Cybersecurity expert Hed Kovetz would like a personal AI agent to take care of some of his administrative tasks and lighten his workload. But he doesn’t trust any of the commercially available agents, such as Meta’s Muse or OpenAI’s Dots, with access to his email accounts, bank details, health records and other sensitive information.
“It’s tempting to use a personal AI assistant. They’ll access your email, order things and pay your bills. I’d love to get that kind of help,” he told CBS News. “But they can be taken advantage of or decide to go beyond the scope of what they are told to do.”
While Kovetz sees enormous commercial value in such products, he believes that leading technology companies rushed them to market without sufficient safeguards. For that reason, he advises consumers to be discreet about what they share with personal AI agents. But other AI security experts advise that consumers can use the tools as long as they rely on safeguards and are aware of the risks of providing personal data to an AI agent.
“I would be cautious about giving full access to some of these commercial AI agents,” Kovetz said. “I’m aware of the fact that their security and privacy are far from complete. Some consumers say, ‘I don’t care, I have nothing to hide.’ But that’s not true; they still have medical records, bank accounts.”
Such agents are already hugely popular among consumers. If Meta’s Muse became available first last month, it quickly became the most downloaded product in Apple’s App Store. But while AI agents promise to save consumers time and even money by reading private correspondence and spending money on a user’s behalf, they can also take actions that a user never explicitly authorized, leaving the user with limited recourse.
For example, it can be difficult to know whether your AI agent is working for you or a retailer, Lindsay Owens, a consumer protection expert, told CBS News. She noted that Walmart’s shopping agent, named Sparky, increased average consumer basket sizes by nearly 40% compared to shoppers who normally browse. Such data suggests that some AI agents are trying to trick their users, she said.
Here’s what security experts say they would and wouldn’t let an AI agent do for them.
Should you shop for an AI agent?
Lynette Owens, a consumer education expert at TrendLife, an organization founded to protect households in the age of artificial intelligence by informing them about its capabilities and risks, also warned consumers against entrusting personal AI agents with too much access and information about them.
When it comes to online shopping, she believes that AI agents can be extremely useful for researching products and comparing deals, but she warns that they will cost money.
“If you want to offload something like comparison deals, that’s OK, but I’m not ready to hand off the agency around a purchase, especially a high-ticket. I wouldn’t let it use my credentials like a credit card,” she said.
One reason she doesn’t trust a commercially available AI agent to roam the web with her credit card in hand is that criminals could trick it. Using what’s called a “prompt injection,” cybercriminals can trick an AI agent into ignoring its original instructions, such as “Don’t spend more than $25.”
Unlike traditional cyber attacks, prompt injection does not necessarily require hackers to break into an account or install malicious software. Instead, an attacker can plant instructions in a website, email, or document that an AI agent encounters while performing a legitimate task.
If the agent lacks these instructions for the commands it should follow, it can be manipulated to reveal private information or take actions that its user never intended.
“We’ve seen an increase in incidents of prompt injections, and criminals are getting smarter about how they hide malicious code on websites,” Owens said. “We are so excited about these new capabilities, but with any new technology, the safety concern always remains.”
Media and technology attorney Douglas J. Wood said consumers are liable if they authorize an AI bot to shop on their behalf, and it misinterprets instructions or overspends.
“When you give credit card information to an AI agent, such as Muse, you make the bot an authorized user with the power to act on it,” he told CBS News. “If it overrides your instructions and spends your money, the card issuer will argue that you authorized the purchase instrument.”
Under federal law, such an individual would not be entitled to loss protection, Wood explained.
“Since you can’t prosecute the AI bot for misuse (it’s not an entity that can be sued), your only recourse is to cut it down,” he said, adding that by then the damage has already been done.
His advice to consumers is: “Don’t be lazy.”
“Shopping the old-fashioned way with the card in your hands. An AI agent authorizing your card to use is like giving a bank robber the vault combination and telling him to steal only $100,” he said.
How much data do you share?
New York-based entrepreneur Chris Franco, founder of marketing firm Woodridge Growth, took the opposite approach. He said tech companies have been collecting consumers’ personal data for decades for various uses, such as selling it to advertisers, who use it to better market their goods and services.
“We spent the last 20 years giving away personal data to ad platforms, and all we got back was better ad targeting,” he told CBS News. “With these agents, you share information, but the benefits are greater. It’s a trade, but it’s a much better deal.”
To be sure, he wouldn’t feel comfortable giving a Muse, Dots, or Instinct AI agent his full life, and feels it necessary to give it strict instructions while also monitoring its behavior and activity.
He compared an AI agent’s credit card details to a parent handing over an exclusive credit card for high-net-worth individuals to a teenager with no parameters. Both would be unwise, according to Franco.
Franco also allows his personal AI agents, including Muse and Grok Bot, to comb through his Gmail inbox. He tasked them with organizing his receipts into a spreadsheet so he could manage — and cancel — subscriptions.
It’s a task he estimates would take him hours to do manually if he ever got around to it.
“In 10 minutes it had found some that I didn’t use. I would have canceled them anyway, but this made it happen sooner,” said Franco.
He acknowledges that it has insight into his personal life, including sensitive family matters, but at the end of the day, believes that the benefits of giving AI agents great access to his life outweigh the risks.
“The upside and the benefits of giving it context, in my opinion, are so much greater than any sci-fi-like scenarios being held from it,” he said. “I’m comfortable with having that knowledge about me because it can help me reach my goals faster.”
Ask how it works
Matt Fredrikson, a computer engineering expert at Carnegie Mellon and founder of Gray Swan AI, an AI security company, said he gives his AI agents some autonomy but also closely monitors their activity, using tools his company is building.
“The consumer-facing agents that are intended for ordinary people are not immediately transparent about what they do with your data,” he said. “But you can ask for that information when you investigate it.”
Simply ask your agent for a soft-spoken summary of how they went about completing the tasks they handled for you.
He also compared the outsourcing of administrative tasks to an AI agent to hiring a human personal assistant, which comes with a similar set of risks.
“When you have a human assistant, you’ve built a relationship with them, and there’s a reason why you hired them in the first place. You trust them with a certain level of authority and autonomy,” he said.
At the same time, when you work with a human personal assistant, you talk to them and ask them to explain their thought processes. “You have to do the same with these agents,” he said.
Columbia Business School psychology and computer science expert Sandra Matz also drew parallels between working with a human assistant and an AI agent.
“If you don’t trust another person to take care of your personal information and process it securely, I wouldn’t trust any agent,” she said.
However, she highlighted a difference between AI and humans.
“What stops people from sharing things they know about you is that they feel guilty or ashamed, or have a negative emotional response to breaking the trust you’ve built with them,” she said. “You can train an agent not to violate your trust, but they can violate it because they have no fault.”