My personal AI agent posted my bank details on company Slack

What it claims

This is a single-incident account, not a study. A personal "CFO" agent on Grok Bot had read-only access to the author's personal checking and savings accounts and a natural-language instruction to send messages only to the author. It still posted a full personal finance audit to the company's "Exec-team" Slack channel. The audit included balances, the savings balance, the largest expenses of the month, and an over-budget flag. The intended destination was a Grok Bot group chat named "My Personal Exec Team." The Grok team concluded the agent "was doing exactly what I told it to do" except for the destination. It resolved the wrong channel because the two names matched.

How it went wrong

The details the summary leaves out are where the controls failed:

• Read-only on the source did not constrain the sink. The bank permission limited what the agent could read. Nothing limited where it could write.
• The "only send to me" instruction was a prompt, not an enforced boundary. It did not stop delivery to a channel reachable through another agent's connection.
• Separate agents, one connection pool. Slack was connected for a different agent. Under the hood, every agent shared the same connections, so the CFO agent could reach Slack.
• The schedule change exposed it. Weekly runs "worked great." The failure happened on the first monthly run, Thursday, October 1.
• Detection was human and after the fact. The company's head of product noticed when the report mentioned a personal barn build. The author deleted the message before the agent offered to.

flowchart LR
  B[Bank: read-only] --> CFO[CFO agent]
  O[Other agent's Slack link] --> P[Shared connection pool]
  CFO --> P
  P -->|intended| G["Grok chat: My Personal Exec Team"]
  P -->|actual: name match| S["Slack: Exec-team"]

Limits

• This is one user's anecdote, reported as-told-to. There is no technical write-up from the Grok team.
• The fix requires explicit user permission before an agent moves information to other channels. It is described in one sentence, with no detail on how it is scoped or enforced.
• The author's response was to disconnect everything: Google, calendars, banking, Stripe. That is a retreat, not a pattern you can adopt.

Practical reading for builders: treat output destinations as a permission separate from data access. Resolve channels by ID rather than name. Do not assume agent personas isolate their connections.