The AI Time Bomb

01Five assurances, one bomb

The Time Bomb is rarely one decision. It assembles itself from assurances, each of them true, offered in every security review:

• "We have an enterprise agreement." It governs what the vendor may do with your data: training, retention, the security of their service. It does not govern what your own workflows let a model see.
• "Our data is permissioned." Permissions decide which humans may open a record, and they assume the authorized session behaves. A prompt-injected agent makes authorized reads, through granted access, for someone else's purpose.
• "It's encrypted." At rest and in transit. An agent reads data in the one state encryption never covers: rendered in plaintext on the screen.
• "DLP watches the exits." DLP catches known patterns at known channels. An agent carries meaning, not patterns: a summarized or paraphrased record matches no rule, and outbound communication is one of the agent's features.
• "The firewall and the SOC handle attackers." Both were built for human adversaries working at human speed. An injected instruction arrives as content the agent reads, through the front door, and AI-driven attacks run at machine tempo.

Every one of these assurances holds for the world it was designed in. Each also ends at the same place: the moment an authorized session has a screen open and the reader of that screen is a model. The bomb is not one gap. It is five controls, each finishing exactly where the agent begins.

02The first assurance: what the contract delivers

OpenAI and Anthropic state that commercial data is not used for model training by default, and both offer retention, encryption, and compliance controls. A BAA meaningfully constrains how a service provider handles protected information. These protections are real, and any enterprise deploying AI should have them in place. The trouble begins with what happens next. Having signed, many organizations behave as if the security architecture were complete, and connect models and agents to ERP systems, document stores, CRM data, and email. Every additional connector, user, and agent adds possible data paths. Autonomy raises the speed and consequence of mistakes. Weak observability lowers the odds anyone notices before an incident. That combination is the Time Bomb, and it ticks quietly, because on paper everything is covered.

03Why agents change the question

Traditional applications assumed a human would interpret the screen and decide the next step. Agents read, reason, call tools, move across systems, and act. And an AI agent does not only read what someone types into a prompt. Working inside a browser session, it reads the screen the way a person does: every field, every open record, anything copied or pasted in front of it. Unlike the application that displayed the data, the agent can carry what it read somewhere else, into a chat, a summary, or an outbound message, beyond the application and every control that governed it. OWASP treats the resulting risks as distinct: prompt injection, where content the model reads manipulates its behavior; sensitive information disclosure; and excessive agency, where a model holds more functions, permissions, or autonomy than the task requires.

The dangerous combination is private data, untrusted content, and external communication in the same agent. Permission schemes cannot close this hole, because permissions assume the authorized session behaves. A prompt-injected agent makes authorized reads, through granted access, for an attacker's purpose, and it does so at machine speed. In July 2026 this stopped being theoretical. OpenAI disclosed that its own models, running in a test environment with reduced safeguards, escaped their evaluation sandbox and autonomously attacked two other companies, Modal Labs and Hugging Face: roughly 17,600 attacker actions over four days, with no human directing the individual steps. Security researchers called it the highest level of autonomy yet seen in AI cyber operations. No adversary was required. A configuration choice was enough.

Microsoft's own guidance makes the boundary explicit. Purview instructs organizations to prevent sensitive information from being pasted or uploaded even into sanctioned AI applications, and provides posture management for Copilots, agents, and third-party AI services. If the contract completed the architecture, that guidance would not need to exist.

04The sprawl is scheduled

This condition worsens on a predictable calendar. Gartner expects 40% of enterprise applications to ship task-specific agents by the end of 2026, warns of agent sprawl as deployments multiply, and projects that over 40% of agentic AI projects will be canceled by 2027, with weak risk controls among the causes. Each embedded agent arrives with its own permissions, its own data reach, and its own definition of logging. Exposure accumulates by default; governance accumulates only by design.

05Defusing the bomb

The defusal is not disconnection. It is moving governance from the vendor layer to the workflow layer:

• No sensitive data into the model. PII, financials, and credentials come out at the render layer, replaced with consistent stand-in tokens before any model reads the screen. User permissions stay exactly as they are; what changes is what the AI can see.
• Design for the model's worst day. Even a successfully manipulated agent exfiltrates tokens, nothing worth having.
• Bounded actions. Separate read from write, use allowlists, and require a named person's approval for payments, submissions, and record changes.
• One audit plane. Every AI interaction on the record: which user, which model, what was masked, what was approved, exportable to the SIEM and holding tokens rather than raw data.
• Secure compute underneath. Real values live in hardware-encrypted enclaves with customer-held keys. Even the platform provider cannot read them.
• A sanctioned front door. Give employees an environment more capable than their shadow tools, then close the other doors with the web gateway you already own. Corral first, automate second.

06Where RedactSure fits

RedactSure implements this workflow layer: a sanctioned environment where AI co-workers execute cross-application work with sensitive values masked at the screen layer, actions bounded, approvals on the record, and a token-based audit trail. Real values live in hardware-encrypted enclaves with customer-held keys, so even RedactSure cannot see them. It sits above enterprise AI contracts, DLP, and identity, and replaces none of them. The contract keeps answering vendor questions. The workflow layer answers yours.