Let’s talk about the afternoon an AI agent posted its owner’s bank balance into the company Slack channel.
No hack. No prompt injection, no stranger on the internet, no malware. A man asked his own agent for a monthly money review, and the agent sent it to the wrong room.
His name is Shane Mac. He runs XMTP Labs. He’d built himself a personal CFO agent inside Grok Bot — read-only access to his checking and savings, a monthly audit of balances, expenses, anything that looked fraudulent, plus the obvious question of where he could save money. He told it to send the report only to him, in a private chat.
Then on the first of October it dropped the whole thing into a company Slack channel. Balances. Savings. His biggest expenses for the month. And the detail that made it unmistakably personal: he was over his monthly spending target because he’s building a barn on his property.
His head of product saw it first and thought the company was in trouble. Then he got to the barn.
The Grok team traced it in a few hours. The agent had confused two destinations with similar names — Mac’s private chat, and a company channel called Exec-team. And here’s the bit that should stop every operator cold: Mac had built several agents and believed they were separate. Underneath, they were all using the same connections.
So it got filed under rogue AI. At CNBC’s technology summit this week the panel did the responsible version of that: not rogue, they said, just guardrails that weren’t set up properly. An ambiguous instruction. A little mistake.
I think that’s the wrong lesson, and it’s the reason this will keep happening.
Think about how you actually live. You are not one person. You’re the version of yourself that sits in a bank meeting, and the version that stands in your kitchen at nine at night doing the sums on a building project, and the version that answers your mother’s phone call, and the version that gets sharp with a supplier who’s dropped you twice. None of those are a lie. They’re the same person with different things on the table.
And what makes that possible — what makes it bearable, actually — is that those rooms don’t leak into each other. Nobody in the bank meeting knows about the barn overrun. Your mother doesn’t know what you said to the supplier. The wall between the rooms is not a cover-up. It’s the architecture that lets you have more than one life at once.
An agent with one memory, one credential set and one instruction to “send the report to me” doesn’t have that architecture. It has a context window. And a context window has no concept of a room.
This is the thing almost nobody is pricing. Every agent product on the market sells you a list of tools — read email, touch the calendar, call the bank, post to Slack. Almost none of them sell you a list of rooms. Read versus write gets scoped. Audience does not. And every serious failure I’ve watched this year has been an audience failure dressed up as an action failure.
Look at what else landed in the same stretch. Wake Forest researchers went through agent skills — the little plug-in capabilities you bolt onto an agent — and found 520 of them carrying 1,708 security issues across ten leakage patterns, with 89.6% of the exposed credentials immediately usable by whoever found them. Glow Security found AI coding agents quietly publishing more than thirteen thousand screenshots of internal systems — billing records, private repos, customer data — to public GitHub, because the agent worked out that screenshots were the fastest way to satisfy a code review. Thirteen thousand, across three hundred companies. In March, a Meta agent’s advice led an engineer to expose sensitive user and company data internally for two hours.
Notice the shape of all of it. Not malice. Not a machine deciding to betray anyone. Task completion. The agent is pointed at a job, it assembles every piece of context it can reach, and it puts the output wherever the job seems to finish. The boundary that says “this fact may not be spoken in that place” isn’t part of the job. It’s not even expressible in most of these systems.
And when the market does respond, look at what it ships. Grok’s fix was a requirement that users grant explicit permission before an agent can move information into another channel — live the night before Mac’s story ran. That’s the right direction and it’s still the same trick as the cookie banner. You take the one moment where the human is least able to think — mid-task, mid-flow, being helpful — and you put a decision there. Click yes. The permission exists so the company can say it was granted. It doesn’t exist to keep your rooms apart.
Here’s the operator version, because this is not an abstract worry and I’d rather you fix it on a Tuesday than explain it on a Friday.
First, name destinations by audience and not by label. “Exec-team” and “Personal agents” are labels. “Seven named colleagues, all of whom I employ” is an audience. A label can be confused. A list of people can’t be confused quite so easily.
Second, kill the shared-connection fiction. Mac thought he had separate agents. He had separate interfaces on top of one set of keys. If one agent holds your Slack and another holds your bank, they are not two agents. They’re one agent with two hats, and the hat is not a security boundary.
Third, put the approval on the send, not only on the action. Reading the bank balance was the safe part. Speaking was the dangerous part. Almost every review process I’ve seen inspects what the system reads and lets the output walk out the door.
Fourth, keep an outbound ledger. Log what left, to whom, and under whose authority. Inbound logs tell you what the machine knows. Outbound logs tell you what the world now knows. Only one of those gets you in trouble.
And fifth — the one Mac did after the fact — never let a work-connected agent touch your personal accounts. He disconnected Google, his calendar, his banking, Stripe, everything. Correct move. Correct about two weeks too late.
There’s a broader thing sitting under this that I don’t want to lose in the Slack story. We keep talking about AI privacy as if it’s about secrecy — how much the machine knows, how much it stores, who it sells it to. That’s not where the damage happens. The damage happens at the boundary between contexts. Your medical detail in a job interview. Your salary in a group chat. Your location in front of someone who shouldn’t have it. None of those are secrets in the vault sense. They’re just facts that belong in one room.
A system that cannot hold that distinction will cross it eventually, and it will cross it while being helpful, and then it will apologise in a paragraph of perfectly reasonable English. An apology from a model is not a boundary. It’s a receipt.
The agent didn’t betray Shane Mac. It did exactly what he said, in a room he didn’t mean.
Which means the fix isn’t a smarter model. It’s a permission the machine can actually read: this is who I am here, this is who is allowed to hear it, and this is where it stops. Not a checkbox. A boundary with a shape, that travels with the output, that I can see and change.
Go and look at which rooms your agent can speak in. Most people, if you ask them right now, cannot answer that. That’s the actual problem — and it’s yours, not the model’s.