It's often missed that tools that only read information are perfect for data exfiltration (no need for any more permissions).

So if you add a Jira tool and a web browser tool together (unauthenticated GET only), then the AI can send all your Jira data to the Internet.

Even big players get this design wrong quite often.