AI Can Now Change Your Ad Budget. Who Holds the Keys in Your Czech Account?

What actually happened

Through 2026, AI in ad accounts stopped being an advisor and became an operator. Two major platforms opened their interfaces so an external AI agent, not just a human logged in through a browser, can write to your account.

On Meta it has a name: the ads MCP server. Meta launched it on 29 April 2026 and on 16 July 2026 opened it to any developer, with no approved-partner status required. Through it, an assistant like ChatGPT, Claude or Perplexity connects to your ad account and, with the right permission, can create and pause campaigns, change targeting, edit the catalog and adjust budgets.

Google is moving the same way from the other side. Its Ads Advisor, an agent built on Gemini models, was announced on 12 November 2025 and can “apply approved changes directly to your account in just minutes.” It starts with English-language accounts, but the direction is clear: in-account AI that acts, not only advises.

Why the defaults are the real risk

The technology is not the danger; the setup is. Turning a connector on takes a minute. Giving it sensible permissions and checkpoints takes someone who knows what each access level actually allows.

That gap showed up clearly at Meta. When the platform updated its permission panel on 11 August 2026, Jon Loomer — one of the most respected authorities on Facebook advertising — reported that across all his accounts it opened with every agent action enabled, budget changes included.

Meta did add fine-grained control over nearly a hundred tools. But the starting position was “allowed,” not “off.” Anyone who connects an agent and does not review the scopes by hand may be handing it actions they never meant to grant.

Why this matters more when you enter Czechia

A foreign brand launching in the Czech market rarely runs the account alone. You hand access to a local agency, a Czech-speaking freelancer, a market-entry partner, maybe an AI tool on top — often remotely, in a language you do not read, under time pressure. That is exactly the situation where access sprawl builds up unnoticed.

• Handovers leave residue. A trial tool, a former agency, an ex-contractor — each can keep write or admin access long after the relationship ends, because no one removed it.
• Financial scope is easy to over-grant. Meta’s top tier includes billing and spend limits. Handed to an automated agent, that is budget control without a human in the loop.
• Distance hides the change. A budget that doubles overnight or a winning campaign paused by an agent is harder to catch when you are a time zone away and not watching the Czech account daily.

What it costs, in real terms

An agent with write and financial access can spend real money and switch off a profitable campaign, and it can do so without a human approving the step. Picture three scenarios, none hypothetical: a tool with broad access “optimises” the budget upward overnight and you wake to double the spend; an agent judges a campaign weak and pauses it, when that was the one bringing in leads; or access lingers with someone you never meant to keep. In all three, the cause is a permission setting, not malicious AI.

How we would approach it

This is about order, not complexity. The same checklist secures the account whether or not you use AI.

• Inventory access — in Google Ads under Access and security, in Meta Business Manager under People, Partners and Integrations. Remove anything you do not recognise or use.
• Lowest useful level — read-only is enough for analysis and suggestions. Grant write only to a tool under human control.
• Keep finance out of automation — billing and spend limits belong to named people, essentially never to an automated agent.
• Human approves the big moves — budget increases and campaign pauses wait for a person to confirm. Add two-factor on admin accounts and a quarterly access review.

FAQ

Sources