Here is the pitch for a personal AI agent: it reads your email, knows your bank accounts, pays your bills and orders things for you. Meta’s Muse, OpenAI’s Dots, Instinct and Grok Bot all offer some version of it, and people want it. When Muse came out last month it quickly became the most downloaded product in Apple’s App Store. Security people are less keen, and Megan Cerullo at CBS News asked a handful of them what they would actually let one of these things do.
Hed Kovetz, a cybersecurity expert, would love one. “It’s tempting to use a personal AI assistant. They access your email, order stuff and pay your bills. I would love to get that kind of help,” he said. “But they could be taken advantage of or decide to go beyond the scope of what they are told to do.” He thinks the big tech companies rushed the products out without enough security, and he won’t give any of them his email, banking details or health records. People who say they have nothing to hide are wrong, he said: “they still have medical records, bank accounts.”
The most interesting answer came from a lawyer, though. Douglas J. Wood, a media and technology attorney, points out that if your agent misreads your instructions or overspends, the loss is yours. “If you give an AI agent, e.g., Muse, credit card information, you are making the bot an authorized user with the power to act on it,” he said. “If it exceeds your instructions and spends your money, the card issuer will argue you authorized the purchasing tool.” Under federal law, he explained, you wouldn’t be entitled to loss protection.
Here’s how that works. The federal rule everyone half-remembers, that a stolen credit card costs you at most $50, comes from Regulation Z. The $50 cap applies to “unauthorized use,” meaning use by someone with no “actual, implied, or apparent authority” to use the card, from which the cardholder gets no benefit. The official commentary then covers the other case: “If a cardholder furnishes a credit card and grants authority to make credit transactions to a person” (its examples are a relative or a coworker) and that person goes beyond what they were allowed, “the cardholder is liable,” until the cardholder tells the issuer to stop allowing that person’s charges. So the consumer protection is built for thieves. If you hand the card over yourself, you are the opposite of robbed.
Imagine, purely as a hypothetical, that you tell your agent to buy paper towels and spend no more than $25. That $25 limit lives in a chat window between you and a piece of software. Visa never sees it. What the card network sees is a valid card, used by a party you set up, buying something from a real merchant. “Since you can’t pursue the AI bot for improper use (it is not an entity that can be sued), your only remedy is to cut it off,” Wood said, and by the time you do that the damage is done. His advice: “Don’t be lazy.” Also: “Authorizing an AI agent to use your card is like giving a bank robber the vault combination and telling him to steal only $100.”
Then there’s prompt injection, which is how somebody else gets to that $25 limit. Lynette Owens, a consumer education expert at TrendLife, a group set up to teach households about AI’s capabilities and risks, explains that an attacker doesn’t have to break into anything. They hide instructions in a webpage, an email or a document that the agent comes across while doing a legitimate task. If the agent takes those instructions as orders, it might hand over private information or do things its user never wanted. “We’ve seen an increase in incidents of prompt injections, and criminals are getting more clever about how they’re hiding malicious code on websites,” she said. She’s happy to let an agent compare deals, but “I wouldn’t let it use my credentials like a credit card.”
Put those two together and you get the unpleasant part. From where you sit, a prompt injection looks a lot like fraud. From where the issuer sits, according to Wood, it may look like your authorized user doing some shopping.
Whose agent is it?
Lindsay Owens, a consumer protection expert (and no relation to Lynette, as far as CBS indicates), raises a quieter worry: you may not be able to tell whether your agent is working for you or for the retailer. Her example is Walmart’s shopping agent, Sparky, which she said increased average basket sizes by almost 40% compared with people who browse normally. That, she said, suggests some agents could be trying to upcharge their users.
Walmart sees the same number as good news. Chief executive John Furner said on the company’s latest earnings call that Sparky users spend 40% more per order than other shoppers, Storyboard18 reported. Global CTO Suresh Kumar put it at 38%. Earlier in the year the figure was about 35%. This month, when Deutsche Bank upgraded Walmart to a buy, it cited the bigger baskets. Storyboard18 also noted the obvious caveat: the comparison is between people who use Sparky and people who don’t, and it doesn’t prove Sparky caused the extra spending. Still, it’s the same statistic with two audiences. Shareholders read it as a reason to buy the stock. Consumer advocates read it as a reason to keep your card in your pocket. Both readings can be correct at once.
Not everyone is worried. Chris Franco, a New York entrepreneur who founded the marketing firm Woodridge Growth, sees it as a better version of a deal people have accepted for years: “We’ve been giving out personal data to ad platforms for the last 20 years, and all we got back was better ad targeting.” He lets Muse and Grok Bot go through his Gmail, and he had them sort his receipts into a spreadsheet so he could find subscriptions to cancel. “In 10 minutes, it had found a few I wasn’t using,” he said. He still won’t give an agent free rein. Handing one your card details without limits, he said, would be like a parent giving a teenager a high-end card with no rules. You’ll notice that his best use of an agent was to spend less money, while Walmart’s best number is about people spending more. That’s roughly the whole question of whose side the agent is on, and our coverage of how executives use these tools comes out about the same way.
Matt Fredrikson, a computer engineering expert at Carnegie Mellon and founder of the AI security company Gray Swan AI, gives his agents a fair amount of autonomy but watches them closely with tools his company makes. “The consumer-facing agents meant for normal people aren’t immediately transparent about what they’re doing with your data,” he said. “But you can ask for that info if you probe them.” He suggests asking the agent for a plain-language summary of how it handled each task, the way you’d ask a human assistant to explain what they did. Sandra Matz, who studies psychology and computer science at Columbia Business School, sets the bar this way: “If you wouldn’t trust another person to deal with your personal information and process it safely, I wouldn’t trust an agent.”
The difference is that a human assistant who goes over budget can be fired, and sued. With the agent, as Wood says, cutting it off is the whole remedy. That makes it a lot like a subscription you forgot to cancel, and finding those is the one job everyone agrees these agents are good at.