Judging an AI vendor's security without a security team

You are one person, or five. There is no security team, no procurement checklist, and no lawyer who reads terms of service for a living. What there is: a folder of client work that would be genuinely bad to lose, and six or seven AI tools holding some piece of it. A chat assistant that has read your contracts. An automation in Zapier or n8n that moves invoices between an inbox and a spreadsheet. A coding agent with a token that can push to your repository. When one of those vendors publishes a page about its security posture, you cannot audit it and you have no leverage to ask for more.

OpenAI hosts an open letter calling for collective action on cyber defense, and its first-day signatories include Anthropic, AWS, Cloudflare, CrowdStrike, Google, Hugging Face, Microsoft, Oracle and Perplexity [1]. It binds nobody and creates no obligation. It is still worth ten minutes of your time, because it is the clearest public statement of what your own vendors think everyone else should be doing, and most of the work it describes sits on your side of the line rather than theirs. This guide covers the three vendor facts that are genuinely checkable and the handful of settings that matter more than any vendor’s answer. It is not for anyone who has a compliance function, a certification of their own, or a regulator to satisfy. Those readers need a real vendor risk process, and a guide is a poor substitute for one.

The asks aimed at every organization are the short version of the job

The letter organises itself around three principles: “Recognize that status quo security won’t be enough,” “Empower more defenders with cyber-capable AI,” and “Mobilize a collective response” [1]. Read past the framing and it splits its requests by audience. Governments are asked to coordinate cyber defense at local, national and international levels and to fund cyber defense for essential services. Cybersecurity companies are asked to share threat intelligence and playbooks, and to measure progress by how many organisations get protected and how fast attacks are contained. Frontier AI companies are asked to “Provide responsible model access, significant funding, training, and hands-on support,” to “ensure agentic identities are traceable and accountable,” and to share best practices in continuous monitoring alongside tools, playbooks and credible threat assessments [1].

The section addressed to every organization is the one that concerns you, and it is short. Make cyber defense an immediate leadership priority. Fix the highest-risk weaknesses. Upgrade or replace systems to build in “least privilege, strong access controls, and defense in depth.” Use “capable, lower-cost models for broad coverage, and apply frontier capabilities to the hardest problems” [1]. None of those four require a purchase. Three of them are configuration and one is a habit. That is the useful thing about this letter for a small operator: the companies best placed to know what an AI-enabled attack looks like put least privilege and strong access controls in the paragraph written for you, not in the paragraph written for banks.

The risk moved from what the vendor stores to what your tools will do

For three years the standard worry about an AI vendor was storage. Where do my prompts go, who reads them, do they train on my client’s contract. That worry is still real and it is addressed later here. It is no longer the largest one.

In November 2025 Anthropic published an investigation into a campaign it attributes with high confidence to a Chinese state-sponsored group, in which an attacker used Claude against roughly thirty global targets across technology companies, financial institutions, chemical manufacturers and government agencies. The report’s figure is that the threat actor “was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically,” needing a human at “4-6 critical decision points per hacking campaign” [2]. Whether or not that specific attribution holds up, the shape of it is the thing to absorb. The expensive, scarce part of an intrusion used to be skilled human hours. An agent that can chain steps together compresses that cost, and it does so for attackers and defenders at the same time.

The mirror image is sitting in your own account. The tools you have given credentials to can now take multi-step actions on instructions they read somewhere. OWASP’s current list defines the failure directly: a prompt injection vulnerability “occurs when user prompts alter the LLM’s behavior or output in unintended ways,” and the project’s own assessment is blunt about the ceiling, noting that “it is unclear if there are fool-proof methods of prevention for prompt injection” [6]. A web page your agent fetches, a document a client emails you, a comment in a repository issue: any of these is text your tool may treat as instruction. The question to ask about a vendor is therefore no longer only what it keeps. It is what its tool is permitted to do at the moment it reads something hostile.

Three vendor facts you can check, and the plan tier that changes all three

Skip the trust marketing and go for three specific sentences. First, the training default. Anthropic’s Commercial Terms state that “Anthropic may not train models on Customer Content from Services,” and that the customer “owns its Outputs” [3]. OpenAI’s enterprise privacy page states “We do not train our models on your data by default,” and applies that to ChatGPT Business, Enterprise, Edu, Healthcare and the API Platform [4]. Google’s Workspace privacy hub states that “Workspace does not use customer data for training models without customer’s prior permission or instruction,” that chats and uploaded files in the Gemini app “won’t be reviewed by human reviewers,” and that “Your interactions with Gemini stay within your organization” [5]. Those are three concrete, quotable commitments from three vendors, and you can find the equivalent sentence, or fail to find it, for any tool you use.

Second, retention control. A no-training promise says nothing about how long the data sits there. OpenAI’s page states that workspace admins control how long business data is retained, that deleted conversations are removed within 30 days unless retention is legally required, and that API inputs and outputs may be retained for up to 30 days [4]. Look for a number and an owner. If a vendor will not tell you either, that is your answer.

