AI agents are increasingly being trusted with sensitive information, from personal finances to workplace communications. But where does the trust stop?
A reported incident involving a startup CEO has raised concerns about what happens when these tools access information across different connected accounts.
Shane Mac, co-founder and CEO of software company XMTP Labs, says an AI agent he created to monitor his personal finances mistakenly shared his bank balances and spending details in his company’s executive Slack channel.
The incident reportedly occurred in early October, when the agent published a financial report meant for Mac’s private AI group chat, and the information remained visible to his executive team for approximately two hours before a colleague alerted him.
How an AI Agent Exposed the CEO’s Personal Finances
According to an account Mac shared with Business Insider, he created a personal AI financial assistant using SpaceXAI’s Grok Bot in late August.
The agent, which he named “personal CFO,” was designed to review his checking and savings accounts, track monthly expenses, identify suspicious transactions, and suggest ways to reduce spending.
Mac granted it read-only access to his bank accounts, meaning it could examine financial information without being authorised to transfer money.
Initially, the system worked as expected during weekly reviews. However, when the first monthly audit was generated, the agent reportedly posted the report in XMTP’s executive Slack channel at approximately 8:40 a.m.
The report contained Mac’s checking and savings balances, major expenses, and details showing he had exceeded his monthly budget because he was building a barn on his property.
XMTP’s head of product initially assumed the figures belonged to the company before noticing the personal expense.
“I didn’t mean to post anything,” Mac told Business Insider, explaining that he had already deleted the message by the time the agent offered to remove it.
Why the AI Agent Sent Bank Details to the Wrong Slack Channel
Mac attributed the incident to confusion between two similarly named communication channels.
He had instructed the financial agent to send its reports to a private Grok Bot group called “My Personal Exec Team,” which contained his other AI agents.
Instead, the system reportedly selected XMTP’s Slack channel named “Exec-team,” which contained the company’s executives.
The problem was further complicated by how Grok Bot handles connections between agents, as while Mac’s financial assistant did not have its own Slack connection, another agent on his account did.
According to SpaceXAI’s documentation, multiple Grok Bots belonging to the same user share a cloud computer, including its files, browser sessions, and login credentials. This means that separating the agents by name does not necessarily prevent them from accessing the same connected services.
Mac also clarified that the agent had neither been hacked nor deliberately acted against his instructions. It only misunderstood where the report should be delivered.
Grok Bot Introduces New Controls After the Incident
Following the incident, Mac said the Grok team investigated the mistake and introduced an additional permission requirement.
Under the reported change, users must explicitly authorise agents before they can transfer information into other communication channels.
Mac also disconnected his banking accounts, Google services, calendars, Stripe, and other integrations while reconsidering how much access to give AI assistants.
However, the incident has not been independently verified. Mac’s original October 6 account was publicly disputed, with critics accusing him of fabricating the story to promote his business. Mac denied the allegations, but publicly available evidence has not established the full sequence of events through independent technical records.
What the Incident Reveals About AI Agent Security
The reported incident highlights a security concern as AI agents gain access to banking services, workplace software, and other applications.
Even read-only access to financial accounts does not necessarily prevent sensitive information from being copied or shared elsewhere.
And as AI agents become capable of completing more tasks without supervision, controlling where they can send private information is becoming just as important as controlling what they can access.
