How do you stop an AI agent from leaking your photos and files online?

Treat an AI agent like a new contractor: grant only the access it needs, review every public action, and audit connected storage and published outputs.

Unsecured agent setups exposed 53 user images on the public internet, while separate reporting found agent swarms making heavy requests to online databases and some Supabase projects exposing large amounts of customer data. The lesson is configuration, not panic. Give an agent the smallest permission set that completes the job—read-only where possible, one folder instead of an entire drive, and no public-posting permission by default.

Before it acts, review the exact files, destination, audience, and whether a link will be public. Keep private photos, identity documents, medical records, and unreleased work out of agent inputs unless the workflow truly requires them and the access controls are verified. On a schedule, inspect connected data sources, public storage buckets, shared links, logs, and the agent’s posted output; remove stale access and install security updates promptly.

If a task needs a public upload, use a clean folder containing only approved copies.