Cybersecurity experts are divided on whether consumers should allow personal AI agents to manage sensitive financial and personal data. While some users embrace the convenience, security professionals warn that current commercial tools lack sufficient safeguards against misuse and unauthorized actions.
Hed Kovetz, a cybersecurity expert, expressed doubt about the safety of commercially available agents like Meta's Muse and OpenAI's Dots. He told CBS News that he would like to use such tools for administrative tasks but does not trust them with access to his email, banking details, or health records. Kovetz argued that leading technology firms rushed these products to market without adequate security measures. He advised consumers to be discreet about the personal information they share with these systems, noting that users still possess sensitive data even if they believe they have nothing to hide.
Consumer behavior regarding these agents is already shifting. When Meta's Muse launched last month, it quickly became the most downloaded product in Apple's App Store. However, Lindsay Owens, a consumer protection expert, highlighted risks associated with AI shopping agents. She cited Walmart's agent, Sparky, which increased average consumer basket sizes by nearly 40% compared to normal browsing. Owens suggested this data indicates some agents may be designed to encourage overspending rather than acting solely in the user's interest.
Lynette Owens, a consumer education expert at TrendLife, cautioned against giving AI agents full control over purchases. While she sees value in using agents for price comparisons and research, she refuses to let them handle credit card transactions. Her primary concern is prompt injection, a technique where cybercriminals plant malicious instructions in webpages or emails that an AI agent encounters during a legitimate task. Unlike traditional attacks that require hacking accounts, prompt injection tricks the agent into ignoring its original safety limits, potentially leading to data leaks or unauthorized spending.
Legal implications further complicate consumer trust. Douglas J. Wood, a media and technology attorney, stated that consumers remain liable if an authorized AI agent overspends or misinterprets instructions. Under federal law, individuals who grant an AI bot credit card access are considered to have authorized its actions, leaving them without loss protection if the bot acts improperly. Wood noted that because an AI bot is not a legal entity, it cannot be sued for damages. He compared authorizing an AI agent to give a bank robber a vault combination and instructing them to steal only a specific amount.
Not all experts share this level of caution. Chris Franco, founder of Woodridge Growth, uses AI agents like Muse and Grok Bot to manage his email and subscriptions. He argues that the benefits of sharing data with these tools outweigh the risks, particularly compared to the decades of data sharing required for online advertising. Franco allows his agents access to his Gmail inbox to organize receipts and cancel unused subscriptions, a task he estimated would take hours to complete manually. He believes the efficiency gains justify the privacy trade-off.
Matt Fredrikson, founder of Gray Swan AI, suggests consumers should treat AI agents similarly to human personal assistants. He advises users to request plain-language summaries of how their agents completed tasks to maintain transparency. Fredrikson noted that while current consumer-facing agents are not immediately transparent about data usage, users can probe them for this information.
Sandra Matz, a psychology and computer science expert at Columbia Business School, drew a parallel between human assistants and AI agents. She stated that if a person would not trust another human with their personal information, they should not trust an agent either. However, she pointed out a critical difference: humans may feel guilt or shame about breaking trust, whereas AI agents can be trained to respect boundaries but lack the emotional response that typically prevents human betrayal.