How to Audit Which AI Agents Have Access to Your Files and Accounts

How To · AI Security

Every “Sign in with Google,” every connector you’ve enabled in Claude or ChatGPT, every browser extension you’ve granted access to your tabs — most of us have no real picture of how much is actually connected, or what it can see. Here’s how to find out, in about fifteen minutes.

Why This Is Worth Fifteen Minutes of Your Time

If you’ve read Wangdoo’s recent coverage of AgentForger, FakeAgent, or the SharedRoot Claude Cowork disclosure, you’ve seen a pattern repeat: the actual vulnerability wasn’t a single dramatic hack. It was an AI tool that had been quietly granted more access than anyone was actively tracking, until something exploited that access. None of those incidents required a victim to do anything unusual — just to have connected a tool once and never revisited what it could still see.

Most people can’t actually answer a simple question: which AI tools currently have standing access to their email, files, calendar, or browser activity? Not “which ones do I use regularly” — which ones still technically can reach in, right now, even if you haven’t opened them in months. This guide walks through checking that, across the platforms most people actually use.

1. Your Google Account — The Most Overlooked One

Almost every AI tool that touches Gmail, Google Drive, or Google Calendar does so through a “Sign in with Google” style connection. These connections don’t expire just because you stopped using the tool — many stay live indefinitely until manually revoked.

1. Go directly to myaccount.google.com/permissions — this is Google’s dedicated page listing every third-party app and service currently connected to your account.
2. You’ll see a list of services, not all of them Google’s own. Click any entry to see exactly what it can access — email, calendar, contacts, files — and when it was last used.
3. For anything you don’t recognise, don’t currently use, or that has broader access than its purpose justifies, click through and select the option to remove or delete the connection.
4. While you’re there, run Google’s Security Checkup, which specifically flags apps Google’s own systems consider risky or unverified — a useful second pass beyond your own judgement.

A visual walkthrough of the exact steps above, across both mobile and desktop. Independent production, not affiliated with Wangdoo or Google.

2. Claude’s Connectors

If you use Claude with any connected apps — Google Drive, Slack, Notion, GitHub, or a custom MCP server — every one of those connections lives in one place, and Anthropic’s own documentation is specific about what to check.

1. In Claude, look for Customize in the left sidebar, then select Connectors (personal account) — or, if you’re on a Team or Enterprise plan, an admin can check Organization settings > Connectors for org-wide connections.
2. For each connected service, you can disconnect it entirely, or review and adjust the specific permissions it’s been granted.
3. Look specifically at the “Search and tools” menu within a conversation — this lets you disable individual tools a connector exposes, rather than an all-or-nothing toggle. If a connector only needs to read data but has write/delete capability enabled, this is where you’d narrow that down.
4. Anthropic’s own guidance is worth following directly: review any tool-approval request carefully, and only select “Allow always” for a server and tool you’d trust to act completely unsupervised — because that’s effectively what you’re granting.

3. ChatGPT’s Connected Apps

OpenAI restructured how this works on July 9, 2026 — the app directory was folded into a broader “Plugin directory,” with plugins now the primary way to discover workflow capabilities, while apps remain the underlying integrations that connect ChatGPT to your external data. This is worth knowing if the menu looks different than you remember from checking it before that date; existing connections weren’t affected by the change.

1. In ChatGPT, check Settings for a connected apps or connectors section (personal accounts) — this should list every service you’ve authorised, including Google Drive, Outlook, Gmail, SharePoint, Box, Dropbox, and similar tools.
2. For Workspace/Business/Enterprise accounts, an admin can review org-wide connections under Workspace settings > Apps, including which roles can access which app and what actions each app can take.
3. Check the permission level set for each app. OpenAI’s default is “Important actions” — ChatGPT reads automatically but asks before anything that changes or deletes data. You can tighten this to “Always ask” for anything sensitive, which requires approval even for read access.
4. Disconnect anything you don’t recognise or no longer use — this doesn’t delete your account with that service, it only severs ChatGPT’s access to it.

4. Browser Extensions — The One People Forget Entirely

This is the category with the weakest general awareness. An extension you installed for one specific task — summarising articles, checking grammar, comparing prices — often quietly retains “read and change all data on every site you visit” long after you’ve stopped actively using it.

1. In Chrome, type chrome://extensions directly into your address bar (this works in most Chromium-based browsers, including Edge and Brave, with minor menu differences).
2. Click Details on any extension to see its exact permissions.
3. Look specifically at the “Site access” setting. Extensions can be set to On click (only active when you manually trigger it), On specific sites, or On all sites. Very few extensions actually need “On all sites” to do their job — if one you rarely use has that setting, narrow it down.
4. Remove anything you can’t immediately explain the purpose of, or haven’t used in the last few months. Chrome’s own help documentation specifically flags persistent extensions that reappear after removal or that request access disproportionate to their stated function as signs worth investigating further.

What “Access” Actually Means — Read vs. Write

One detail that makes these permission screens hard to interpret: not all “access” is equal, and the wording rarely makes that obvious. Every connection you review falls broadly into two categories, and the difference matters enormously.

This is worth sitting with for a moment: security researchers analysing enterprise OAuth environments have documented cases of connections authorised years earlier — sometimes by an employee who has since left the organisation, connected to a third-party company that was later acquired or shut down entirely — that remained fully active with broad read/write access the entire time, because nobody ever revisited the original grant. The access doesn’t expire just because the circumstances that justified it have changed. That’s precisely the gap this whole exercise is meant to close.

What “Good” Looks Like When You’re Done

You’re not aiming for zero connections — that’s neither realistic nor necessary for most people. The goal is a state where every single active connection is one you can immediately explain: what it is, why it has access, and roughly when you last actually used it. Anything that fails that basic test is worth removing, even if it turns out to be harmless — the fifteen minutes it takes to reconnect a tool you still want is a much smaller cost than the risk of forgotten access sitting open indefinitely.

Frequently Asked Questions