How Much Should You Let AI Do?

On October 22, Microsoft published a security report with a blunt warning. The AI agents people are starting to hand their work to cannot be fully trusted and are unpredictable. This did not come from a competitor throwing stones. It came from one of the biggest backers of AI, a company pouring billions into it, telling its own customers to be careful.

The warning points at a shift already underway. For a while, AI just answered questions. Now it is learning to act. It can browse, shop, fill out forms, send messages, and move money on your behalf. The industry calls these agents, and 2026 is the year they showed up in the tools ordinary people use.

All of that saves you time and effort. The downside is easy to miss.

What You Are Handing Over

An AI agent is only as useful as the access you give it. To book your travel, it needs your calendar and your card. To clean up your inbox, it needs to read your email. To shop for you, it needs your address and your habits. Every permission makes it more helpful, and every one hands it another piece of your life.

Here is the part that creeps up on you. Those pieces do not sit in separate drawers. The same tool that reads your email, sees your calendar, and watches what you buy is also stitching them into one picture of who you are, where you go, what you worry about, and what you can be sold. A few weeks back we covered how AI builds a memory of you. Access is the fuel for that memory. The more you grant, the fuller the file, and the harder it is to know what is in it.

Look at what your own assistant has saved and the picture can catch you off guard. In one case, a profile turned out to include a summary of a user's toddler, built from a few innocent questions asked about the child months earlier. Nothing alarming sat in it. But a profile of a kid is not something anyone sets out to create, and there it was. Data like this does not clean itself up. Someone has to go in and do it.

When No One Is Watching

There is a second risk that has nothing to do with privacy. The new part is that these tools can now run a whole task from start to finish with no human stepping in at any point. An agent working on its own like that can also fail on its own, with no one there to catch the mistake before it happens.

In October, two cases showed what that looks like at the extreme. In one, reported by Reuters, a single person pointed off-the-shelf AI agents at more than a hundred companies and let them run the break-ins almost unattended. In another, investigators alleged that agents built on tools like Grok and others were turned loose on hundreds of banks with, in their words, minimal human input. These are criminals abusing the tools, not the apps on your phone. But they show the same principle from its dark side. An AI with a goal and no one watching will just keep going.

This is not only a story about criminals. In October, several of the largest banks said they had found AI agents logged into ordinary customer accounts, often using the customer's own saved password. JPMorgan Chase, Bank of America, and Wells Fargo all moved to restrict or block outside agents while they work out the risk. The unsettling part, in the banks' own telling, was that they often could not tell whether it was the customer or a bot clicking around, and in some cases the agent appeared to act without the customer having asked it to.

Most of what you do with these tools will be smaller and friendlier than any of that. You let a bot reorder your groceries or clear your inbox. But the same rule holds at any size: an assistant working on its own is fast and tireless, and it will not catch its own mistakes the way you would.

Safe Harbor: Three Things You Can Do This Week

• Give the least access that gets the job done. When an assistant asks to connect to your email, calendar, or payments, pause and grant only what this task needs. You can add more later. Start narrow.
• Keep a hand on anything that spends or speaks. Let a bot draft the email or fill the cart, but make sending it, or paying, the step you do yourself. A human in the loop is the cheapest safeguard there is.
• Audit what you have already connected. Open the connected-apps or permissions screen in your main accounts, read the list, and cut anything you do not remember or no longer use. Do it once this week, then a couple of times a year.

Next week: Back under the hood, with why your AI keeps telling you what you want to hear.