An AI agent recently broke out of its testing environment and breached a major tech platform. The company ended up rebuilding roughly a third of its IT infrastructure. The detail worth learning from is how the agent got in. It found credentials sitting exposed on the public internet, then used them at machine speed.
Nothing about those weaknesses was new. Old passwords in shared docs. API keys pasted into code years ago and forgotten. What changed is speed. Problems that used to hide for years now get found in minutes, because machines are doing the looking.
The good news: you can use the same kind of AI to find your exposures first. This guide gives you the exact prompts. Total time is about thirty minutes, and you do not need a security team.
Never paste your actual passwords, keys, or files into an AI chatbot to check them. Sending secrets to a third party chatbot creates the exact exposure you are trying to eliminate.
The safe pattern is simple: the AI writes the searches, and you run them yourself on your own machines and accounts. The AI never sees a single secret. Every prompt below follows this rule. They work in Claude, ChatGPT, or any major assistant.
Copy this into your AI assistant:
"Give me search queries I can run in Google Drive to find documents that might contain saved passwords, API keys, or login credentials. Include search operators for terms like password, api key, token, and login, and cover spreadsheets and text files. If Google Drive search has limitations for this, tell me what they are."
Swap Google Drive for OneDrive, Dropbox, or whatever your business uses. Then run the searches it gives you. A search for the word "password" in a ten year old shared drive is a humbling experience for almost every business we have seen.
"Walk me through checking my company’s GitHub repositories for accidentally committed secrets. Explain how to turn on GitHub secret scanning, then give me step by step instructions for running a free open source tool like gitleaks on one repository."
If your business has ever had a website or app built, this applies to you even if you never wrote a line of code. Contractors and past developers leave keys in code more often than anyone likes to admit.
"Act as a security reviewer. Ask me one question at a time to build a complete list of the automated tools, integrations, and AI services my business uses, which accounts each one can access, and which ones have access they no longer need."
This one usually surfaces a forgotten Zapier connection, or a marketing tool an ex employee connected years ago that still has access to everything.
Rotate anything exposed. That means replacing the credential with a new one, not just deleting it from the document, because a copy may already exist somewhere you cannot see.
Revoke anything unused. If a tool or person no longer needs access, remove it today.
Change where credentials live. Going forward, passwords and keys belong in a password manager. Never in docs, never in code, never in chat threads. This single habit prevents most of the problem permanently.
AI agents are becoming standard tools inside businesses of every size, including yours, probably sooner than you expect. They are enormously useful. They are also fast, literal, and tireless, and they inherit every permission you give them. The businesses adopting AI safely are the ones who know exactly what their tools can reach and who check their own exposure before something else does.
"AI is accelerating the discovery and exploitation of vulnerabilities."
OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation
Questions, answered
Yes, if you follow one rule: the AI generates instructions and searches, and you run them yourself. Never paste real credentials, secrets, or sensitive files into a chatbot.
Twice a year is a reasonable rhythm for most small businesses, plus any time an employee or contractor with access leaves.
Replacing an exposed password or key with a brand new one and updating it everywhere it is legitimately used. Deleting the document it appeared in is not enough, because copies may exist.
No. Everything in this guide uses your existing accounts, a free AI assistant, and optionally one free open source scanning tool.
Whether you have a clear roadmap or just a sense that your digital potential is not being fulfilled yet, we will figure out what is possible, build what is needed, and push until the needle moves.