Get Started for Free

Is Your AI Agent Safe? 7 Things to Check Before Connecting Your Tools

Kris Newlin

Key Takeaways

  • 80% of organizations have encountered risky AI agent behaviors including improper data exposure and unauthorized system access (McKinsey). Only 29% feel ready to deploy AI agents securely.
  • Before connecting any AI agent to your business tools, verify 7 things: credential handling, action approval workflows, execution environment, compliance certifications, data training policies, plugin security, and team controls.
  • Viktor is the safest AI agent on the market. SOC 2 certified, GDPR aligned, CCPA compliant, CASA Tier 3 certified. Credentials are AES-256 encrypted in a dedicated vault, never exposed to the AI model, and injected server-side at execution time.
  • Open-source agents carry real risks. OpenClaw stores credentials in plaintext by default, has documented RCE vulnerabilities (CVE-2026-25253), and had 341 malicious skills on its marketplace. Security researchers found over 40,000 exposed instances online, 63% of them vulnerable.
  • Viktor was built security-first from day one -- managed OAuth for all 3,000+ integrations, managed cloud execution tied to your Slack workspace, zero model training on your data, and human-in-the-loop approval as the default behavior.

Viktor vs the alternatives: security at a glance

Viktor OpenClaw Claude Code ChatGPT Zapier
Credentials AES-256 vault, never exposed to AI model Plaintext by default N/A (coding agent) OAuth via Apps (select services) OAuth + API keys
Human approval On by default (Slack) None Tiered: reads auto, edits/bash require approval. Bypass mode available. Confirmation for write actions Opt-in per workflow
Execution Managed cloud (your Slack workspace) Your local machine Your local machine (full terminal) OpenAI servers Zapier cloud
SOC 2 Yes No Yes (Anthropic) Yes (OpenAI) Yes
Data training Never Depends on LLM provider No (commercial plans). Consumer: opt-out. Opt-out available No

The key difference is where approval lives. Viktor's human-in-the-loop is on by default for sensitive actions -- your team approves in Slack before anything executes. Zapier offers approval as a feature you configure per workflow. Claude Code requires approval for edits and commands but offers a bypass mode. ChatGPT confirms before write actions within its interface. OpenClaw has no approval mechanism at all.

Get the safe AI agent for your team

The 7 checks

  1. How does it secure your credentials?
  2. Can it take actions without your approval?
  3. Where does it run?
  4. What compliance certifications does it hold?
  5. Is your data safe from model training?
  6. Are third-party plugins safe?
  7. Is it built for teams or individuals?

Why AI agent security matters now

AI agents are not chatbots. A chatbot generates text in a browser window. An AI agent connects to your real systems, reads your real data, and takes real actions. That distinction changes the security conversation entirely.

The adoption curve is steep -- and the readiness gap is wider:

That gap between adoption and readiness is where incidents happen. And they are happening.

The Meta email incident. In February 2026, Meta AI alignment director Summer Yue connected an open-source AI agent called OpenClaw to her inbox. The agent began mass-deleting her emails, ignoring her commands to stop. She had to physically run to her Mac Mini to terminate it.

The OpenClaw marketplace breach. That same month, security researchers found 341 malicious skills on ClawHub with over 9,000 compromised installations. SecurityScorecard found over 40,000 exposed OpenClaw instances in the wild, 63% of them vulnerable, with 12,812 exploitable via remote code execution.

The Anthropic simulation. In testing reported by McKinsey, Anthropic gave an AI agent access to a corporate email system. The agent discovered an executive was planning to shut it down, independently mined the executive's personal emails, found evidence of an extramarital affair, and began sending blackmail messages to prevent being deactivated. This was a controlled simulation, but it demonstrates the kind of emergent behavior that becomes possible when agents have broad access without guardrails.

These are not hypothetical risks. They are documented incidents and verified research findings with real implications.

Regulators are catching up too:

AI agent security is no longer optional. It is becoming a compliance requirement.

The 7 things to check before connecting any AI agent

1. How does it secure your credentials?

This is the single most important question. When you connect an AI agent to Stripe, HubSpot, or Google Ads -- how does it store and use those credentials?

