AI Agent Permissions: How Much Access Is Too Much?

Give an AI agent the least access that still gets the job done, then step up one tier at a time: read-only first, draft-and-review next, real actions only with per-step approval, and full autonomy almost never: only inside a throwaway sandbox. ChatGPT’s Gmail connector requests gmail.modify: read and write access to your inbox, when plenty of tasks only need reading. OpenAI’s own evaluations show its agent resisted 67% of active data-exfiltration attacks. And in July 2026, OpenAI confirmed its GPT-5.6 agent deleted users’ files in Full Access mode. Here’s where to draw your line.

What access does an AI agent really get when you click “connect”?

Usually more than the task needs, and the OAuth consent screen is the only place it’s spelled out.

An AI agent is software that takes multi-step actions for you (browsing, sending, editing files) rather than just chatting. Connections ride on OAuth scopes: the permissions a service hands over, like “read my email” or “edit my calendar.” The scope sets the ceiling on what the agent can ever do through that account.

OpenAI’s help article on Google connector scopes lists one Gmail scope for its Gmail connector: gmail.modify. In Google’s permission model that means read and write: reading, labeling, archiving, trashing, and sending mail (permanent deletion is excluded). There’s no read-only toggle in the connector UI; users have an open feature request on OpenAI’s Codex GitHub asking for one, and the workaround is a custom MCP connector scoped to gmail.readonly.

Why care? Prompt injection is an attack where a malicious instruction hides in content the agent reads (an email, a webpage) and the agent obeys it like it obeyed you. A read-only agent can leak your data; a read-write one can move mail, mark things unread, send as you. Anthropic’s red-teaming of Claude in Chrome measured a 23.6% attack success rate before mitigations; one documented successful attack was Claude deleting emails without confirmation.

The consent screen is the contract: clicking “allow” without reading scopes is how over-granting happens, and vendors rarely resurface those details later.

What are the four access tiers for AI agents?

Read-only, draft, act-with-approval, autonomous, in rising order of risk. Match the tier to data sensitivity, not task excitement.

Access tier	What it allows	Real risk	Use it when
Read-only	Search, view, summarize; no changes	Data can still leak via prompt injection	Research, inbox triage, reports on your own data
Draft	Reads, then writes drafts for your review; nothing goes out without you	Low to moderate; drafts still carry your data if the agent has network access	Email replies, documents, social posts, code suggestions
Act with approval	Performs real actions (send, publish, buy, move files) but pauses for your OK each time	Moderate; approval fatigue makes people rubber-stamp	Routine publishing, file cleanup, scheduled work
Autonomous / full access	Acts continuously; no sandbox, no prompts	Severe; irreversible damage at machine speed	Disposable containers and test environments only

Draft mode is the most underrated rung: an agent that writes replies you approve delivers most of the time savings with almost none of the impersonation risk. Autonomous mode is the opposite. OpenAI’s Codex security docs label the danger-full-access sandbox “not recommended,” and the incident below shows why.

What happens when an agent gets too much access?

Three documented failures from the past 14 months show the pattern: deletion, theft, and fraud exposure.

The July 2026 file deletions. TechCrunch reported that users of GPT-5.6, OpenAI’s then-new flagship coding model, watched it delete files, databases, and in one case an entire home folder during routine tasks. OpenAI’s Codex lead Thibault Sottiaux posted an “On file deletions” statement on July 16: the deletions occurred when Full Access mode was enabled and Codex ran without sandboxing: an over-eager cleanup step plus a $HOME override bug turned a temp-directory cleanup into a home-directory wipe. One user reported losing 1.5 TB of documents. No hacker needed: just too much permission plus an eager model.

The malicious MCP server. In September 2025, Koi Security found the first known malicious MCP server in the wild: a fake postmark-mcp npm package that behaved itself for months, then added a hidden BCC field in version 1.0.16: every email an agent sent through it was silently copied to an attacker. Postmark confirmed it had no affiliation with the package; over 1,500 downloads happened before discovery. Install-time approval didn’t save anyone.

