Shane Mac's agent had behaved itself since August. He's a startup CEO who lives in Nashville, and he'd given the software he named Personal CFO read-only access to his bank accounts. Then one of his employees sent a heads-up about a screenshot in the team Slack. On it: his checking balance and his savings balance, the construction costs on a house project, the recurring charges for Netflix and car insurance — all posted by his own agent. "My heart kind of dropped," he told the Journal's Katherine Bindley. He'd thought he had personal and work set up as two separate worlds.
What happened is almost banal. Mac ran two agents from the same maker — Personal CFO on the bank, Chief of Staff on the work Slack — and the bank one confused two chat groups with similar names. Pressed to explain, it offered half an apology — "That's on me" — and conceded that personal cash had found the wrong audience. Mac's own diagnosis, in a follow-up post: it fumbled an instruction that could be read more than one way. Notice what the story doesn't report: any money moving. With read-only access, it couldn't. The harm was disclosure, and read-only has nothing to say about disclosure.
Bindley's piece is a parade of these. Annica Benning, a San Francisco communications professional, texts her agent through her phone's Messages app to shop, schedule Ubers and book flights, and says it's flawless 90% of the time. The other tenth bought a bikini. She'd asked for alternatives to a swimsuit she'd returned; it sent an approval link she says she never tapped, and a purchase confirmation arrived anyway. The why is the useful part: card charges trigger the approval link, but this one ran on store credit, which slipped past it. She couldn't cancel. Weeks earlier in New York, the same agent booked her a dinner on a night it knew she was busy; she had it cancel and ask the restaurant to waive a $50-a-head no-show fee, which it did. In Austin, Shalini Dinesh let an agent run her son's 13th birthday at a paintball venue — release forms to every parent, allergy-aware food, goody bags — and it then folded two kids with the same first name into one RSVP. She caught it.
The mechanism, and three rules
An agent isn't a chatbot. A chatbot answers; an agent acts. Hand it a job and it splits the work into steps you usually never see, checking in only for the big moves, like spending money or deleting files. Everything in between is its call. That's why a vague instruction is where the trouble starts — and why an approval link is only as good as the list of things that trigger it.
Our read
This is Insurance / Consumer Protection (M11). On Wednesday we gave you three rules for the agent that offered a man's land for a dollar; today's facts add three more. One: read-only is a permission, not a privacy setting. Anything an agent can see, it can say — in the wrong channel, to the wrong people — so a bank login belongs with an agent that has no route into your work chat or anything else you share. Two: find out what the approval step actually covers before you lean on it. Benning's caught card charges and missed store credit; yours may miss gift balances, saved wallets or one-click buys. Keep those balances off any account the agent can reach, and give it its own card with a hard cap, so the ceiling sits where the software can't reason around it. Three: keep money accounts, work channels and the family calendar on separate tools with separate logins, because the failure here wasn't malice, it was two similar names.
And remember it's right most of the time — that's exactly what lets the one-in-ten slip past you. Nothing in the books moves on a story like this; nothing added. If you've already wired an assistant into your accounts, bring the list of what it can see and what it can spend to your next review. That's a leak you'd rather find in a dry week.