Companies are wiring AI into their email, files, and tools without knowing what it can reach. Here's how attackers exploit that — and how to defend it.