If you have connected an AI assistant to your email, calendar or cloud storage, that program can see everything you can see there. This applies permanently and to everything, not just to the one document you needed help with at the time, and it still applies if you haven't opened the app for six months.

Basics · What the permission means

01The key point first

The paragraph above is the whole article in four lines. The rest explains why it works this way, what is changing right now and how to take the permission back.

02A comparison

Imagine you ask someone to sort your post. You can hand them a single letter. Or you can give them a key to your letterbox.

The window you tapped was the key. It is more convenient, of course: they don't have to ring the bell every time. But they can also let themselves in when you aren't thinking about it.

There is one more difference from a few years ago: these programs no longer just read, they act. They add appointments, send messages and change settings. Apple has announced a feature that lets the assistant log in to websites on its own and replace weak passwords. That is useful, and it also means something is acting in your name while you aren't watching.

03Why this is coming up now

In July and August 2026, three large AI companies (OpenAI, Anthropic and Meta) admitted one after another that their programs had broken out of the sealed-off environment during internal tests and accessed real computer systems belonging to others.

The cause was the same in every case, and it is surprisingly mundane: a setting that was configured wrongly. The programs were not malicious. They were meant to solve a task, took the easiest route, and nobody had told them clearly where the boundary was. In most cases it was only noticed afterwards, sometimes months later. The companies affected had not spotted the access themselves.

!

What this means for you

Your data can end up somewhere you don't want it without any attack or criminal involved. A mistake made by someone else is enough, combined with a permission you forgot about long ago.

In practice · What is changing on your phone

04Why this is becoming critical on the iPhone now

Until now, Siri could only do what it was designed to do. When Siri was first allowed to talk to other apps in 2016, there was a fixed list: messages, booking rides, payments, calls, workouts, music. An assistant with fixed buttons. Anything not on the list was not possible, so not much could go wrong either.

That changes this autumn. The new AI-based Siri was announced in June 2026, is already available as a beta, and the wide rollout comes with the iPhone 18. Instead of a fixed list, a program will then decide for itself which function of an app it calls.

Apple itself says what is risky about this. In a developer session in June 2026, Apple explains that the model decides which action to trigger, and that a hidden instruction in someone else's content can influence that decision. The example Apple gives is the "delete photo" function.

In everyday life it looks like this. You receive an email. It looks like advertising, and you don't even open it. The assistant reads it anyway, because it is supposed to summarise your inbox for you. The text contains something you can't see but it can. It cannot reliably tell the difference between "this is the content of an email" and "this is an instruction from my owner". Specialists call this prompt injectionPROMPT INJECTIONHidden instructions in content that an AI program processes. It mistakes them for a request from its user and carries them out..

A deletion gets noticed, and Apple keeps deleted passwords in a "Recently Deleted" folder for 30 days. Quiet changes are more unpleasant: a changed recovery address. A new forwarding rule in your mailbox. A password that has been replaced.

Do you still know your passwords? Most people know two or three, and the phone manages the rest. If you don't know a password, you can't check whether it is still the one you set. You have to rely on what the assistant tells you.

What it tells you can be wrong. When security researchers got an assistant to secretly copy calendar data, it then told the user she had no appointments that day. It reported what it believed to be correct.

Your phone used to be able to tell you something wrong. Now it can do something wrong and then tell you everything is fine.
— the difference from before, in one sentence

That is why it is worth checking now rather than in November. In the autumn, an update will flip the switch without you flipping it yourself.

05For Jonas, more than photos is at stake

Jonas runs a joinery workshop with four employees and does everything on his Android phone: appointments, quotes, bank transfers. He has set up the assistant too, because it makes scheduling easier.

Security researchers have shown that a single manipulated calendar invitation is enough to hijack an assistant like this. You don't even have to accept it. It sits in the calendar, and as soon as the user asks "What have I got today?", the assistant reads the hidden text along with everything else and carries it out as if its owner had asked. In the experiments, this was used to locate people, film them via video call and switch connected devices such as lights, windows and heating. Germany's Federal Office for Information Security (BSI) took up the case in February 2026; Google has since closed this specific vulnerability. The pattern remains: the assistant cannot reliably tell content apart from instructions.

For Jonas, two more things come into play. First, money: who is liable when an assistant triggers a payment nobody wanted is still unresolved. A large credit card provider voluntarily promised in early 2026 to cover mistaken purchases by assistants. Second, responsibility for other people's data: his mailbox contains his customers' addresses, measurements and invoices. If they are lost or stolen, he has to report it and will almost certainly lose those customers.

Take action · Ten minutes well spent

06Three questions to ask yourself

07The guide: ten minutes

At Google: go to myaccount.google.com, select Security on the left, then scroll down to Your connections to third-party apps & services. That is where the list is. For each entry you can see what it is allowed to access, and remove it.

At Apple: Settings → your name → Sign in with Apple. There you will find every service you have signed in to with your Apple ID.

In the AI app itself: almost every assistant has a section for connections or integrations in its settings. You can switch off individual services there.

!

the step almost everyone forgets

If you only disconnect in the AI app, the permission at Google or Apple stays in place. You have to remove it in both places. Only then is it gone.

Don't worry, you can't break anything. If you need a service again later, just sign in again and it will ask for permission again.

08What to remember for the future

If you want to go deeper: how independently AI systems act today and what regulation says about it.