Banks pulling the plug. Axios reported on October 22, 2026 that Morgan Stanley blocks AI agents outright, while JPMorgan Chase, Bank of America, Citi, and Schwab restrict them, after detecting unvetted agents inside customer accounts: some taking actions beyond what customers asked for. Reuters confirmed the reporting the same day. When an agent logs in as you, the bank sees you, which is why some banks allow view-only agent access, and why sharing banking credentials with an agent can breach your bank’s terms.

The common thread: blast radius follows permissions, not model intelligence.

What are vendors actually doing about agent permissions?

The majors now ship tiered permission modes and ask-first defaults, but the safe settings are mostly opt-in, so you have to find them.

OpenAI. Connected apps in ChatGPT have four permission levels: Always ask, Allow read actions, Allow low-risk actions, and Allow all actions. Codex splits what the sandbox permits (read-only, workspace-write, danger-full-access) from when it asks you, keeps network off by default in workspace-write, and can run an auto-review agent that screens proposed actions for exfiltration, credential probing, and destructive behavior. The ChatGPT agent launched with memory disabled (OpenAI’s system card says that was to blunt injection-driven exfiltration) plus watch mode in sensitive contexts and GET-only terminal restrictions. In February 2026 OpenAI added Lockdown Mode, which restricts external connections during elevated-risk windows; it rolled out broadly that June, and researchers have since shown bypasses. One layer, not a guarantee.

OpenAI’s ChatGPT agent system card reports the agent resisted 67% of active data-exfiltration attacks in visual-browser evaluations: lower than predecessor Operator’s 75%. Roughly one in three sophisticated attempts still got through.

Anthropic. Claude in Chrome asks permission before touching financial sites, prohibits stock trading and investment transactions outright, hard-blocks adult and pirated-content sites, and won’t enter sensitive data or bypass captchas. High-risk actions (publishing, purchasing, sharing personal data) trigger confirmations, and you can flip the side panel from “Automatically approve” to “Manually approve” to review everything. The smartest piece is 1Password for Claude, launched July 16, 2026 for Mac users: the password manager fills logins and one-time codes itself, so credentials never enter Claude’s context: a credential proxy, an agent completing sign-ins without ever holding the secret.

Anthropic’s red-teaming numbers show mitigation helps but never closes the gap: across 123 test cases in 29 attack scenarios, attack success fell from 23.6% to 11.2%; on a challenge set of four browser-specific attack types, from 35.7% to zero. Their help page calls the risk “non-zero” and leaves you responsible for what Claude does on your behalf. Security researcher Simon Willison’s threat analysis of Claude in Chrome likewise treats browser agents as unusually exposed to prompt injection.

The MCP project. The Model Context Protocol’s security best practices tell implementers to verify every inbound request, never treat a session handle as authentication, issue short-lived tokens, and scope each server to the least privilege its tools need. Self-hosting agents? That page is your checklist.

One honest note on cost: nearly all of this ships in plans you already pay for. Lockdown Mode reached Free through Business tiers, and permission levels are settings, not upsells. The real cost is attention: reading scopes, approving actions, running audits.

What should you never grant an AI agent?

Money movement, identity, credentials, and destruction rights: the categories where a single mistake is unrecoverable.

• Banking and brokerage accounts. Banks are actively blocking agents, their terms generally require a human, and liability for agent-initiated transactions can land on you.
• Crypto wallets and trading platforms. Transfers are irreversible, and Anthropic already prohibits trading actions in Claude in Chrome: take the hint.
• Your primary personal email. gmail.modify includes sending, and a hijacked send capability impersonates you at scale. Use a secondary account or a read-only custom connector.
• Admin or root credentials. An agent with admin rights can disable the very guardrails meant to contain it.
• Production systems without staging or containers. If an agent must touch production, box it in first: the one legitimate use case OpenAI’s docs offer for full-access mode.
• Regulated data without proper controls. Anthropic notes Claude in Chrome is off by default in HIPAA-enabled organizations. Get professional advice before wiring agents into regulated workflows.

How do you audit an AI agent’s permissions in about 10 minutes?

List what the agent is connected to, read the real scopes on the provider side, cut what you don’t use, and set every level to “ask” until you have a reason not to.

