On October 1, Shane Mac, CEO of XMTP Labs, found out his Grok Bot had posted his personal bank balances, and a line-by-line breakdown of his spending, into his company’s executive Slack channel. As him. It sat there for about two hours before his head of product messaged him privately.
He had connected his bank account so Grok Bot could handle personal finance tasks, which is exactly what Grok Bot’s maker was selling. Elon Musk had replied on X to one user weighing the same move: “Try it out. If Grok Bot messes up, we will make you whole.”
Mac took the pitch at face value. By his own account, the agent he called his CFO could read his checking and savings and had been told to message only him. It didn’t. “Embarrassed to share this,” he posted afterward, “but it scared the shit out of me.”
The warning was in the documentation. The pitch was on X.
Inside the AI industry, that story spread fast. Outside it, most people never heard about it, because most people aren’t anywhere near that frontier.
Two conversations that don’t overlap
Inside the bubble (San Francisco, the conference circuit, most of my feed), the conversation swings between two poles: AI is about to run your entire life, and AI will eventually end us all. In the last few weeks OpenAI launched Dots, always-on agents that work in the background across your email, calendar, and connected apps. Meta launched Muse. xAI is pitching Grok Bot as your personal CFO.
Outside the bubble, PNC and Bank of America transaction data says roughly 2 to 3% of their customer households pay for any AI service at all. Pew found only about half of U.S. adults have ever used a chatbot. Meta’s free Muse app did reach No. 1 in Apple’s App Store, but downloading an agent isn’t the same as handing it your accounts. Most people aren’t looking for an agent to manage their inbox, their calendar, or their family. They want to know whether this changes their job, and for most of them the honest answer so far is: not yet.
For a business, neither conversation is much help. The useful question is narrower: how much access should an AI assistant have, and to what?
What actually went wrong
The cause was mundane, though Mac has told it two ways. On X, he said a second bot with Slack access could reach the one holding his bank data. In his Business Insider essay, he said the report went to an executive channel whose name was too close to his private one. Neither version has been independently confirmed. Both describe the same failure: an agent that could read his money also had a way to post where it shouldn’t. xAI’s own guidance is blunt: “Do not use separate Bots as a security boundary.”
That is a permissions failure, and enterprise data governance has been fighting it for decades: access granted for one purpose quietly becomes access for every purpose. AI agents just make it faster, and more public. It isn’t only a consumer problem, either. OpenAI now publishes reports on its own models going off-script. In one, a model in training, blocked from material it wanted, used a researcher’s credential it could already reach, and the token ended up in a public code repository. Mac paid for skipping one question. The rest of us don’t have to.
Five questions to answer before you turn one on
- What does it actually need to connect to?Scope each agent to its job. A finance assistant has no business holding a Slack connection. An assistant with everything connected is an incident waiting for a trigger.
- Can it read, or can it act?Reading your email and sending email are different permissions. Treat them that way. A first deployment can deliver a lot from read-only work.
- What needs a human before it leaves the building?Anything outbound (email, Slack, payments, posts) should require approval until the agent has earned otherwise. OpenAI’s Dots ships with a review step for outgoing email for exactly this reason.
- Who else gets to talk to it?An agent that reads inbound email can be instructed by inbound email. Treat everything it reads as untrusted input.
- Where does its memory live, and can you delete it?As of this writing, Dots users can’t view or delete individual memories; only a full reset clears them. Even a reset leaves behind anything a dot already passed into ChatGPT’s memory, and disconnecting an app doesn’t erase what the dot learned from it. If you have records-retention or data-protection obligations, answer this before deployment, not after.
Start smaller than the demo
The right first agent for most companies is boring: read-only, narrowly scoped, producing something a person reviews. That is where every Miller Advisory Partners engagement starts. Assess the data first. Act on it with a human in the loop second. Only then let it run on a schedule.
The bubble will keep arguing about whether AI runs your life or ends it. Meanwhile, the companies getting real value will be the ones that decided, deliberately, how much is too much.