Personal AI agents can sort email, compare products, organize receipts and complete other administrative tasks, but security experts disagree over how much access consumers should grant them. The central concern is that an agent connected to email, financial accounts or payment cards can act beyond what its user intended.
Cybersecurity expert Hed Kovetz said he would welcome help with routine work but does not trust current commercial agents with his email, banking information or health records. He believes the technology reached consumers before its security and privacy protections were ready and advises people to limit the sensitive information they provide.
The risk is especially visible in online shopping. Consumer protection expert Lynette Owens supports using agents to research products and compare prices, but not allowing them to make purchases with a credit card. A prompt injection can hide instructions in a webpage, email or document that an agent is reading, potentially causing it to ignore limits, disclose private information or take unauthorized actions. OWASP classifies prompt injection as a leading risk because language models can struggle to distinguish trusted instructions from hostile text embedded in data.
In that situation, the agent itself cannot be sued, leaving the consumer to stop the access after the damage has occurred.
Other users see a worthwhile trade-off. Entrepreneur Chris Franco lets agents search his Gmail for receipts and place them in a spreadsheet so he can identify and cancel subscriptions; he said a task that could take hours was completed in about 10 minutes. He still favors strict instructions and close monitoring, and does not support giving an agent unrestricted control over his life.
Matt Fredrikson, a Carnegie Mellon computer engineering expert, recommends asking an agent to explain in plain language how it completed a task. Sandra Matz, a psychology and computer science expert at Columbia Business School, compared an agent with a human assistant but noted that software does not experience guilt or shame when it violates trust.
Independent security testing reinforces the need for limited permissions. NIST researchers found that agents could be hijacked when malicious instructions were embedded in emails, files or websites, and testing produced attacks involving data theft, code execution and phishing.
The practical dividing line is authority. Agents that only summarize or compare information expose less than systems that can send messages, access files, call APIs or spend money. Restricting permissions and requiring explicit confirmation for consequential actions can reduce the damage from a compromised agent, but those safeguards do not eliminate the underlying vulnerability.