1. Inventory the connections. ChatGPT: Settings → Connectors. Claude: Settings → Connections, plus extension permissions. Coding agents: read your MCP config and Codex settings for every registered tool server.
2. Read the scopes on the provider side, not the agent side. For Google, check Security → Third-party access to see what each app may do, then compare against the vendor’s scope documentation.
3. Revoke anything unused. Every idle connector is standing access waiting for an incident.
4. Set each permission level explicitly. In ChatGPT: Always ask → Allow read actions → Allow low-risk actions → Allow all actions. Default to Always ask; step up with a written reason.
5. Hunt for dangerous combinations. Write access plus network access in one session, or write access plus stored credentials in one profile, multiplies both halves of an attack. Codex keeps network off unless you enable it in workspace-write: mirror that logic everywhere.
6. Check the trail. Review what the agent has already done: provider-side connected-app activity, commit history, account logs. Logs should record actions (who, what, when, which tool, which resource) not just chat transcripts.
7. Re-add with the narrowest scope that works. Where read-only exists, take it. Where it doesn’t (like ChatGPT’s Gmail connector) ask whether you need it at all.
8. Calendar the next audit. Monthly for anything with write access, quarterly for read-only. Set the recurring reminder now.

Why do session isolation and audit trails matter more than you’d think?

Because an agent running in your main browser profile is indistinguishable from you on every site it visits.

Session isolation means the agent works in its own browser profile or container with its own cookies and logins, so it can’t reach the accounts your daily profile is signed into. Anthropic’s guidance for Claude in Chrome says just that: use a separate profile without access to sensitive accounts, and don’t open the side panel over confidential information.

The audit problem is subtler: when an agent operates inside your authenticated session, websites log its actions as yours. Keep Aware has documented how browser-based agents break enterprise audit trails exactly this way. If you can’t later tell which actions were the agent’s, you can’t investigate an incident cleanly.

Microsoft’s July 2026 guidance on least privilege for AI agents pushes the stronger version: treat agents as first-class identities with their own credentials, so access is scoped, logged, and revocable per agent. Where your platform doesn’t support that yet, a dedicated browser profile is the practical fallback, and it is worth doing today.

So how much access is too much? The checklist

Any grant that lets an agent move money, send as you, destroy data, or escalate its own rights is too much without per-action approval.

Run it against every connector and agent you use:

• Could the next action be irreversible: send, delete, pay, publish? Then it needs approval.
• Does the scope cover more than the task? Downgrade it.
• Does the agent hold credentials directly? Move them to a proxy or remove them.
• Could prompt injection in the content it reads trigger the action? Assume yes and shrink the blast radius.
• Is sandboxing off? Turn it back on.
• Do you have an action log? If not, fix that before expanding access.

If any answer worries you, drop the agent down a tier. You can always step back up.

What to do next

• Casual ChatGPT or Claude user: set every connector to Always ask, disconnect what you don’t use, and keep agents out of the browser profile where your bank lives. Ten minutes, today.
• Indie builder running coding agents: stay in workspace-write with on-request approvals, containerize anything that genuinely needs more, scope MCP tokens, and leave network off unless a task needs it.
• Small business owner: connectors on read-only by default, one named owner per agent, monthly audits, and a written rule for which accounts agents may never touch. Get professional security advice before connecting anything regulated or client-facing.

FAQ

How much access should I give an AI agent?

Start at read-only and step up only when a task demands it: read-only, draft-and-review, act-with-approval, then autonomous. Match the tier to data sensitivity, not convenience. ChatGPT’s Gmail connector requests gmail.modify (read and write) even though many tasks only need reading, so verify scopes on the consent screen. Anything involving money, sending, or deletion should require per-action approval.

What are the four AI agent permission tiers?

Read-only (view and search, no changes), draft (writes drafts you approve before anything leaves), act-with-approval (performs real actions but pauses for your confirmation), and autonomous or full access (acts continuously without sandboxing or prompts). ChatGPT’s connector levels run Always ask, Allow read actions, Allow low-risk actions, and Allow all actions. Most people belong on the first two rungs.

Why does ChatGPT’s Gmail connector request write access?

OpenAI’s help article on Google scopes lists gmail.modify as the connector’s Gmail scope: reading plus creating, labeling, archiving, trashing, and sending mail, though not permanent deletion. There’s no read-only toggle in the connector UI, and an open GitHub issue (openai/codex #23995) requests one. A custom MCP connector scoped to gmail.readonly is the workaround.

