Ask most households what their AI assistant currently has access to, and the usual answer is "whatever it was given when it was set up." That answer is already out of date. Every new integration, every consent screen tapped through without reading past the first line, every skill or plugin bolted on because it looked useful at the time, adds to a permission set that almost nobody goes back and checks. This failure mode is old: it is how permissioning has always broken down, in every system that has ever had permissioning. AI assistants give the same pattern far more to reach into: the calendar, the inbox, the smart home, increasingly the accounts that move money.
There is a reason that combination matters more here than it does for a single overreaching app. Security researcher Simon Willison named it the "lethal trifecta" in June 2025: an agent that can see private data, that is exposed to content it did not write itself, and that can communicate with the outside world can be tricked by a single well-placed instruction into handing that data to an attacker. A household AI assistant with email, calendar, and web access can check all three boxes. That is the whole appeal of it, and the whole exposure.
The Sprawl You Didn't Mean to Build
Permission creep is not hypothetical. In a SailPoint survey of 353 IT professionals published in May 2025, 80% said their organizations' AI agents had taken unintended actions, and 23% said their agents had been tricked into revealing access credentials. Okta's 2026 survey of 292 executives and 492 knowledge workers, run in March 2026, found that only 34% of organizations apply the same security controls to their AI agents as to their human staff. There is little reason to think households are more disciplined than enterprises with dedicated security teams.
The discipline that actually works is the unglamorous one: stay on top of what has been granted as you go, rather than letting it build for a year and facing a clean-up nobody wants to do. Small and continuous beats large and occasional, for the same reason it does everywhere else in security. The cost of checking is measured in minutes. The cost of not checking is measured in however long it takes to work out what a compromised assistant actually had access to.
The Access That Outlives the Task
Overprovisioned access has been an identity and access management problem for as long as identity and access management has existed: a contractor keeps their login after the project ends, an old integration keeps its token after nobody uses it any more. AI agents inherit that exact problem and sharpen it, because the agent itself is now a party to negotiating how much access it asks for to complete a given task, and that negotiation is a target. A threat actor can skip breaking in and supply a plausible enough reason for the agent, or the person approving its request, to say yes to more than the task required.
Once granted, that access rarely gets revisited. Consent-based attacks exploit this gap. A Cloud Security Alliance research note from May 2026 says OAuth consent phishing bypasses multi-factor authentication, because the victim completes a genuine MFA challenge and then approves the malicious app's request, and that refresh tokens persist after a password reset. Microsoft describes these attacks as targeting users who can grant access directly, unlike credential compromise. The access is given once, by someone who never went back to check it was still needed.
Guardrails Only Stop the People Who Ask
Here is the part that gets missed. It would be easy to assume the fix is choosing an AI assistant with strict enough guardrails that it will never ask for anything as extreme as root access to your computer's operating system. That is an insane level of permission to hand to anything you do not trust absolutely, and no household assistant should be requesting it.
But the guardrails on any single vendor's product are close to irrelevant, because attackers have other options. In August 2025, NYU Tandon researchers built a proof-of-concept ransomware, in a lab, that had open-source AI models write its attack scripts on the fly. Open-source models lack the safety restrictions of commercial services. Software written with AI carries its own flaws too: Veracode's 2025 GenAI Code Security Report, which tested more than 100 models on 80 coding tasks, found that they chose an insecure method 45% of the time. A determined attacker does not need any mainstream AI system's permission to write something that asks for command-line or root access outright. Lock that capability down completely and a vendor mostly succeeds in frustrating its legitimate users, because the same tool can always be built to do most of the job through legitimate means and finished by hand by someone who already knows how. Guardrails stop the people who were going to ask nicely. They were never the problem.
What Fifteen Minutes Actually Buys You
The sensible response is to treat your AI assistant's permissions the way you would treat a member of staff who can let themselves into the house: something reviewed on purpose, on a schedule, rather than set once and forgotten. An AI assistant can often summarize what it has been granted and flag what looks unused, if someone asks it to and reads the answer.
That same discipline applies to a business handing more of its workflow to AI tools as much as it does to a household handing over more of its daily life. It is the same sprawl a Security Posture & Risk Review looks for on the business side, just with a different address book.
A Personal Cyber Exposure Review is where an actual look replaces a guess. It looks at what your household's connected accounts, devices, and assistants can currently do, and shows where you're exposed. If it has been longer than you can comfortably answer since anyone checked, that is the conversation worth having. Reach out, and let's find out what has actually been granted.