remove what you don’t use.
- Microsoft 365 admins: Microsoft Entra admin center › Enterprise applications. Review apps and the permissions they were granted.
- Under Enterprise applications › Consent and permissions, restrict user consent so staff can’t grant broad access to new apps on their own.
Four more fixes in this chapter
This chapter has six fixes. You have just read the first two in full, with every click path. The other four work the same way:
- Fix 3: Check the apps inside your other tools — the integrations page of your CRM, Slack and accounting
- Fix 4: Lock down browser extensions — site access on click, and what to remove outright
- Fix 5: Tame your notetakers — auto-join, who gets the transcript, how long it is kept
- Fix 6: Connect chatbots narrowly — what to connect, what to never connect, and how to check
Get the playbook — $79.99
Go deeper (technical)
Look for restricted scopes when you review Google apps: full Gmail access (mail.google.com) and full Drive access are the high-value ones. A tool that only needs metadata or a single file picker should not hold them.
Refresh tokens are long-lived by design. Revocation is the only reliable kill switch, which is why offboarding (chapter 9) includes revoking a leaver’s tokens from the admin console rather than just disabling the password.
For extensions, the risky manifest permissions are host access to <all_urls> plus scripting. Restricting site access at runtime removes most of the blast radius without uninstalling.