On Thursday morning, I nearly handed client files to an autonomous AI assistant
Last Thursday at 10 a.m., I was updating a client quote in a Hangzhou café while my AI assistant organized my documents. I casually switched on “automatic processing,” and it began scanning the entire shared drive. Then I wondered: why did it have access to all those files? I’d gotten stuck here before too—saving a few minutes often made me forget to check permissions. The bigger issue was the report that AI agents had found 948 Linux security vulnerabilities. That news doesn’t mean my computer will be compromised tomorrow, but it reminded me that an AI agent that can do the work shouldn’t have unlimited permissions.
For small teams, the relevant part isn’t the vulnerability count
A November 5 AI roundup said OpenAI had reported AI agents discovering 948 Linux security vulnerabilities; Anthropic investigated abnormal cell granules; Apple cut employee AI budgets; and Meta acquired code-tool company Conductor. We could chase every item, but what matters most to freelancers is “agent permissions.” Take Lin Yue, a designer in Beijing. After connecting an AI agent to her asset library, she restricted it to reading only designated project folders. Every evening before exporting files, she clicks through a manual confirmation. She says, “It isn’t much slower, but I sleep better.” If I use AI to organize contracts, email, or code, I look at what it can see before what it can do for me.
Replicating this safer setup costs very little
Money: 0 yuan; I can start with an existing account by auditing permissions. Time: 30 minutes to check every connected tool. Technical barrier: no coding knowledge required, but I need to find the “permissions, connections, shared files” settings. First step: open the settings page of the AI tool I use, find “connected files, apps, or accounts,” and save a screenshot. Then revoke unnecessary access one by one. If I can’t understand a description, I can contact the platform’s support team, send them the permissions screenshot, and ask for help. I keep manual confirmations, especially for contracts, quotes, client lists, and payment details.
Here’s how I’d handle it at each stage
If I’m just starting out: I’d use AI only for public material and drafts, keeping original client files in a separate folder. I wouldn’t rush to grant access to my email or cloud drive. If I already have one or two clients: I’d create a “client data whitelist,” open only the current project, and set one rule—every send, delete, or payment requires a manual click. If I’m scaling: I’d add permission checks to onboarding and tool-change workflows, then review agent accounts every quarter. Not everyone needs this setup, and nobody has to replace tools today. But the next time I connect a new tool, spending 30 minutes checking permissions will be less of a headache than cleaning up the damage later.