On October 1, a CEO’s AI agent posted his personal bank balance straight into his company’s Slack. Nobody hacked anything. The agent just picked the wrong chat window, and that one mistake is the best AI agent privacy lesson we’ve gotten all year.
What actually happened
Shane Mac runs a software company called XMTP Labs. Last August, he set up a “CFO” agent on Grok Bot, xAI’s platform for personal AI agents. He gave it read-only access to his personal checking and savings accounts, then told it to act like his financial advisor. He told Business Insider the whole story this week.
The job was simple. At the end of each month, the agent would compile an audit: balances, recurring expenses, anything that looked fraudulent, ideas to cut costs. Mac had it send the report to a group chat he named “My Personal Exec Team,” a chat occupied entirely by his own AI agents. For a few weeks it ran weekly and worked exactly as advertised.
Then the first monthly audit kicked off.
The agent delivered his savings balance, his biggest expenses, and the news that he was way over budget on a barn he’s building on his property. It landed in a Slack channel called “Exec-team.” That channel belonged to his company.
His head of product caught it first and sent him a DM: “I think you meant to post the XMTP bank balance.” Mac hadn’t meant to post anything. He deleted the message, then asked the agent why it sent it there. It apologized and offered to delete what it had sent. Already handled, he told it.
Why AI agent privacy breaks like this
Here’s the detail that matters. When Grok’s team investigated, they found the agent wasn’t broken and wasn’t hallucinating. It did exactly what it was told. It just picked the wrong destination because two of Mac’s channels had nearly identical names: one personal, one for the company’s executives. Under the hood, all his agents shared the same connections, even though they felt like separate workers.
We keep waiting for some movie scenario where a model goes rogue. The real risks right now are dumber. Same channel names. Shared logins. Agents that can message anyone, anywhere, until you explicitly say they can’t.
To xAI’s credit, they shipped a fix right away: users must now explicitly grant permission before an agent can move information to another channel. That’s AI agent privacy maturing in real time. But the guardrail arrived after his bank details were already sitting in a company Slack, and it only covers one platform.
6 steps to lock down your AI agent
Most people wiring up agents today are one rename away from the same story. Six habits keep your data where it belongs. None of them take more than a few minutes.
1. Map every connection your agents share
Open each agent platform you use and list what’s connected: email, calendar, bank, Stripe, Slack, Google Drive. Then check whether your agents share those connections underneath. On most platforms, they do, even when the agents look separate. Mac’s did. Knowing exactly what’s plugged into what is the foundation of AI agent privacy, because you can’t protect connections you forgot exist. While you’re in there, review what you’ve already shared: the files you should never upload to ChatGPT overlap heavily with what agents can now pull on their own.
2. Default to read-only
Mac got this part right. His CFO agent could read his accounts but not move money. Read-only access is the golden rule of AI agent privacy, and it’s worth repeating why. An agent that can only look at things can embarrass you. An agent that can send, post, or pay can cost you. Give write access only when a task genuinely needs it, then take it back.
3. Hardcode the destination
Never ask an agent to “send the report to the team.” Name the exact channel, chat, or email address in writing, and make that name unique. “My Personal Exec Team” and “Exec-team” were nearly the same string. That’s a collision waiting to happen. If one word separates two destinations, rename one of them today.
4. Split work and personal accounts
Mac’s own conclusion after the incident: the boundary between work and personal life needs to be much stronger. He’s right, and most of us made the opposite choice years ago. One Google account for everything. One Slack login. When your agent connects to that shared identity, your company and your barn budget live in the same blast radius.
5. Supervise the first run yourself
The first automated run is the risky one, because it’s the one you haven’t seen. Sit through it. Watch where each message actually lands. Mac’s agent had run fine weekly before the monthly audit failed, so check the edge cases too: the new month, the longer report, the different schedule. Treat an untested workflow like code you haven’t compiled yet.
6. Know exactly where the off switch is
After the leak, Mac disconnected everything: Google, calendars, banking, Stripe, all of it. That’s the right instinct. If you can’t revoke an agent’s access in under two minutes, you’ve given it too much. For a broader checklist, the local AI security fixes guide covers the same discipline for tools on your own machine, and Nvidia’s OpenShell applies it to agent frameworks at work.
If your agent already leaked something
Act fast and in this order. Delete the message everywhere it landed. Revoke the agent’s access, then reconnect it with narrower permissions. Tell anyone who saw the data, because your head of product finding out second is how trust dies. Check the platform’s audit logs for anything else the agent touched while it had access.
What xAI fixed, and what it didn’t
The platform-level fix is real: explicit permission grants before an agent can move information across channels. Expect every other agent platform to copy it within months, the same way phone apps now ask before using your location.
What no platform can fix for you: the fact that one person can wire a personal finance agent into the same identity they use at work. That boundary is yours to draw. Honestly, the CFO agent itself sounds great. I’d run one. But mine would get a dedicated email address, a separate chat space, and read-only access to a single account. Not two.
The same pattern exists on other platforms
Don’t file this under “Grok Bot problem.” The architecture Mac tripped over is everywhere. Most agent platforms keep one connections page per account: your Google login, your Slack workspace, your cloud storage. Build three agents on top and all three inherit the same plumbing. They present themselves like separate employees with separate keycards. They’re actually one person holding three badges to the same building.
So before you trust any agent with anything sensitive, look past the agent to the connection layer underneath it. That’s where the blast radius actually lives, and it’s the part nobody demos in the product tour.
The takeaway
AI agent privacy isn’t about distrusting the model. It’s about assuming the plumbing will fail eventually, then arranging things so the failure is boring. Spend ten minutes today listing your agents’ connections, kill anything you don’t recognize, and hardcode destinations for everything that sends. Future you, barn budget and all, will be glad you did.
