Hosts:
Justin Shelley – https://www.phoenixitadvisors.com/
Mario Zaki – https://www.mazteck.com/
Bryan Lachapelle – https://www.b4networks.ca/
Joshua Holloway – https://7thdi.com/
You’ve heard “just make it read-only” and figured you were covered. You’re not.
In Episode 91 of UnHacked, Justin, Mario, Bryan, and Josh pick up their ongoing AI series and get into the real-world Security risks hiding inside AI integrations — the ones that don’t show up until something goes wrong. Bryan takes the hot seat this week and walks through what happened when he connected Claude to his accounting software through Xero’s MCP server. Spoiler: the data it can access tells a hacker exactly who your best clients are and how much they’re paying you. That’s not a read-only problem. That’s a target.
The crew also digs into why “read-only” is only safe at the start, why there’s no Control-Z once your AI does something you didn’t intend, and why your endpoints are now the biggest vulnerability in your entire security stack. Plus, Brian shares what happened when he tried connecting Claude to DocuSign — and what almost worked.
Key takeaways from this episode:
This is Part 2 of the team’s multi-part AI series: basic chat setup, integrations (that’s right now), and vibe coding is coming next. The series follows a crawl-walk-run framework designed to help business owners actually implement AI without burning it all down.
Not sure where to start? Go to unhackmybusiness.com, click any episode, and use the action cards below the player to ask a question or request a free consult.
