One Stolen AI Session Can Open More Than You Expect
You may think your business is protected because your team uses two-factor authentication, Google Workspace security, and company-approved applications. Those controls matter, but they do not protect every moment after a successful login.
When an employee signs in to an AI tool such as Claude, the browser receives a session cookie. That cookie tells the service that the user has already passed the login process. If malware copies it from the computer, an attacker may replay the cookie and enter the account without seeing the password or triggering two-factor authentication again.
The bigger concern is not only unauthorised AI usage. If the employee connected the AI account to Gmail, Google Drive, or another work system, the stolen session may provide a path to information that your company never formally approved.
TL;DR
A stolen AI session cookie can bypass the login page, including two-factor authentication, because it represents an already approved session.
Personal AI accounts connected to company Gmail or Drive can create a blind spot: you may not be able to revoke the AI session from your business admin console. Keep AI accounts, connectors, devices, and permissions under clear company control.
What This Means
A session cookie is a small piece of browser data created after you sign in. It allows you to move between pages without entering your password repeatedly. Normally, this improves convenience. However, infostealer malware can search a computer for browser cookies, saved passwords, and other login information.
Security researchers and vendors have reported campaigns involving malware families such as Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer, according to VentureBeat’s report. Some infections have been linked to pirated software, fake installers, and misleading advertisements that direct users to unofficial application downloads.
If an attacker obtains a live session cookie, they may appear to the service as the legitimate user. Two-factor authentication protects the sign-in event, but the attacker is not signing in normally. They are reusing the proof that the sign-in already happened.
This distinction is important for you as a business owner. Logging out, terminating sessions, rotating credentials, and removing connected app permissions can help. However, your response depends on who controls the account. A company-managed account may be visible to your identity provider and administrator. A personal, self-serve account may not be.
The key question is not only “Does this app use two-factor authentication?” It is “Who can revoke access when the session or connected permission is abused?”
AI connectors create another layer of risk. Anthropic’s help information explains that connectors can retrieve information and take actions in connected services, while the AI service generally inherits the user’s permissions in those services. Read and search activities may be available without approval, while actions such as sending, forwarding, sharing, moving, or deleting may require approval, as described in the source report.
How This Applies to Malaysian SMEs
Imagine you run a 12-person trading company in Selangor. Your sales manager uses a personal AI subscription to summarise Gmail messages and prepare customer replies. The mailbox contains quotations, supplier terms, delivery schedules, and customer contact details. The AI account is not managed by your company, but it has permission to read the work mailbox. If the manager’s laptop is infected, the attacker may gain access through the AI session and connected permission, even if your Google Workspace account has strong sign-in controls.
Now consider a professional services firm in Kuala Lumpur. Your team uploads draft contracts, client documents, and financial spreadsheets into an AI project to speed up document review. A stolen session could expose the AI conversation history and uploaded files. The immediate warning may not be a failed login. It might appear as unusual activity inside the AI account, or as a client asking why confidential information seems to have been referenced elsewhere.
A small retailer, distributor, or restaurant group faces a different version of the same problem. An operations employee may connect an AI assistant to Drive, Gmail, calendars, or shared folders to organise orders and prepare reports. Because the account was created independently with a personal email address, your IT support provider may not know it exists. When the employee leaves, you may disable the company email but fail to remove the AI account or its third-party access.
This risk is particularly relevant when employees download software from search advertisements, unofficial websites, file-sharing platforms, or cracked software sources. A fake “desktop AI app” can be more dangerous than an obviously suspicious email because the employee believes the download is related to work. Your written policy should therefore cover software downloads and browser extensions, not just passwords.
A Simple Risk Picture for Your Business
| Access point | What may be exposed | Control to review |
|---|---|---|
| AI account session | Conversation history, uploaded files, account activity | Session sign-out, device review, account ownership |
| Gmail connector | Messages, attachments, customer and supplier information | Third-party app permissions and mailbox audit logs |
| Drive connector | Shared folders, documents, spreadsheets | Folder permissions and external sharing settings |
| Employee laptop | Cookies, saved passwords, browser data | Endpoint protection, patching, approved software list |
| Personal subscription | Access outside company administration | Company-managed account and documented ownership |
The source article cites LayerX research indicating that 47% of enterprise AI conversations run through personal identities, with Claude at 61%; these figures are reported in the VentureBeat source. Regardless of the exact percentage for Malaysian SMEs, the practical lesson is clear: employees may already be using AI through accounts your company cannot see or control.
Practical Takeaways
- Create an AI inventory. Ask each employee which AI tools they use, whether the account is personal or company-owned, and what business systems are connected.
- Separate personal and business use. Do not allow work Gmail, Drive, CRM records, or client files to be connected to an unmanaged personal AI account.
- Use company-controlled identities. Where available, use your organisation’s email domain, central identity provider, and administrator console.
- Review third-party permissions. Check Google Workspace, Microsoft 365, and other business platforms for AI applications with mailbox, file, calendar, or contact access.
- Remove access when roles change. Offboarding should include connected apps, AI accounts, browser sessions, shared folders, and API tokens.
- Make official downloads easy to find. Give staff direct links to approved software and explain why unofficial installers and pirated software are prohibited.
- Protect browsers and laptops. Keep operating systems, browsers, endpoint protection, and business applications updated. Block unnecessary browser extensions.
- Use least privilege. If an AI tool only needs to search a folder, do not grant access to the entire company Drive. If write access is not required, keep it disabled.
- Define an incident response. If a device may be infected, disconnect it from business systems, terminate sessions, remove app permissions, reset relevant credentials, and preserve evidence for investigation.
- Train employees on session theft. Explain that two-factor authentication does not make an infected laptop safe. Employees should report suspicious downloads, unexpected AI activity, and unfamiliar permission requests quickly.
Questions to Ask This Week
- Which employees use AI tools for company work?
- Which AI accounts are owned by the company rather than an individual?
- Can your administrator see and revoke every AI connection to Gmail, Drive, or Microsoft 365?
- What happens to those connections when an employee resigns?
- Can your team download software freely onto company laptops?
- Do you know where client information and internal documents are being uploaded?
If the answers are unclear, do not begin with a complicated technology project. Start with a short register listing the tool, user, account email, connected services, data accessed, and person responsible for approval. That basic visibility will help you decide which tools need tighter controls.
The Bigger Picture
AI security is moving beyond passwords and login screens. The important controls are becoming identity ownership, permission scope, session management, device health, and clear accountability. An AI tool may be useful, but it can also become a bridge between an employee’s browser and sensitive business systems.
For Malaysian SMEs, this does not mean banning AI. It means introducing it deliberately. Give employees approved tools, approved download locations, clear data-handling rules, and a simple process for requesting new connectors. When staff have a safe, practical option, they are less likely to create hidden workarounds.
You should also treat AI access like access to accounting software, customer databases, or shared drives. Record who owns the account, what it can reach, and how you will revoke it. A connected AI account that no administrator can control is not just an individual productivity tool; it may be an unmanaged business access point.
The strongest response is a combination of controls: company-managed identities, limited permissions, protected devices, verified software sources, regular access reviews, and fast incident handling. Two-factor authentication remains valuable, but it is one part of the process rather than the entire answer.
Your next step: choose one business mailbox and one shared Drive folder, list every AI application with access to them, and remove any connection that has no clear owner or business purpose.
Ready to Streamline Your Operations?
Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →