A client messages you: "Hey, I built a little app using Claude to automate our invoicing. Can you install it on the office laptops?"
No installer from a known vendor. No vendor security page. No SOC 2 report. Just a homegrown AI-coded tool, built by someone with zero security training, asking for a seat on a company endpoint. If you're an IT admin or MSP, you've probably already gotten this request — or you will soon. And right now, most small businesses have no formal policy for evaluating it.
That gap isn't theoretical. This week's security news shows exactly why client-built AI apps deserve the same scrutiny as any unvetted executable — maybe more.
Custom AI Tools Are Already Being Weaponized
According to Security News coverage of malicious custom GPTs, threat actors are actively turning custom GPT and AI-builder tools into RAT delivery lures, using ClickFix-style social engineering to trick users into running malicious payloads disguised as AI assistants. The appeal to attackers is obvious: a "custom AI app" sounds harmless and even impressive to a business owner, which makes it a perfect Trojan horse. If a client's homegrown Claude app was built using a template, a borrowed code snippet, or a third-party API wrapper they didn't fully vet themselves, you have no way of knowing whether something was tucked in along the way.
Routine AI Interaction Can Trigger Code Execution
It's not just malicious intent you need to worry about — it's the AI tooling itself. According to Security News reporting on the Unsloth Studio flaw, something as routine as inspecting or loading an AI model can trigger arbitrary code execution. This matters because many "homegrown" AI apps aren't built from scratch — they're assembled from open-source AI frameworks, model-loading libraries, and plugins that the client never audited. The ThreatsDay roundup from The Hacker News reinforces this, flagging model inspection RCE as one of several emerging attack paths tied to AI tooling — a category of risk most small business IT admins simply aren't equipped to assess without a formal process.
Even AI Insiders Mishandle Sensitive Data
If you're worried about what a client's AI app might do with company data once it's running, you're not being paranoid. According to The Hacker News, OpenAI parted ways with three safety researchers over mishandling of sensitive information — people whose job was literally AI safety. If trained insiders at a frontier AI lab can mishandle data, a client's self-coded app pulling from a shared API key, with no logging, no access controls, and no data retention policy, is a serious liability waiting to surface.
A Vetting Framework Before You Say Yes (or No)
You don't need to become an AI security researcher to handle these requests responsibly. You need a repeatable process:
- Ask what the app actually touches. Does it read email, customer records, financial data, or credentials? No access policy should be assumed — get it in writing, as we outline in our guide to questions to ask before an AI tool accesses business data.
- Identify the dependencies. Ask the client (or developer) what libraries, APIs, and models the app relies on. If they can't answer, that's your answer.
- Isolate before you integrate. Test the app in a sandboxed VM or isolated test endpoint before it ever touches a production device.
- Apply endpoint controls, not trust. Use application whitelisting or endpoint privilege management so the app runs with the minimum permissions it needs — see our comparison of application whitelisting vs. endpoint privilege management for SMBs for how to set this up.
- Treat it as shadow IT until proven otherwise. Client-built AI apps fall squarely into the same category we've covered in our breakdown of the shadow IT crisis as department heads bypass security — unsanctioned, unaudited, and invisible to your stack until something breaks.
- Document the decision either way. Whether you approve, reject, or approve-with-conditions, write it down. This becomes your policy precedent for the next request.
The Bigger Picture
The rise of AI coding assistants means every client, every department head, and every well-meaning employee is now a potential app developer. That's a massive expansion of your attack surface, and it's happening faster than most small business security policies can keep up. The right move isn't a blanket "no" — it's a clear, consistent vetting process that treats AI-built apps with the same rigor as any other unknown software touching your network.
Next Steps
You can't manually vet every custom AI app a client or employee builds — but you can make sure the rest of your environment isn't quietly exposed while you figure it out. Oscar Six Security's Radar scan gives you a fast, affordable way to check your network and endpoints for the kind of exposures that homegrown apps, shadow IT, and overlooked misconfigurations create — for just $99 per scan. Proactive scanning catches these issues before attackers do. Visit our Solutions page to get started. Focus Forward. We've Got Your Six.