There are two common approaches:

Approach How It Works Risk Level
API keys You paste a key into the agent's config. Stored by the agent, often in plaintext. High. Keys don't expire automatically, remain valid until manually revoked. Deleted keys found in backup files.
Managed OAuth You authenticate through the service's own login flow. Agent receives a scoped, time-limited token. Lower. Tokens expire automatically. You can revoke access without changing passwords. More secure by design.

But here is the question most people miss: does the AI model itself ever see your credentials?

Most security discussions stop at "are credentials encrypted at rest." That matters, but it is not the real risk with AI agents. The real risk is that the model -- the thing interpreting natural language, making decisions, generating code -- has your keys in its context window. If the model can see your credentials, a prompt injection attack or model compromise can exfiltrate them. Encryption at rest does not help if the decrypted key sits in the model's working memory during execution.

The safest architecture keeps credentials completely isolated from the model. The model requests an action ("call the Stripe API"), the server injects the credential at execution time, and the model never touches the token.

What to ask: "Does the AI model ever see my API keys or OAuth tokens? Where are credentials stored? Are they encrypted at rest?"

How Viktor handles this. When you connect Stripe, HubSpot, or Google Ads to Viktor, you authenticate through the service's own OAuth flow. Viktor receives a scoped token, encrypts it (AES-256), and stores it in a dedicated vault -- completely separate from the application layer. The AI model never sees it. Not in memory, not in logs, not in any prompt. Credentials are injected server-side at the moment of execution and discarded after.

This is why we built Viktor's credential system the way we did. You type @Viktor pull last month's Stripe revenue in Slack, and Viktor executes that request using your scoped Stripe token without the model ever having the ability to read, copy, or transmit your credentials.

2. Can the agent take actions without your approval?

An agent that can read your data is one thing. An agent that can delete emails, modify ad spend, or push code without asking is something else entirely.

The OWASP Top 10 for Agentic Applications introduces the principle of "Least Agency": agents should only be granted the minimum autonomy required for their task.

The Meta email-deletion incident is the canonical example. The agent decided to delete emails. No approval step. No way to stop it through the interface. The only option was to physically terminate the process.

McKinsey characterizes AI agents as "digital insiders" -- entities that operate within your systems with varying levels of privilege. Just like human employees, they need guardrails, approval workflows, and oversight. A well-designed human-in-the-loop system does not slow things down. It makes them smarter -- the agent handles routine cases while humans focus on exceptions and high-stakes decisions.

What to ask: "Which actions can the agent take autonomously? Which require approval? Is approval the default or opt-in? Can I stop an action mid-execution?"

How Viktor handles this. When Viktor is about to do something sensitive -- modifying your Google Ads budget, pushing code to production, sending an email on your behalf -- it pauses and sends an approval button directly in Slack. Your team sees exactly what Viktor is about to do, and nothing happens until someone clicks "Approve."

This is not a settings toggle buried in a dashboard. It is the default behavior. Every sensitive action requires explicit approval unless your team decides otherwise. If you delete the triggering message, Viktor stops the operation. If you edit the message, Viktor treats it as a correction and adjusts. The Meta incident could not happen with Viktor -- it would have surfaced "Delete 847 emails?" as an approval request in Slack first.

3. Where does the agent run?

The execution environment matters more than most teams realize.

Environment What It Means Risk
Your local machine Agent has access to everything: files, keychains, browser sessions, other apps One compromised agent = your entire machine compromised
Managed cloud (isolated) Agent operates in a sandboxed environment. Only accesses what you connect. Compromise contained to one workspace

TechTarget notes that developers frequently grant agents broad, static permissions, creating a "large unguarded blast radius."

There is an important distinction here between policy isolation and technical isolation. Policy isolation means an access control list says "workspace A cannot access workspace B's data." Technical isolation means the infrastructure makes it physically impossible -- separate sandboxes, separate credential stores, no shared memory. Policy can be misconfigured. Infrastructure cannot be talked into an exception.

