Most CEOs I meet size up an AI vendor on three things: what it does, what it costs, and who else is using it. All three are worth asking, and not one of them touches the question that actually decides whether you sleep at night.
That question is what the tool plugs into once it is inside, and what happens when somebody else takes control of it.
In the OWASP Top 10 for LLM Applications 2025, supply chain risk climbed from fifth place to third. Not because vendors got worse. Because the connections got deeper. A modern AI tool does not take a file and hand back an answer. It holds an authorization token into your CRM, your mailboxes, your drive and your internal chat, and it works in the background.
When a sales chatbot became a back door
In August 2025 this stopped being theoretical. An attacker that Google Mandiant researchers track as UNC6395 hijacked the OAuth tokens of Drift, the Salesloft chat app - an AI sales tool that plenty of organizations wire straight into Salesforce.
Between 8 and 18 August 2025, those tokens alone were enough to pull data out of the Salesforce environments of more than 700 organizations. In some cases the access reached into Google Workspace and Slack as well. They went after support tickets in particular, knowing that is exactly where employees paste AWS keys, Snowflake tokens, VPN details and passwords while working a problem. Then they deleted logs to slow the investigation down.
Here is the part I want you to carry away. The attackers broke no employee's password and bypassed nobody's two-factor authentication at any of those 700 organizations. They walked in through a vendor token the organizations had handed over willingly, and that nobody had looked at in a year to see what it actually allowed. FINRA, the regulator of the US capital markets, issued a dedicated alert on the incident and called it an AI supply chain attack.
In Israel, a May 2026 report from the National Cyber Directorate listed four foundational weaknesses that keep recurring in organizations, and supply chain vulnerability sits first on that list. In parallel, the National Cyber Defense Bill passed its first reading in the Knesset on 8 June 2026, placing a duty on essential organizations to manage supply chain risk and map their cyber assets.
Why "it's in the cloud" is not an answer
When I ask where the data sits, the answer I hear most often is "in the cloud". That is not an answer. The cloud is not a place, it is a business model. There are four real questions, and every one of them can be answered in writing.
Is our input used for training. Serious vendors let you say no, in the contract. But the default is not the same across plans, and the gap between a personal plan and an enterprise plan is substantial.
How long are input and output kept, even when not used for training. Vendors that do not train on your data still hold a copy for a limited period to monitor abuse. This has turned into an open commercial question. TechCrunch reported on 19 August 2026 that OpenAI had introduced Private Safety Processing, a mechanism meant to catch misuse without storing customer data, while Anthropic keeps API data for 30 days on certain models to detect abuse - a policy that, per the same report, worried organizations handling sensitive data. Both vendors offer no-retention arrangements to enterprise customers who qualify. My point is not which vendor comes out better. My point is that if you do not know what your contract says on this clause, you do not know where your data is.
Who are the vendors under your vendor. Almost every AI tool runs on somebody else's infrastructure, sometimes on a third party's model. Ask for the subprocessor list, and for a commitment that you get notice before it changes.
What happens when the engagement ends. How many days until the data is deleted, who confirms the deletion in writing, and what happens to the backups. If there is no answer, the safe assumption is that the data stays.
Seven checks before you sign
This is the list I actually hand over. It does not require a security department.
- A full list of the permissions the tool requests, trimmed to the minimum it needs. A read-only token beats a write token in every case where read-only does the job.
- A quarterly audit of every third-party access token in your core systems, including tokens belonging to tools nobody uses any more. In most organizations, that is where the surprise turns up.
- A written commitment on no use for training, on retention period, and on the geographic location of storage and processing.
- A subprocessor list, with mandatory advance notice of any change to it.
- An audit right, or at minimum a current SOC 2 report and a commitment to cooperate with a customer audit.
- A procedure for reporting a security incident at the vendor, with a timeline measured in hours. Amendment 13 to the Privacy Protection Law requires you to report immediately, and you cannot do that if your vendor tells you two weeks later.
- An exit plan: how long it takes you to go back to working without this tool, and what that costs.
When a local model is the right answer
Not for everything. A local model costs more, runs slower, and needs maintenance. But there are three cases where it is simply the clean answer: when the data is medical, biometric or criminal; when a contract with a customer or a regulator forbids moving data outside defined borders; and when it is core business you do not want sitting with anybody else.
Working with a large medical institution, we run transcription of patient calls on a local server rather than in the cloud, for the simplest reason there is: the safest way to protect data is not to send it. It cost a little extra processing time, and it took an entire category of questions off the table.
The quarterly review of third-party tokens takes half a day and usually turns up more than you expected. If you want to walk your organization's connection map and see exactly who is holding a key, talk to me.
