High SeverityData ExposureMarch 10, 2024

AI Email Agent Sends Confidential Data to Wrong Recipients

An AI email assistant autocompleted recipient addresses incorrectly, sending confidential financial documents to external parties not authorized to receive them.

System Type:Email Assistant

What Happened

An executive assistant AI was deployed with email capabilities to help manage correspondence. When asked to send quarterly financial reports to 'the board,' the AI autocompleted email addresses based on historical patterns. However, the AI included former board members who had been removed from the authorized distribution list, as well as a journalist who had previously corresponded with the company. Confidential pre-announcement financial data was sent to unauthorized recipients.

Root Cause

Recipient autocompletion was based on historical email patterns without access to current authorization lists. No verification step existed for sensitive document distribution. The AI lacked context about document classification and corresponding recipient restrictions.

Impact

Confidential merger documents exposed to unauthorized parties. Legal review initiated for potential securities violations. Emergency communications to recipients requesting document deletion. Potential insider trading implications requiring SEC notification.

Lessons Learned

  • 1AI email systems need access to current authorization data, not just historical patterns
  • 2Sensitive document distribution requires explicit recipient verification
  • 3Classification-aware policies should restrict distribution based on content sensitivity
  • 4Historical patterns can encode outdated access permissions

Preventive Measures

  • Integrate authorization systems with AI email tools
  • Require explicit confirmation for external recipients
  • Implement document classification-based recipient restrictions
  • Add warnings when recipients differ from recent authorized patterns

How Runplane Would Handle This

Runplane would intercept the email send action and verify each recipient against the current authorized list for documents of that classification. External recipients or removed board members would trigger a block, with the action routed to the executive for manual verification. The email would only send after explicit confirmation that all recipients are authorized.