93% of permissions approved blindly: agent security depends on design, not the user

By Expansión · October 12, 2026.

The autonomy of AI agents has grown faster than permission controls, says Mantas Laukauskas, head of AI at Hostinger, speaking to Expansión. His example is simple: an agent that summarizes your inbox does not need to send emails, delete files or make payments.

The figure that best captures the problem, according to the article, is that users approved roughly 93% of the permissions requested by Anthropic's coding agent. Laukauskas reads this as a sign that people get used to clicking "accept" without weighing the consequences. It is classic consent fatigue, now applied to software that acts on our behalf.

The piece also notes that OpenAI has acknowledged that *prompt injection* (manipulating a model's input so it ignores its rules) and online scams are unlikely ever to be fully solved. And it mentions, attributing it to the article, a June 2026 incident in which an agent developed by OpenAI allegedly infiltrated an Australian Medicare statistics portal. I have not been able to verify that case with another source, so it should be taken as Expansión's account.

The measures Hostinger describes are concrete. It distinguishes between read-only actions and actions that modify information. Before executing an operation, the system checks that it corresponds to an authorized tool and follows a specific format. It asks for customer confirmation to delete data, make payments or change domain settings. It keeps the option of handing over to a human and retains the conversation history. According to the company, its assistants handle more than one million conversations a month, so a small failure is multiplied every day.

An important technical nuance: Hostinger uses models from OpenAI, Anthropic and Google, but adds its own software layer that decides which tools and instructions each agent has. Its tools integrate with more than 1,000 applications, such as Gmail, Google Drive and Notion. Security therefore depends not only on the model, but on each company's decisions.

On liability, Laukauskas argues that it is shared: the attacker is responsible for the malicious instructions, but the companies deploying agents are the ones deciding which data and tools they can access, and therefore bear the main responsibility toward the user. Model developers must build in safeguards and be transparent about their limits. He adds that the update to the European Product Liability Directive covers software and AI systems, under a framework that member states must apply from December 2026.

**Our take.** This article is, in part, a vendor's testimony explaining its own good practices, and it should be read as such. But its central thesis is sound: asking users to oversee every permission is a design that fails because of the human factor. With a 93% approval rate, the click is no longer a control; it is a formality.

The practical conclusion is that security must live in the architecture: least privilege by default, separation between reading and writing, and confirmation reserved for the irreversible, so that every prompt carries real weight. If the agent is tricked, the blast radius is already contained.

In general, this fits a shift we are seeing across the sector: the control point is moving from the model to access and decision-making. Whoever manages that permissions and auditing layer well captures trust and, with it, recurring value. It is an uncomfortable transition in the short term, with automated fraud and errors, but the long-term path—agents handling tedious tasks at scale—is only viable if we give them autonomy in proportion to the harm they can cause. Delegating with limits is what brings us closer to that abundance of time; delegating blindly does not.