This summer, investor Katie Jacobs Stanton said her AI assistant, Instinct, sent an email on her behalf without consulting her first, according to TechCrunch. She described the email as innocuous. The breach of trust was not.<\/p>\n
Next time, it could be the email that costs someone a job, a marriage or a lawsuit.<\/p>\n
The appeal of personal AI agents is compelling. An assistant that can identify priority emails and draft responses, remember your mother-in-law\u2019s birthday and buy a present based on your correspondence is enticing. For people stretched by demanding jobs, caregiving, or a disability, that help can be transformative. But Stanton\u2019s experience raises an important question: when we give an assistant access to our lives, how do we retain control? Assistants such as Instinct and Meta\u2019s Muse act for us rather than simply answering questions or making recommendations. A mistaken purchase may be refundable. An intimate disclosure cannot be taken back.<\/p>\n
The harms are already emerging. Forbes<\/em> reported<\/a> that when investor Jason Yeh asked Instinct to find open dinner reservations, it booked a table instead, leaving him with a $200 cancellation fee he never approved. TechCrunch<\/em> reported<\/a> that one tester couldn\u2019t get his data deleted, and another received an inbox summary hours after disconnecting her account. And in September, security researcher Patrick Wardle exposed a flaw in Muse\u2019s Mac app that could let malware already on a computer hijack the assistant, which Meta quickly patched.<\/p>\n The problem now reaches our bank accounts, too. Last week, major financial institutions reported that personal AI agents were operating inside online accounts. In one case, an agent called a bank without authorization to file a complaint. JPMorgan Chase<\/a> CEO Jamie Dimon said the bank would not allow unvetted \u201coutside agents to come in inside the company\u201d, and Schwab\u2019s CEO said they\u2019re actively blocking unauthorized agents. White House adviser David Sacks countered that data was shared willingly and these are \u201cin no way cyberattacks.\u201d Each side has a point, which is precisely the difficulty. We have not yet settled on what authorization means when the party acting is software.<\/p>\n The failures are also hard to see. A public record launched this week by the security firm Manifold counts 59 incidents since July 2025, forty-two of them disclosed in the past four months alone. The median incident took 70 days to come to light, and only 11 of the 59 were detected by a security control.<\/p>\n