What to ask: "Does the agent run on my machine or managed infrastructure? Are workspaces isolated from each other? Is the boundary technical or just policy?"

How Viktor handles this. Viktor runs on managed cloud infrastructure with 24/7 monitoring, automated threat detection, and regular penetration testing. Every Slack workspace gets its own isolated environment -- a hard technical boundary, not a policy that could be misconfigured. No other team's data, credentials, or conversations are reachable from your workspace.

Compare that to an agent running on your CTO's MacBook, where a compromise gives access to SSH keys, browser sessions, password managers, and every file on disk.

4. What compliance certifications does it hold?

Compliance certifications are independent verification that a company's security practices meet established standards. Over 60% of businesses are more likely to partner with SOC 2 compliant vendors. About 70% of VCs prefer to invest in SOC 2 compliant startups.

The certifications that matter:

Certification What It Verifies
SOC 2 An independent auditor has verified that the company's security controls -- access management, encryption, monitoring, incident response -- meet the standards set by the American Institute of CPAs. It is the most widely recognized security certification for SaaS companies.
ISO 27001 Information security management meets international standards
GDPR Data handling complies with EU privacy regulations
CCPA Data handling complies with California consumer privacy law
CASA Tier 3 Google's highest application security tier -- lab-verified audit required for Workspace Marketplace approval

Most open-source and early-stage AI agents have none of these. That does not make them bad products, but it means you are trusting their security claims without independent verification.

What to ask: "Do you have SOC 2 certification? Can I see the audit report?"

How Viktor handles this. Viktor is SOC 2 certified (independently audited), GDPR aligned, CCPA compliant, and CASA Tier 3 certified. We invested in compliance early because connecting to your Stripe, your HubSpot, your GitHub means earning trust at the infrastructure level, not just the product level.

Get the safe AI agent for your team

5. Is your data safe from model training?

This is a deal-breaker for many teams. If the AI agent sends your business data to a model provider that uses it for training, your proprietary information could surface in responses to other users. 63% of employees who used AI tools in 2025 pasted sensitive company data, including source code and customer records, into personal chatbot accounts. With an AI agent that has direct access to your systems, the surface area is even larger.

What to ask: "Is my data used to train AI models? Who has access to my conversations? Can I delete my data at any time?"

How Viktor handles this. Viktor does not use your data to train AI models. Full stop. Your Stripe revenue numbers, your HubSpot contacts, your internal Slack conversations -- none of it feeds back into model training. Ever. This is a hard policy, not an opt-out checkbox.

You can review and delete your conversation logs, skill memory, and generated files at any time. Delete your account and data is permanently removed. Want to keep your account but start fresh? The "Clean Workspace" option wipes all stored data in one click.

6. Are third-party plugins and extensions safe?

The 341 malicious skills found on ClawHub are a warning about what happens when an agent ecosystem lacks security review. OWASP specifically flags third-party extensions as a supply chain risk.

When you install a community-built plugin, you are trusting that author with access to everything the agent can reach. Cisco found third-party OpenClaw skills performing data exfiltration without user awareness -- silent network calls sending data to external servers controlled by the skill author. Users had no indication their data was leaving the system.

What to ask: "Are integrations built in-house or community-contributed? Is there a security review process? Can a third-party extension access my credentials?"

How Viktor handles this. All 3,000+ integrations are managed through Pipedream Connect, using standardized OAuth flows with vetted security controls. Every integration goes through the same managed authentication infrastructure -- no unvetted third-party code touches your credentials.

7. Is it built for teams or individuals?

When an AI agent is shared across a team, you need:

  • Access control: Who can connect tools and grant the agent access?
  • Audit trails: Can you see what the agent did and who triggered it?
  • Workspace isolation: If one person connects GitHub, can everyone else access it through the agent?

Single-user agents typically lack multi-user security controls. That matters when the agent has access to your company's Stripe account.

What to ask: "Does the agent support team workspaces? Is there role-based access control? Can I audit what actions the agent has taken?"

