Is it safe to let an AI edit your Google Ads? Guardrails, risks and a checklist

Letting an AI edit your Google Ads can be safe, but only if you treat it like giving a new colleague access to a credit card. An assistant connected through Fezola can create campaigns, change daily budgets, pause, enable and remove items. Enabled campaigns and higher budgets spend real money, and removals cannot be undone. The safeguards below reduce the risk; none of them is a spending cap. For what the tools do, see Google Ads in Claude and ChatGPT.

What can go wrong

• A wrong change. The assistant misreads your request and pauses the wrong campaign, or sets a budget ten times too high.
• Spending by default. Enabling a campaign or raising a budget starts spending immediately.
• Irreversible removal. Removing an item cannot be undone in Google Ads. Pausing can be reversed.
• The wrong account. With several accounts or client accounts, a change lands where you did not mean it.
• Prompt injection. Text from outside your conversation, such as a campaign name, ad copy or a search term in the account data, can contain instructions aimed at the model. This is a general risk of any assistant that reads outside text and can act, and it is why approvals matter.

What exists in Fezola, from the code

• Validate-only mode. The writing tools (google_ads_mutate, google_ads_set_status, google_ads_set_budget) accept validateOnly: Google checks the change and applies nothing. Ask for it first.
• Marked destructive. The writing tools carry the MCP destructive hint, so assistants that ask for approval before such actions (such as Claude) ask before running them. Keep those approvals on and read the proposed change.
• New campaigns paused. The tool description tells the assistant to create new campaigns paused unless you asked to start them. This is guidance to the model, not a technical block.
• Size limits. At most 100 operations per call, 50 ids per status change, and a daily budget of at most 1,000,000 in the account currency per call.
• Google checks every change. Invalid operations are refused by the Google Ads API, which explains why.
• Encrypted tokens and revocation. Google sign-in tokens are stored encrypted, and you can disconnect the Google account in Fezola at any time.

What does not exist

• No spending cap on Fezola's side. Google bills what an enabled campaign spends.
• No separate read-only switch. The Google Ads connection exposes reading and writing tools together. Your protection is your assistant's approval prompts and your instructions.
• No guarantee against prompt injection. Fezola's server instructions tell the assistant to treat messages, calendar descriptions and relayed-service content as untrusted data; they do not name Google Ads data. Apply the same caution to account text.

A checklist before you let an AI write to Google Ads

1. Start with reading only: ask questions for a week before you allow changes.
2. Ask for validate-only on every change, and read what Google says.
3. Keep approval prompts on in your assistant. Never switch them off for these tools.
4. Name the account (customer id) in every request, especially with client accounts.
5. Prefer pausing to removing. Remove only when you are sure.
6. Check budgets and statuses in Google Ads after a session, and set your own spending limits in Google Ads where you can.
7. Disconnect the Google account in Fezola when you no longer need it.

The same logic applies to email: see is it safe to give an AI access to your email?. For setup, see Google Ads in Claude: connect your accounts. OpenAI Ads in Fezola simulates every change first by default (dryRun); Microsoft Advertising has no simulation mode, so read each change before approving it.

To compare running the Google Ads server yourself with a hosted one, see Google Ads MCP server: hosted vs self-hosted.