AI agents on work laptops: what can they reach?

Obsidian Ridge offers the assessment described below and is a Huntress partner. Huntress supplies the cited malware-defense recommendations; the agent-permission guidance draws on OWASP, a security standards community, and our practical review process.

Short answer: An AI agent's granted tools and accounts determine whether it can read files, send email or execute commands. It does not automatically inherit every user permission. Review installed agents, their access and required approvals. OWASP excessive-agency guidance.

Key facts

• Can an agent reach everything? Not automatically; inspect granted access. OWASP, checked October 23, 2026.
• Separate actions: Restrict functions and permissions to the approved task. OWASP, checked October 23, 2026.
• Consequential actions: OWASP recommends human approval for high-impact actions and authorization checks outside the model. OWASP, checked October 23, 2026.
• Computer defenses: Huntress recommends computer restrictions and staff reporting for AI-themed lures. Huntress overview, checked October 23, 2026.
• Assessment scope: Our service examines device AI tools, accessible data and systems, and risky actions. Scope checked October 23, 2026.

What should we ask before approving an AI agent?

Ask what the agent can do without another person saying yes. Our recommended review starts with the business task, then lists the access needed for that task. Avoid granting broad access simply because a setup guide offers it.

For a document-drafting task, ask which folder the agent needs to read. For an email task, distinguish preparing a draft from sending it. For a computer-maintenance task, ask whether it can run commands and which account executes them. These are examples for the review, not claims about every agent product.

Record the person who approves each permission and the reason for it. If the answer depends on a setting or license, capture that dependency. An owner should be able to understand the decision without reading a terminal transcript.

How do we map what an installed agent can reach?

List the local permissions, connected accounts and allowed tools separately, then have the administrator verify them. Our recommended worksheet separates the intended use from the observed capability.

Use invented documents and a controlled test account for demonstrations. Do not make a real payment, send a real client message or delete a working file just to prove that the agent can do it.

Mark unavailable evidence as unknown. If an agent connects to a service account with separate access, include that account in the review. A screenshot showing the employee's ordinary desktop permissions is not enough to explain every connected service.

Which controls should our IT provider check?

Start with the granted access and required approvals, then check the computer's defenses against malicious instructions and installations. Our recommendation is to give these as acceptance questions to the provider, not as settings an office manager should change unaided.

Huntress's recommendations for AI-themed malware lures support this checklist:

• Clipboard scripts: Restrict scripts copied from untrusted instructions.
• Approved applications: Define which applications may run.
• Scheduled tasks: Watch for programs scheduled to run later.
• Antivirus exclusions: Watch for newly skipped files or locations.
• Staff reporting: Train staff to recognize and report copy-and-paste lures, called ClickFix.
• Ads: Use ad blocking to reduce exposure to malicious sponsored results.

Huntress's published recommendations.

For the agent itself, have the administrator show which meaningful actions need approval. Ask what the approval screen reveals, who is allowed to approve and what record remains. An approval step is useful only when the person can understand the proposed action.

What should we do about an agent with too much access?

Reduce the access through the normal change process after confirming what work depends on it. Our suggested sequence is to pause unapproved use, name the business owner, decide the minimum needed access, test the revised setup and record the result.

Do not describe an agent as safe merely because it can only read. Decide whether the information it can read is appropriate for the approved task and destination. Likewise, a permission to send messages or execute commands needs an explicit reason and a tested approval path.

If there is evidence of suspicious activity, involve the IT provider before changing or deleting the evidence. The inventory and permission review are useful background for that response; they do not establish what happened on their own.

Where should an owner start if the inventory is missing?

Start by identifying the installed tools and responsible accounts. Ask employees about their work, then verify the devices and access the business has agreed to review. Keep a list of unverified devices or accounts alongside the findings.

The assessment below is a defined starting point for that review. It provides findings and recommended fixes for the business to consider. Agree the coverage before work starts, and keep follow-up implementation distinct from discovery.

Sources

• OWASP excessive-agency guidance: functions, permissions, approval and authorization boundaries.
• Huntress AI attack surface overview: malware-defense recommendations.
• Obsidian Ridge assessment scope: approved offer. Sources checked October 23, 2026.

Related reading

• Is it safe to run a Terminal command ChatGPT gives you?
• How to stop employees pasting client data into ChatGPT
• What AI tools are my employees using? How to find out
• Fake AI app downloads: how to spot a poisoned Claude or ChatGPT ad
• Compare AI security assessments
• Write an AI usage policy