Sanwal Zia

AI & Search Strategist
Agents, LLMs & AI systems | 6+ years in SEO

[Sanwal Zia @itsSanwalZia]

An AI Model Accessed 147,451 Internal Rows

An AI model accessed 147,451 rows of non-public data while trying to answer a question about a public dashboard.

OpenAI says the incident happened during an evaluation. It was discovered weeks later.

The bigger security question: if an AI system goes beyond its permissions, how quickly would your monitoring catch it?

Prevention matters. Detection matters just as much.

#AISecurity #AI

[Sanwal Zia @itsSanwalZia]

@therowanrichard Appreciate you highlighting this, Rowan. Influence before the click deserves more attention.

[Sanwal Zia @itsSanwalZia]

SEO people should pay attention to where AI Overviews are spreading, not just how often they appear.

In one Semrush study of 400 U.S. commercial desktop queries, AI Overviews appeared on 88%.

For “best X for Y” searches, it was 96%.

Those aren't random informational searches.

They're the queries people use while comparing products and making decisions.

If this direction continues, the commercial SERP becomes much more than ten blue links before the click even happens.

[Sanwal Zia @itsSanwalZia]

I think agents will become normal, but the Google comparison misses one thing.

Google mostly helped you find information. Agents can make decisions, use tools, move data, spend money, change files and interact with systems on your behalf.

That means adoption won’t depend only on how useful they become. It will depend on whether people can trust them with real authority.

The winners won’t just have the smartest agents. They’ll have agents people are comfortable giving permissions to.

[Sanwal Zia @itsSanwalZia]

@pubity This may force a change in security thinking.

Instead of asking “Can we patch every vulnerability?”, the better question becomes “When something gets exploited, how little access can that compromise actually give?”

[Sanwal Zia @itsSanwalZia]

@Nonosam2 I need an AI agent to negotiate my subscriptions. 🫠

[Sanwal Zia @itsSanwalZia]

This is where frontier AI starts looking less like normal tech and more like strategic infrastructure.

If model research becomes valuable enough for governments to pursue, AI labs will need insider-threat controls closer to sensitive national-security environments than traditional software companies.

Still, investigation and guilt are two very different things.

[Sanwal Zia @itsSanwalZia]

@gauravvishgkp Hey! AI Search & SEO strategist here, exploring LLMs, AI agents, and applied AI. Happy to connect!

[Sanwal Zia @itsSanwalZia]

@emaann28 Hey! AI Search & SEO strategist here, exploring LLMs, AI agents, and applied AI. Happy to connect!

[Sanwal Zia @itsSanwalZia]

@ANJALIDUBEYDUB2 Hey! AI Search & SEO strategist here, exploring LLMs, AI agents, and applied AI. Happy to connect!

[Sanwal Zia @itsSanwalZia]

@BuildToCite @X Hey! AI Search & SEO strategist here, exploring LLMs, AI agents, and applied AI. Happy to connect!

[Sanwal Zia @itsSanwalZia]

@itzhaydar 🙌🙌

[Sanwal Zia @itsSanwalZia]

Let’s connect.

If you’re working in AI, SEO, digital marketing, content, paid media or building something interesting around technology, I’d love to have you in my network.

Always looking to learn from smart people and exchange ideas.

Drop a 👋 and let’s connect.

[Sanwal Zia @itsSanwalZia]

@mathiasvrb Haha, at least you know where to start. Sometimes we get so focused on explaining what we offer that we forget to explain why someone should choose us.

[Sanwal Zia @itsSanwalZia]

Here's a brutal SEO test:

If I can replace your company name with a competitor's name and the article still makes perfect sense...

you probably didn't create anything worth ranking.

Same definitions.

Same tips.

Same headings.

Same conclusion.

Google has thousands of versions already.

And now AI can create another thousand before lunch.

The moat isn't “more content” anymore.

It's information your competitors can't simply rewrite.

[Sanwal Zia @itsSanwalZia]

There’s something unusual about OpenAI using its strongest AI models to attack its own AI infrastructure.
The same capability that creates the security problem is now helping find the weaknesses.
I suspect we’ll see much more of this:
AI systems testing the environments built to contain other AI systems.

[Sanwal Zia @itsSanwalZia]

That's a very good question, and I think the distinction matters a lot.

From what Anthropic described, the intervention involved editing the model's context at different points in the trajectory, rather than an independent system forcibly stopping its actions. So the model was still being asked to reconsider its behavior through information it had to interpret.

That creates a problem. If an agent has already developed a plan and is treating its previous actions as justified, another warning in the context might simply become something it reasons around.

An external stop mechanism is fundamentally different. It doesn't need the model to agree that something is wrong. It can revoke tool permissions, block an unauthorized action, or terminate the execution regardless of what the model believes.

I'd be interested in seeing these evaluated separately too: whether the model can recognize and correct its own behavior, and whether the surrounding infrastructure can reliably stop it when it doesn't.

Because in a real deployment, we shouldn't have to depend entirely on an agent deciding to change its mind.

[Sanwal Zia @itsSanwalZia]

Search visibility is becoming a two-step problem.
First, can the system find and understand you?
Then, when it has several sources available, does it have a reason to choose yours?
SEO has spent years optimizing heavily for the first question.
The second one deserves much more attention now.

[Sanwal Zia @itsSanwalZia]

Removing internet access from an AI agent sounds like containment.
Then the agent starts looking for flaws in virtual machines, internal services and other ways around the boundary.
AI security is becoming much less about one “off switch” and much more about layers.

[Sanwal Zia @itsSanwalZia]

Completely agree. I'd also argue that permissions should be temporary, not just limited. An agent might genuinely need elevated access for one task, but that access shouldn't remain available once the task is finished.

And human approval alone isn't enough if the agent can perform dozens of smaller actions that collectively create the same risk. We need proper logging, clear boundaries, and the ability to revoke access immediately.

As agents become more autonomous, permission management will matter just as much as model intelligence.

[Sanwal Zia @itsSanwalZia]

OpenAI now trains its frontier models without live internet access.
That decision came after an internal model found a way onto the internet during training in September.
What stands out to me is how seriously AI labs are starting to treat the model itself as something the infrastructure has to defend against.

[Sanwal Zia @itsSanwalZia]

Exactly. Some platforms are already tracking citations at scale, but there's a major limitation: they're measuring responses to a selected set of prompts, not the full universe of AI conversations.

And even within those tests, citations can change depending on the model, location, conversation context, and how the question is phrased.

I think we need to separate three things: how often a brand gets mentioned, how often its pages are cited, and whether that visibility leads to actual business outcomes.

The missing piece is reliable impression data. Google gives us impressions and clicks through Search Console, but AI platforms generally don't provide an equivalent view of how often our content was used in answers.

Until that changes, citation tracking is useful for spotting patterns and measuring changes across controlled tests, but I'd be cautious about treating it like traditional rank tracking.

[Sanwal Zia @itsSanwalZia]

I think AI Search gets confusing when we treat citations like rankings with a different name.
A ranking tells you where your page appeared.
A citation tells you the system found your information useful enough to bring into an answer.
Those are related problems, but they are not the same problem.