Two Ways to Hand AI Too Much

A coach I spoke with this week said they can spot the people who have handed their thinking over to AI.

That is one way to hand AI too much. There is another, and most people worry about only one of the two. The first group worries about what the tools can reach. The second worries about what people stop doing for themselves. I think both are the same mistake in two forms: handing AI more than you decided to hand it.

The first way: access

Connecting an AI to your email, your shared drive or your CRM takes one click. Deciding what it should be able to read, change or send takes a conversation that mostly never happens. So the click wins, and the decision stays blank.

This week gave a clear example. Two critical flaws turned up in PHP, the language that Wiz Research says powers roughly 70% of websites. They carry the identifiers CVE-2026-109618 and CVE-2026-109619. CISA says they allow remote code execution without logging in, and Wiz, who found them, rates the severity up to 9.2 and says nearly every PHP version of the last decade is affected. Wiz also says it used AI models in the discovery. Infosecurity Magazine reported that details leaked ahead of the scheduled patch. The BBC reports that websites have been taken offline and that attackers are using AI of their own against sites that have not updated. The BBC covered it.

A caution on what is settled. CISA, in its alert on Oct 21, said it had not observed exploitation as of publication, and Wiz’s write-up reports none. The BBC piece from the same day says attackers are already at work. Those are snapshots taken at different moments, and I would not say more than that. I have not seen a count of victims from any source.

I am not telling you AI broke PHP. I am pointing at the speed. When finding a flaw and using a flaw both get cheaper, the time between them shrinks, and “we’ll get to updates next month” stops being a plan.

For a 15-person company this lands differently than for a bank. A bank has a team whose job is this. You have a website somebody built three years ago, a hosting plan on a card, and a handful of AI tools that somebody connected on a Tuesday. Two questions follow, and I would be surprised if you can answer both.

Who patches my website, and how fast?

What can each of my AI tools read, and what can it change?

The second question is the one this article is about. A tool with read access to your whole inbox, or write access to your CRM, is a decision you made whether or not you made it on purpose. Nobody has to attack you for that to matter. A wrong guess by the tool, a mistaken click, or a connector with a bug is enough.

“With great power comes great responsibility.” The power is cheap now. The responsibility is a human job, and it has to be assigned to a person with a date, or it does not get done.

The second way: judgment

The coach I mentioned at the start made a point I had been circling for a while. They see people who have handed their thinking over. Every question, every business decision, every option gets run through an assistant first, and the person stops weighing consequences themselves. They see it as a real danger, and so do I.

Notice that this is also a form of access. The AI now reaches your judgment instead of your inbox. And the same rule applies: decide what it gets to touch.

What I suggested to them was a use I find helpful: ask AI to be a second perspective on your work.

When you are in the middle of a conversation, you are zoomed in. That is your job in that moment. But zoomed in means you miss things: a point the other person raised that you walked past, a question you never asked. It is why I like working with other people. I have my view, they have theirs, and we get further together than either of us would alone.

I use AI as a second perspective and reviewer. It can sit in that second chair. Give it the transcript and ask for an honest critique, no fluff. What did I do well? What did I miss? Where did I not follow up?

The bigger payoff comes with volume. Record or transcribe sessions one through ten, then ask it to look for patterns over time and for what changed. You will see some patterns yourself. I would bet it finds others you did not.

I also find that I can explore an idea far faster than I could even a year ago. The speed is useful, and the risk is that I stop checking. The way I keep myself honest is to treat the AI as a reviewer who has not earned the last word.

My own rule of thumb is simple, and I say it to my son too: keep improving your mind, or end up directed by the machine.

Why a policy alone will not hold

I talked this through this week on The Coffee Brief with John Matoso, a change consultant who works on the people side of rollouts. The full conversation is on LinkedIn: https://www.linkedin.com/events/7518347249932783617/.

Most companies reach for a policy and a training module first. John’s concern with that is simple:

“What’s the problem obviously with AI is that you can work with AI to break all of those rules and bypass them.”

He also said: “This is not something that you win through policies and training modules.”

John said a policy alone is not enough. His answer is literacy: he wants AI taught alongside math, language and financial literacy, at “equal footing.”

My take, and this part is mine and not John’s: literacy is what lets someone use the tool on purpose, which is the decision this article keeps coming back to. I connect his point to both halves. A policy only covers the access side, and the judgment side needs people who can think for themselves with the tool in front of them.

Three places this shows up in a 5 to 50 person company

This is where the abstract argument turns into something you can schedule.

Meeting and sales call reviews. Many firms record calls and never watch them. Run a week of sales calls through a general assistant and ask for the honest version: where did the prospect hesitate, what question did we skip, what did we promise that we cannot deliver? Do the same with internal meetings that keep running long. A second pair of ears is cheap now, and a manager rarely has the time to be it.

Decision logs. Pick the five most expensive decisions your firm made this year. For each, write down what you knew, what you chose, and why. Then ask an assistant to argue the strongest case against, using only what you wrote. Ask it what the decision looked like from outside. A log also gives you something to compare against later, so you learn whether your judgment is improving.

Onboarding. A new hire’s first month is a stack of questions they are embarrassed to ask. Give them an assistant loaded with your own playbooks, templates and examples, and tell them to ask it first. A general assistant already holds a lot of the common knowledge, so the cup is more than half full before you add anything. What it lacks is your specifics. The more of your own frameworks and past examples you hand it, the more it sounds like someone who has worked at your firm. Without them it answers like an average of everyone else.

All three share a design choice. The person stays responsible for the call. The AI sees the material, offers a view, and is allowed to disagree. Nothing in that chain lets it act on its own.

The access check, as a short routine

Every item above needs the access question answered first, because a reviewer that can also send email on your behalf is no longer just a reviewer.

For each AI tool in the company, write four things:

• What it can read
• What it can change or send
• Who approved that
• Who gets told when something looks wrong

Any blank is your starting point. Put a name beside it and a date.

Then split the tools into two groups. The ones that only look at material you paste in are reviewers. The ones connected to live systems are operators. Operators need a short rule, written down, about what they may touch. Reviewers mostly do not.

Try this week

• List every AI tool your team uses and fill the four lines above for each. Twenty minutes.
• If you run a website, ask your web person in writing: are we on PHP, and have we installed this week’s patch? Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA advises organizations on PHP 8.1 or earlier to take PHP-based systems offline until they are updated.
• Take one recorded call from this month. Ask an assistant for an honest critique with no fluff, and write down one thing you would not have caught yourself.
• Choose one decision from this year and ask for the strongest argument against it.
• Gather two or three of your own frameworks or playbooks. Give them to the assistant before your next review.

If you only do one, do the first.

Where I can help

Setting limits on what AI can reach, and building the habit of using it as a reviewer, is the work I do as a fractional CAIO for firms of 5 to 50 people. Here is how that works.