Third, independent attestation. OpenAI states that ChatGPT Business, Enterprise, Edu, Healthcare and the API Platform have completed SOC 2 Type 2 audits [4]. Anthropic’s product documentation points to a SOC 2 Type 2 report and an ISO 27001 certificate available through its Trust Center [7]. A certification is not proof that a vendor is secure. It is proof that somebody outside the company looked, which is more than you can say for a vendor that offers only a page of adjectives.

Now the part that undoes all three if you miss it. Every sentence quoted above describes a commercial or business tier. The commitment attaches to the plan, not to the brand on the login screen. Anthropic’s own documentation makes the split explicit: the Commercial Terms of Service apply to “Team, Enterprise, and API users,” while Free, Pro and Max users fall under the Consumer Terms [7]. OpenAI’s default is likewise stated for its business products [4]. Moving is not usually expensive. A Claude Team standard seat is 20 dollars per seat per month billed annually, or 25 billed monthly, sold for teams of 2 to 150, against 17 dollars per month for an individual Pro subscription billed annually [8]. The gap between those two numbers is often the entire distance between a consumer agreement and a contract that says otherwise.

Traceable agentic identity, translated for a business with one person in it

One of the letter’s asks of AI companies is that “agentic identities are traceable and accountable” [1]. In a large company that means an identity platform. In yours it means something smaller and entirely achievable: every tool gets its own credential, every credential has the narrowest scope that still works, and you can name what each one can reach without opening a dashboard to check.

The design worth copying is visible in how the vendors constrain their own agents. Claude Code’s security documentation describes a permission-based architecture in which the tool starts with read-only permissions in Manual mode and asks before editing files, running tests or executing commands that modify the system; commands that fetch content from the web such as curl and wget “are not auto-approved by default”; web fetch “uses a separate context window to avoid injecting potentially malicious prompts”; and “First-time codebase runs and new MCP servers require trust verification” [7]. Those are the same moves OWASP recommends generally: enforce least privilege, require human approval for high-risk actions, segregate and clearly denote untrusted external content, and validate output formats [6].

Translate that to your stack. An automation that reads a shared inbox and writes to a spreadsheet does not need write access to your CRM, even though the connector will happily grant it. A coding agent working on a client site does not need a token scoped to every repository you own. Assume any tool that can both read untrusted text and take an action will eventually be pointed at hostile text, and set the permission so that the worst case is annoying rather than expensive.

Two vendor caveats belong here because they are easy to assume away. Anthropic’s documentation states plainly that while it reviews connectors against its listing criteria before adding them to the Anthropic Directory, it “does not security-audit or manage any MCP server” [7]. A tool appearing in an official directory is a distribution decision, not a security guarantee. And the same page ends with a warning worth keeping: “no system is completely immune to all attacks” [7].

The defensive upgrade for a small operator is configuration, not a purchase

The letter’s second principle asks the industry to empower more defenders with cyber-capable AI [1], and Anthropic’s recommendation to defenders is that security teams “experiment with applying AI for defense in areas like Security Operations Center automation, threat detection, vulnerability assessment, and incident response” [2]. That advice is written for organisations with a security operations centre. You do not have one, and the correct response is not to buy a small imitation of one.

What you have instead is a set of defaults that are already wrong and free to fix. The permission mode your coding agent starts in. The scopes on every OAuth connection you approved in a hurry two years ago. The plan tier that determines whether a contract covers your client’s data. A written list, in a plain file, of which tools hold which credentials and what each can reach. That list is the single highest-value artifact here, because it is what turns an incident from an open-ended question into a bounded one. When a vendor discloses a breach, the difference between an afternoon and a fortnight is whether you already know what you had connected.

Credential hygiene is the other half. Rotate on a schedule rather than after an event, keep separate keys for anything you would want to revoke separately, and store them somewhere that is not a config file in a repository. None of this is novel and all of it is the least privilege and strong access controls the letter asked of every organization [1], stated in terms that fit a business with no security budget.

What still goes wrong

Everything checkable here is a statement, not a control. A commercial terms document that says a vendor may not train on your content [3] is a contractual promise you would enforce after the fact, in a dispute you have no appetite for. A SOC 2 Type 2 report describes controls over a past window at a company that has probably changed since. You are not auditing anything. You are choosing vendors who have made specific, dated, quotable commitments over vendors who have made vague ones, which is a real improvement and much less than security.

The agent side has a harder limit. OWASP’s own position is that fool-proof prevention of prompt injection is not established [6], and Anthropic’s security documentation says directly that no system is completely immune [7]. That means the permission settings in this guide are damage control, not prevention. If a tool can read untrusted text and take a consequential action without you, some day it will do something you did not intend, and the only variable you control is how much that costs. Design for the bad day rather than assuming it away.

Finally, the letter itself does exactly as much as an open letter does. It sets no deadline and creates no obligation on any signatory [1]. Treating it as evidence that the industry has solved this would be a mistake. Its value is narrower and still real: it tells you, in your vendors’ own words, that they expect attacks to get materially worse, and it puts least privilege and access control in the paragraph written for organisations like yours. That is a recommendation you can act on this week without waiting to see whether the coordination ever becomes an institution.