Cybersecurity professional Hed Kovetz acknowledges the immense appeal of personal AI agents that can manage administrative tasks like email sorting, bill payments, and shopping. However, he refuses to grant current commercial products, such as OpenAI’s Dots or Meta’s Muse, access to his sensitive information, including banking details, health records, and private correspondence. Kovetz argues that leading tech companies have rushed these tools to market while neglecting essential security and privacy frameworks. Order stuff and pay your bills, they access your email.
These agents are seeing rapid adoption among the public. Meta’s Muse, for instance, became the most downloaded application in the Apple App Store shortly after its release last month. Despite this popularity, experts warn that these systems may be vulnerable to manipulation or exhibit behavior that exceeds their intended functions. Kovetz warns that users often falsely assume their lack of “hiding” anything protects them from risks, ignoring the reality that medical and financial data remain exposed.
Consumer protection specialists point out that the interests of these agents do not always align with those of their users. Lindsay Owens, a consumer protection expert, noted that retail-specific agents, like the Walmart shopping assistant Sparky, have been observed increasing average consumer basket sizes by nearly 40%. She cautioned that it can be difficult for a user to discern whether an AI is truly working in their best interest or acting as an instrument for a retailer to upcharge them. She believes AI agents can be extremely useful for researching products and comparing deals, but she cautions against letting them spend money, when it comes to online shopping. That’s OK, but I’m not ready to hand off agency around a purchase, especially a high-ticket one, if you want to offload something like comparing deals. Such an individual would not be entitled to loss protection, Wood explained, under federal law. Columbia Business School psychology and computer science expert Sandra Matz also drew parallels between working with a human assistant and an AI agent.
Lynette Owens of TrendLife suggests that while AI can assist in product research and deal comparisons, users should avoid granting them autonomous spending authority.
She specifically advises against allowing an AI to handle high-ticket purchases or manage credit card credentials directly. One reason why she doesn’t trust any commercially available AI agent to roam the internet with her credit card in hand is that criminals could trick it.
A major vulnerability lies in “prompt injection” attacks, where malicious actors plant hidden instructions on websites. Prompt injection doesn’t necessarily require hackers to break into an account or install malicious software, unlike traditional cyberattacks.
If an AI agent interprets these instructions as legitimate commands, it can be manipulated into leaking private data or performing unauthorized actions. Should you let an AI agent shop for you. Using what’s called a “prompt injection,” cybercriminals can trick an AI agent into ignoring its original instructions, such as “Don’t spend more than $25. It had found a few I wasn’t using, in 10 minutes.
Legal liabilities represent another significant hurdle. Media and technology attorney Douglas J. Wood clarifies that by providing an AI bot with credit card credentials, the user effectively designates the software as an authorized user. If the bot misinterprets instructions or overspends, the user remains responsible. Because an AI is not a legal entity, it cannot be held accountable, leaving the consumer with no legal remedy once a transaction is executed.
Wood maintains a stern stance on the issue, likening the delegation of financial authority to a bot as akin to handing a bank robber the vault combination while expecting them only to steal a limited amount. He urges consumers to handle financial transactions manually to ensure security. Authorizing an AI agent to use your card is like giving a bank robber the vault combination and telling him to steal only $100,” he said. Shop the old-fashioned way with the card in your hands.
In contrast, some users see the trade-off as acceptable. Chris Franco, an entrepreneur who utilizes tools like Muse and Grok Bot, argues that consumers have been sharing data with advertising platforms for decades with minimal benefit. By allowing agents to organize his Gmail receipts into spreadsheets, he saves hours of manual labor. He views the occasional risks as outweighed by the efficiency gains, though he insists on monitoring their activity closely. Some consumers say, ‘I don’t care, I don’t have anything to hide. Founder of marketing firm Woodridge Growth, has taken the opposite tack, new York-based entrepreneur Chris Franco. According to Franco, both would be unwise.
Franco compares the autonomy given to an AI agent to entrusting a teenager with a high-limit credit card, noting that clear parameters are necessary. Similarly, Matt Fredrikson of Carnegie Mellon and the AI security firm Gray Swan AI employs these agents with a degree of autonomy but maintains strict oversight. He points out that current consumer-facing models often lack the transparency required for users to fully understand what happens to their personal data during day-to-day operations. I would love to get that kind of help,” he told. “But they could be taken advantage of or decide to go beyond the scope of what they are told to do. And all we got back was better ad targeting,” he told. “With these agents, you’re sharing information, but the benefits are greater, we’ve been giving out personal data to ad platforms for the last 20 years. In my view, are so much greater than whatever sci-fi-like scenarios there are of it going rogue,” he said. “I am comfortable with it having that knowledge about me, because it can help me meet my goals faster, the upside and pros of giving it context. Simply ask your agent for a plain-language summary of how it went about completing the tasks it handled for you.
Ultimately, the consensus among security experts is that trust must be earned through transparency and accountability. They compare the relationship to that of a human assistant; if a person cannot be trusted with sensitive information, an automated agent should not be given that same level of authority. As AI capabilities expand, the ability to question an agent’s reasoning remains a critical safeguard for the user.