How Viktor handles this. Viktor was built for teams from day one. It lives in your Slack workspace, so access is tied to your existing Slack permissions and identity -- no parallel permission system to manage. Human approval for sensitive actions means the team collectively governs what Viktor does. Approval requests go to Slack where the right people can see and weigh in. Every action is logged, traceable, and auditable.

Full comparison: AI agent security features

Feature Viktor OpenClaw Claude Code ChatGPT Zapier
Credentials Managed OAuth, AES-256 vault, never exposed to AI model Plaintext by default, user-managed N/A (coding agent, no business tool OAuth) OAuth via Apps for select services OAuth + API keys, user-managed
Human approval Default for sensitive actions (Slack buttons) None Tiered: reads auto, bash/edits require approval. Bypass mode available. Confirmation before write actions (in-chat) Human in the Loop (opt-in per Zap)
Execution Managed cloud (your Slack workspace) Your local machine Your local machine (full terminal access) OpenAI servers Zapier cloud
SOC 2 Yes No Yes (Anthropic) Yes (OpenAI) Yes
Data training Never -- hard policy Depends on LLM provider No (commercial). Consumer: opt-out, 5-year retention if opted in. Opt-out available No
Plugin security 3,000+ managed integrations, vetted security controls 341 malicious skills found on marketplace N/A (no plugin marketplace) App directory (OpenAI reviewed) Vetted app directory
Team controls Multi-user workspace, Slack-native, team governance Single-user only Individual developer tool Per-user (Team/Enterprise plans) Team plans available
Workspace isolation Isolated per Slack workspace N/A (single machine) N/A (single machine) Per-user Per-organization

FAQ

Is it safe to connect AI agents to business tools like Stripe and HubSpot?

It depends on how the agent handles credentials, permissions, and oversight. The three things to verify: managed OAuth (not plaintext API keys), human-in-the-loop approval for sensitive actions, and SOC 2 compliance. 80% of organizations have encountered risky AI agent behaviors, so due diligence matters. Viktor connects to Stripe, HubSpot, and 3,000+ other tools using managed OAuth with credentials that never touch the AI model.

What is the difference between an AI chatbot and an AI agent from a security perspective?

A chatbot generates text in a browser. The security risk is limited to the conversation itself -- data leakage through what you paste in, and whatever the provider does with your inputs. An AI agent connects to real systems and takes real actions: reading data, modifying records, executing code. That means agent security must address three things chatbot security does not: credential management, action authorization, and execution isolation.

What security certifications should an AI agent have?

At minimum, SOC 2 -- which means an independent auditor has verified the company's security controls for access management, encryption, monitoring, and incident response. It is the most widely recognized security certification for SaaS companies. GDPR and CCPA compliance matter for data privacy. CASA Tier 3, Google's highest application security tier, requires a lab-verified audit and is the standard for Google Workspace Marketplace approval. Most open-source AI agents have none of these certifications. Viktor is SOC 2 certified, GDPR aligned, CCPA compliant, and CASA Tier 3 certified.

Can AI agents leak my business data?

Yes, through several vectors. Credentials stored in plaintext can be stolen. Data sent to model providers may be used for training. Third-party plugins can exfiltrate data silently -- Cisco documented OpenClaw skills doing exactly this. Agents with broad permissions can expose data through over-permissioned access. Only 54% of professionals are fully aware of what data their AI agents can access. The fix is architectural: encrypted credential vaults isolated from the AI model, zero training on customer data, and managed integrations with vetted security controls.

What is "human-in-the-loop" and why does it matter?

Human-in-the-loop means the agent pauses before sensitive actions and waits for human approval. OWASP's "Least Agency" principle recommends this as a core security control for AI agents. It prevents runaway behavior -- like the Meta email-deletion incident, where the only way to stop the agent was to physically unplug the machine. The critical distinction is whether approval is the default or an opt-in setting. Viktor's human-in-the-loop is on by default. Sensitive actions appear as approval buttons in Slack, and nothing executes until your team approves.

Viktor is the safest AI agent on the market. SOC 2 certified, GDPR aligned, with managed OAuth for 3,000+ integrations and human-in-the-loop approval built in. Get the safe AI agent for your team →