Automation platforms like Zapier and Make have added AI steps directly into their workflows: an action that reads incoming data, uses an AI model to decide something, summarize something, or draft a response, and then passes the result along to the next step in the chain. It's a genuinely useful capability, and it's also worth a specific look at what it actually has access to once it's wired in.
Why an AI step is a different kind of link in the chain
A normal automation step does something predictable: move this field from here to there, send a message if this condition is true. An AI step is different because its behavior depends on reasoning over content, which means it can be steered by that content in ways a fixed, predictable step can't be. If your automation feeds it something a user submitted, a support ticket, a form response, an email, that content is now something the AI step is reading as instructions to reason about, not just data to relay, and that's exactly the prompt-injection risk I've written about before, just showing up inside a no-code automation instead of a custom-built chat feature.
What actually needs checking on a workflow like this
- What does the AI step have access to reach, downstream, if its output gets used to trigger another action? If it can produce text that then gets used to decide which record to update or which email to send, a manipulated input could steer that decision.
- Is the AI step processing content that came from outside your organization, a customer's message, a public form, without treating that content as something to be cautious about, the same way you'd be cautious about any other untrusted input?
- What permissions does the overall automation have across every connected app? A chain built for convenience often ends up with broader access than any single step in it actually needs, because each connected app gets authorized once for the whole workflow.
- If the AI step can trigger a real, consequential action, sending an email, updating a customer record, creating a task, is there any human checkpoint before that happens, or does it flow straight through unreviewed?
Why this is easy to add without thinking through
Adding an AI step to an existing Zap or automation is genuinely just a few clicks: pick the action, write a prompt, connect the output to the next step. Nothing about that setup process prompts you to think about what happens if the input to that step is adversarial rather than the normal, well-behaved content the automation was designed around, the same gap as any other AI feature added quickly to something that already works.
None of this means AI steps in automations are unsafe to use. It means they deserve the same specific question as any other AI feature: what happens if the content flowing into this wasn't written by someone using the system the way it's meant to be used, and what's the actual blast radius if it gets steered somewhere unintended.