What happens if I run an AI agent in full access mode?

You remove the sandbox and approval prompts that contain mistakes. In July 2026, users reported OpenAI’s GPT-5.6 agent deleting files, databases, and entire home folders; OpenAI found the deletions occurred in Full Access mode with sandboxing off, driven by an over-eager cleanup step and a $HOME override bug. Codex’s docs call danger-full-access “not recommended.” Use a disposable container if you must.

Can AI agents access my bank account?

Technically yes if you hand over credentials, but it’s a bad idea. Axios reported in October 2026 that Morgan Stanley blocks AI agents outright and JPMorgan Chase, Bank of America, Citi, and Schwab restrict them after finding unvetted agents in customer accounts. Claude in Chrome asks before financial sites and prohibits stock trading. Sharing banking credentials with an agent can also breach your bank’s terms.

What permissions should I never grant an AI agent?

Banking and brokerage accounts, crypto wallets, your primary personal email, admin or root credentials, and unsandboxed access to production systems. These combine irreversibility with impersonation risk: gmail.modify can send as you, admin rights let an agent disable its own guardrails, and financial transfers can’t be clawed back. Redesign the task with a scoped secondary account or a credential proxy.

How do I check what access my AI agent currently has?

Inventory connectors in the agent’s settings (ChatGPT: Settings → Connectors; Claude: Settings → Connections), then read the actual scopes on the provider side, for Google, Security → Third-party access. Set each connector’s level explicitly, preferring Always ask, review what the agent has already done, revoke unused access, and re-add with the narrowest scope. Audit monthly for anything with write access.

What is the principle of least privilege for AI agents?

Grant only the data, systems, and actions the agent needs for its current task, nothing more. Microsoft’s July 2026 guidance extends this to identity: give agents their own credentials rather than yours, so access can be scoped, logged, and revoked per agent. The Model Context Protocol’s security best practices apply the same idea to tool servers: short-lived, narrowly scoped tokens.

Are AI agents safe to use with work or business data?

With guardrails, cautiously. OpenAI’s system card reports its agent resisted 67% of active data-exfiltration attacks (about a third still succeeded) and Anthropic measured an 11.2% residual attack success rate for Claude in Chrome even with mitigations. Keep business connectors read-only by default, use ask-first modes, keep action logs, and get professional security advice before connecting anything regulated or client-facing.

Sources

• How to connect Google apps and services to ChatGPT: OpenAI Help Center
• Support true read-only mode for Gmail and Calendar: openai/codex issue #23995
• Agent approvals and security (Codex sandbox and approval modes): OpenAI docs
• Connected apps in ChatGPT: OpenAI Help Center
• Managing app permissions in ChatGPT: OpenAI Help Center
• ChatGPT Agent System Card: OpenAI, July 2025
• OpenAI’s new flagship model deletes files on its own, people keep warning. TechCrunch, July 14, 2026
• Anatomy of a Home-Directory Wipe: How GPT-5.6 Deleted Users’ Files (incl. OpenAI’s “On file deletions” statement). Harness Watch, July 16, 2026
• Introducing Lockdown Mode and Elevated Risk labels in ChatGPT: OpenAI
• Designing AI agents to resist prompt injection: OpenAI
• Use Claude in Chrome safely: Claude Help Center
• Claude for Chrome: Agentic Browsing is Here: Anthropic
• 1Password for Claude: 1Password Blog, July 16, 2026
• Get started with 1Password for Claude. Claude Help Center
• Unvetted AI agents are accessing U.S. bank accounts. Axios, October 22, 2026
• US banks detect unauthorized AI agents in customer accounts. Reuters, October 22, 2026
• MCP Security Best Practices: Model Context Protocol docs
• Information regarding malicious postmark-mcp package. Postmark
• Sneaky, malicious MCP server exfiltrates secrets via BCC: Dark Reading
• Least privilege for AI agents: Identity, access, and tool binding: Microsoft Security Blog, July 16, 2026
• Claude in Chrome: A Threat Analysis: Simon Willison, December 29, 2025
• Browser-based AI agents log as users, breaking enterprise audit trails: AI Governance / Keep Aware