Software vendors are used to the risk of third-party integration and vetting of their own code, but increasingly the threat comes from AI tools their customers install. This blog covers how customer-installed AI agents, browser extensions, and plug-ins are expanding attack surfaces, and what software companies can do about it.
Introduction
Software vendors are accustomed to securing the perimeter of their platform — third-party integrations, API partners, and vendor code reviews — but a growing and hard-to-control risk has emerged with the AI tools your customers choose to install and connect to your software.
When a customer connects an AI agent, browser extension, or plug-in to your platform with an API key, and can call other tools, browse the web, or run code on its own, it is essentially part of the attack surface, whether or not you've approved the connection.
Why this risk is becoming harder to ignore
This concern has been heightened by the rise of AI models that are more capable of finding and exploiting vulnerabilities. OpenAI has publicized the reach of a model they found had reached a “Critical” cybersecurity capability threshold in their own safety framework, which could independently discover novel flaws and develop new exploitation methodologies against well-protected systems, using the right tools and access.
For software vendors, the lesson isn’t that any AI model is inherently dangerous, but that model capability now forms a variable on the opposite side of every integration a company has approved, and that variable can change frequently.
The access problem
An AI agent a customer connected months ago, using credentials that seemed reasonable at the time, may now be running a more capable model than when access was initially granted. The permissions haven’t changed, but what the tool is capable of doing with them has increased substantially.
This echoes broader findings from security researchers about prompt injection attacks — malicious content injected into content an AI tool processes can bypass traditional defenses like firewalls and endpoint protection entirely, because they were designed to operate against software using fixed code, not natural-language instructions from whatever it reads.
Traditional security reviews don’t account for this
Most vendor security processes focus on code reviews, dependencies, and direct integration partners, and aren’t designed to account for an unknown AI tool a customer connects to a platform independently, especially one that can act autonomously across multiple systems. Recent industry findings suggest the majority of AI tools in use today in enterprise aren’t formally tracked or managed by security or IT teams at all, leaving a critical blind spot in most organizations’ risk modeling.
What software companies can do
- Treat API access as a living risk, not a one-time approval, and revisit what connected tools can access regularly.
- Scope permissions tightly to grant the minimum access needed rather than open, standing credentials.
- Monitor for irregular behavior, which may indicate misuse even if an integration appears legitimate.
- Educate customers that connecting a capable AI agent can expand their vendor’s attack surface, not just their own, and build incident response plans that account for AI-specific attack patterns, since these tend to take on different risk profiles than traditional breaches.
The bigger picture
AI adoption is continuing to accelerate, and neither is the sophistication of the models customers are connecting to third-party platforms. The vendors that are staying ahead of this risk are beginning to treat AI integrations as an ongoing conversation, rather than a task they complete during onboarding.
FAQs
1. How can a customer’s AI tool become a security risk for a software vendor?
When a customer connects an AI agent or plug-in to a platform using API access, and the tool can act autonomously, it extends the vendor’s attack surface regardless of who installed it.
2. Why is this risk increasing now?
AI models are becoming much more capable of discovering and exploiting vulnerabilities, which means the risk posed by any particular integration can increase over time.
3. Do traditional security reviews catch this kind of risk?
Not typically, because they’re focused on code and direct vendor integrations, not third-party AI tools that customers may connect independently to a platform.
4. What steps can software companies take to reduce this risk?
By regularly reviewing what connected AI tools can access, scoping permissions tightly, monitoring for irregular behavior, and educating customers about the risk.
5. Is this risk limited to large enterprises?
No, because any software vendor that offers API access or integrations is potentially exposed regardless of size.
