Powerful AI Assistants Can Create New Business Risks

You may already use AI to draft customer replies, summarise documents, organise meetings or follow up on leads. The next generation of assistants goes further: it can connect to your email, messaging apps, calendar and business systems, then take action for you.

That sounds useful when you are handling sales, operations, customer service and administration with a small team. But convenience becomes a serious concern when an AI assistant can read sensitive information, retrieve verification codes, send messages or make commitments on your behalf.

A recent report on Instinct, an AI personal assistant still in private access, highlights this tension. Testers praised its ability to book appointments, manage inboxes and handle practical tasks, but raised concerns about broad data permissions, stored emails, unexpected actions and the possibility of manipulation through messages. Read the source report.

TL;DR

AI assistants that can act across your business systems should be treated like a new employee with access to sensitive records, not like an ordinary chatbot.

Start with low-risk tasks, limit permissions, require approval for external actions and confirm how your provider stores, deletes and uses your data.

What This Means

A normal chatbot usually responds to the information you type into it. An agent-style assistant can connect to other applications and perform tasks. It may search your inbox, check your calendar, update a customer record, draft a reply or send a message.

The difference is autonomy. The more autonomy an assistant has, the fewer manual checks are made before something happens. This can save time, but it also means one incorrect instruction, malicious email or misunderstood request may affect customers, suppliers or staff.

The Instinct report describes concerns about terms that reportedly granted broad rights over user materials, including access, storage, reproduction, modification and possible use for AI training. It also describes testers finding that disconnected email data could remain available for searches, while another tester reported the assistant retrieving a sign-up code from an inbox. These are not small technical details. They affect who can see your information, how long it remains available and what the system is allowed to do.

The practical lesson: The more an AI assistant can do without asking you, the more carefully you must control what it can see and which actions it can take.

Why “Read Access” Is Not Always Harmless

Many owners assume read-only access is safe. It is safer than full editing access, but it can still expose important information. Your inbox may contain customer complaints, staff matters, supplier bank details, login links, contracts and one-time verification codes.

If an assistant indexes and stores that information, disconnecting the original account may not immediately remove every copy. You therefore need clear answers about retention, deletion, backups, subcontractors and model training before connecting a business account.

How This Applies to Malaysian SMEs

Imagine you operate a service company in Kuala Lumpur with a small sales team. You connect an AI assistant to Gmail and WhatsApp so it can identify enquiries and prepare follow-ups. That could help you respond faster, but the same inbox may contain customer identification documents, tenancy agreements, payment instructions and internal discussions. A broad connection could expose far more information than the sales task requires.

For a retailer, the assistant might organise orders, answer delivery questions and update a spreadsheet. However, customer conversations can include phone numbers, addresses and purchase details. If the assistant is also connected to a shared drive, it might access supplier agreements or staff files. You should separate customer-service materials from confidential folders and give the assistant access only to the information required for its specific job.

For an accounting, recruitment or professional-services firm, the risk is even more direct. Your email may contain payroll data, identity documents, tax information, employment records and client instructions. An assistant that drafts replies can be useful, but it should not independently send a message containing confidential attachments or make a commitment about a client matter.

Malaysian businesses should also consider the Personal Data Protection Act 2010 and related regulatory expectations when using external platforms to process personal information. The law and its requirements should be reviewed with your adviser for your particular business and data flows. The key operational point is simple: know what personal data you are giving to the tool, why it needs that data and how it will be protected.

WhatsApp deserves special care because many SMEs use it as an informal operating system. If an assistant reads customer chats, it may encounter personal information, payment screenshots, internal instructions or messages from unknown senders. A malicious instruction hidden in an email or chat could potentially influence an agent that is allowed to act elsewhere. Treat every connected message source as untrusted until reviewed.

A Simple Risk View for SME Owners

AI capability	Example task	Suggested control
Read documents	Summarise meeting notes	Use a dedicated folder with non-sensitive files
Draft content	Prepare customer replies	Require human review before sending
Edit records	Update CRM follow-up dates	Restrict fields and keep an activity log
Send messages	Email a quotation or reminder	Require approval and attachment checks
Make commitments	Accept an order or booking	Block autonomous approval unless specifically authorised
Access codes	Retrieve a sign-up or verification code	Do not permit inbox access to authentication codes

Practical Takeaways

• Begin with low-risk workflows. Let the assistant summarise internal notes, classify enquiries or prepare drafts before allowing it to send, purchase or approve anything.
• Use a separate business account. Do not connect an assistant to your personal inbox or a shared mailbox containing unrelated confidential material.
• Apply least-privilege access. Give access only to the folders, calendars and applications required for one workflow.
• Keep approval gates. Require a person to approve external emails, quotations, refunds, bookings, contract changes and messages containing attachments.
• Protect authentication information. Do not allow an AI tool to search for passwords, one-time codes or password-reset links.
• Read the provider’s terms. Check whether your content may be stored, reviewed, shared with service providers or used to train models.
• Ask about deletion. Confirm how to remove indexed content, what happens after disconnection and how long backups remain.
• Turn on logging. You should be able to see what the assistant accessed, changed and sent.
• Test with dummy data. Before connecting real customer records, use sample accounts and deliberately confusing instructions.
• Train staff. Explain that an AI assistant is not automatically trustworthy just because it is inside a familiar application.
• Review monthly. Check connected applications, user permissions and recent activity logs at least once a month.

A Practical Approval Rule

Use this simple rule: AI may prepare; people must approve. The assistant can identify an unpaid invoice, draft a reminder and suggest the correct customer record. A staff member should verify the recipient, wording and attachment before sending it.

You can gradually expand autonomy after the workflow has produced reliable results and you understand its failure modes. Do not give an assistant broad access merely because a demonstration looks impressive.

The Bigger Picture

AI assistants will increasingly move from answering questions to completing tasks across multiple systems. That will change how SMEs organise work. Instead of asking staff to copy information between email, spreadsheets and customer-management tools, you may delegate parts of that process to an agent.

However, trust will become an operating control, not just a product feature. Your business will need clear boundaries about what an assistant may read, what it may change and when it must ask for approval. These rules should be written down, just like your policies for handling customer records and approving payments.

The strongest early adopters will not be the businesses that connect every application immediately. They will be the ones that choose narrow, measurable workflows, monitor outcomes and expand permissions carefully. A small company can benefit from AI while still keeping sensitive decisions under human control.

Before you connect an AI assistant to your SME systems, ask three questions: What information can it access? What actions can it take? How quickly can I stop and verify it? If the provider cannot answer those questions clearly, keep the assistant away from your important business data.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →