At Pwn2Own Ireland on October 6, 2026, security researchers demonstrated successful exploits against software used in AI environments. The event organizer, Zero Day Initiative, reported attacks against LiteLLM, Oracle Autonomous AI Database, and OpenAI Codex. One researcher combined input-validation and code-injection flaws to obtain a reverse shell on LiteLLM, giving the researcher remote command access in the demonstration. 

These were controlled security demonstrations. They do not establish that your company has been breached, that your AI application uses those products, or that attackers are exploiting the same flaws in business environments.

They do give business owners a reason to examine the software and connections supporting their AI tools.

An employee might use AI to summarize a document. Your company might also connect an AI application to Microsoft 365, customer records, an accounting system, or an internal database. That second arrangement requires decisions about access and security that a product demonstration may leave unanswered.

A provider may protect its platform while your organization controls the information and permissions you connect to it. Responsibilities depend on the product, deployment model, configuration, and agreement.

Microsoft’s AI agent shared responsibility guidance makes this distinction explicit. A ready-made service leaves the customer with responsibilities for configuration, identity, data access, and usage. Building a custom agent adds responsibilities for its tools, permissions, and application logic. The guidance describes operational responsibility; it does not replace contractual terms.

Consider a hypothetical sales assistant. You want it to summarize customer conversations and prepare follow-up drafts. During setup, someone authorizes an integration using an account that can also export the entire customer database or change records.

Your employee’s intended task is narrow. The integration’s actual authority is broader.

Choosing a reputable AI provider does not resolve that mismatch. Your team must review the connection and enforce the intended limits.

You do not need to operate a server room to have responsibilities here. Start by asking your technical team to map the components your company uses:

The scope varies. With a managed cloud application, the provider may maintain the underlying software. With a custom integration or a locally hosted system, your organization and its technical partners may have more to maintain.

Ask for a map of your implementation before buying a generic list of AI security controls.

Pwn2Own demonstrates software vulnerabilities. Excessive access creates a separate problem, even when software works as designed.

OWASP identifies excessive functionality, permissions, and autonomy as causes of excessive agency in AI applications. Its examples include a tool intended to read database information using an account that can also insert, update, and delete records. OWASP recommends restricting tool permissions and enforcing authorization in the connected systems. 

Microsoft provides another concrete example: incorrect Microsoft 365 Copilot connector permissions, including making content visible to everyone in the organization, can overshare sensitive information. Administrators need to validate the connector’s intended visibility.

Read-only access deserves scrutiny too. An application that cannot change a record may still retrieve information that the business did not intend to expose.

BizTek’s AI agent security guidance examines the controls for access and authority in more detail. For this infrastructure review, the immediate task is to locate each connection and identify who manages it.

“The vendor handles security” is too vague to guide a response when something goes wrong.

Use a responsibility record that separates business approval from technical work. The following is a starting point for discussion, not a universal assignment or a statement about your current service agreement:

One person may cover several roles in a small business. Still record each responsibility. Include backup coverage and identify work that nobody currently owns.

If your IT provider manages Microsoft 365 but did not build the AI integration, bring the implementer into the review. A working connection does not establish who will maintain its code, review its access, or respond to a vulnerability.

Choose one AI application connected to important company information. Ask its technical owner for a short review:

1. Show the access. Identify the account, connected systems, permitted actions, and information available to the application.
2. Show the maintenance owner. Identify who follows relevant vendor advisories and handles updates or configuration changes for each component.
3. Show the activity record. Confirm which actions produce logs and who reviews exceptions. Protect sensitive information within those logs.
4. Show the containment procedure. Explain how to stop the workflow and remove access. Test whether queued actions or other connected processes continue.

In its vulnerability management guidance, BizTek describes prioritizing weaknesses according to exposure, exploitation, and business impact. Apply that approach to the AI components your organization actually operates. A contest headline should trigger an applicability review, not an assumption that every AI tool requires the same emergency response.

BizTek Connection provides managed IT, cybersecurity, cloud, and Microsoft 365 services for small and midsized organizations. Those established service areas provide a starting point for discussing the systems and permissions surrounding an AI implementation.

For a Central Arkansas business adopting connected AI, the next step is to bring your IT provider and the application implementer into the same conversation. Define what the existing service agreement covers and where you need additional expertise.

Custom AI application testing, model-specific security work, and specialized infrastructure assessments may require a separate scope. Ask your provider to define the deliverables before treating them as included services.

Before your next AI connection goes live, ask: “Who is responsible for securing the path between this application and our sensitive information, and what evidence shows that the controls work?”

If that answer is unclear, contact BizTek Connection to discuss the connected systems, current responsibilities, and appropriate next steps.