Every real AI incident comes down to what you connected it to

It is tempting to treat AI mishaps as freak events — a weird prompt, an unlucky bug. They aren't. Line the real ones up and the same shape appears every time: a capable AI, wired to real systems with broad access, fed input nobody checked, with no record of what it did. Here is what that has actually cost real, named companies — and the pattern worth learning before it is your logo in the headline.

A note on honesty up front, because it matters for a security audience: some of these are confirmed real-world incidents, and some are things security researchers proved were possible and responsibly disclosed. That is a real distinction, and it is flagged throughout. "A researcher showed an attacker could" is not the same as "attackers did" — but for a business deciding how much access to hand its AI, both are the point.

When the employee is the leak

The original shadow-AI story is Samsung, in 2023. Within weeks of allowing ChatGPT in its semiconductor division, employees had fed it sensitive material on at least three reported occasions — including chip-equipment source code, defect-detection code, and a recording of an internal meeting submitted for summarising. None of it was malicious. It was people trying to work faster. Samsung's response was to ban generative-AI tools on company devices outright and start building its own.

Samsung was not alone, and the reaction is the tell. JPMorgan restricted internal ChatGPT use in early 2023; Apple limited employee use of ChatGPT and GitHub Copilot; Amazon warned staff not to paste confidential code after outputs started resembling internal data. The most sophisticated enterprises on earth all reached for the same blunt instrument — a ban — because the alternative, governing the access instead of forbidding it, didn't exist yet. That gap is the whole reason this category of product exists.

When the agent is the leak

Give an AI agent tools, and the leak no longer needs a careless employee. It needs a booby-trapped input. This is prompt injection: untrusted content carrying hidden instructions the agent reads and obeys. Combine it with broad access and an exit path — Simon Willison's "lethal trifecta" — and the agent becomes the exfiltration tool.

Researchers have now demonstrated this repeatedly, against flagship products:

• Microsoft 365 Copilot — "EchoLeak." In June 2025, Aim Security disclosed a zero-click flaw (CVE-2025-32711, CVSS 9.3): a single crafted email could silently steer Copilot into pulling data from a user's emails, SharePoint, OneDrive and Teams and sending it out — no click required. Microsoft patched it and says there was no exploitation in the wild. It is widely described as the first zero-click attack on a production LLM system.
• Supabase MCP server. General Analysis showed that with the MCP server running under a role that bypasses row-level security, a malicious string hidden in a customer support ticket could be read by the agent as an instruction and run as SQL — dumping private tables into a place the attacker could see.
• GitHub MCP server. Invariant Labs demonstrated that a malicious issue filed on a public repo could, when a user asked their agent to triage issues, cause the agent to pull data from their private repos and leak it via a pull request. Their point was sharp: GitHub can't fully patch this server-side — it needs governance at the agent level, like per-session repo scoping.
• Slack AI. PromptArmor showed an attacker posting instructions in a public channel could get Slack AI to surface data — including API keys — from private channels the attacker couldn't see. Slack investigated and patched.

Those four are demonstrations. Here is the one that actually shipped and broke: Asana's MCP server. Weeks after launch in 2025, a tenant-isolation flaw meant AI requests from one organization could receive another organization's data. Asana took the server offline, patched it, and notified around 1,000 potentially affected customers. No confirmed malicious access — but a real cross-organization data exposure, caused by rushing an MCP integration to production without watertight access control.

When the agent speaks for you

The third failure mode isn't data leaving — it's the agent doing or saying something the company is then on the hook for.

The landmark is Air Canada. Its support chatbot told a grieving customer he could claim a bereavement fare retroactively. Air Canada's real policy said otherwise, and it refused the refund — arguing, remarkably, that the chatbot was "a separate legal entity responsible for its own actions." In February 2024 a British Columbia tribunal rejected that outright and ordered the airline to pay. The damages were about C$812. The precedent — you own what your AI tells your customers — is worth far more than that.

Then there's the brand-safety tax. In December 2023 a prankster talked a Chevrolet dealership's ChatGPT-powered bot into "agreeing" to sell a Tahoe for $1, telling it to treat every statement as legally binding. No car changed hands, but the screenshots went everywhere. A month later, DPD's chatbot — after a system update — swore at a customer and wrote a poem about how useless DPD is, to over a million views. Both companies pulled the AI. Neither had a guardrail between "public-facing agent" and "says anything."

The common thread

Read down that last column and it's one thing said five ways: the access was too broad, the input was trusted when it shouldn't be, and nothing recorded or constrained what the agent did. That is not five different problems. It is one, and it is a governance problem — not a model problem. A better LLM does not fix an over-privileged connection or an unlogged action.

The uncomfortable part is that most companies can't even see where they'd be exposed. They don't know which AI tools their team has connected, to which systems, with what access. That is exactly what a shadow-AI scan surfaces — the inventory before the incident. Connor maps every AI connection across your team, read-only, and hands you the list of what to scope down first. Run it on your own team below, before the pattern in this post finds you.