Should you trust personal AI agents? What security experts say.

Cybersecurity expert Hed Kovetz would love to have a personal AI agent handle some of his administrative tasks and lighten his workload. But he doesn't trust any of the commercially available agents, like Meta's Muse or OpenAI's Dots, with access to his email accounts, banking details, health records and other sensitive information.

"It's tempting to use a personal AI assistant. They access your email, order stuff and pay your bills. I would love to get that kind of help," he told CBS News. "But they could be taken advantage of or decide to go beyond the scope of what they are told to do." 

While Kovetz sees tremendous commercial value in such products, he believes leading technology firms rushed them to market without sufficient security measures. For that reason, he advises consumers to be discreet about what they share with personal AI agents. Yet other AI security experts advise that consumers can use the tools as long as they rely on safeguards and are aware of the risks of providing personal data to an AI agent.  

"I would be careful about giving full access to some of these commercial AI agents," Kovetz said. "I am aware of the fact that their security and privacy are far from being ready. Some consumers say, 'I don't care, I don't have anything to hide.' But that's not true; they still have medical records, bank accounts." 

Such agents are already tremendously popular among consumers. When Meta's Muse first became available last month, it quickly became the most downloaded product in Apple's App Store. But while AI agents promise to save consumers time and even money by reading private correspondence and spending money on a user's behalf, they could also take actions that a user never explicitly authorized, leaving the user with limited recourse. 

For example, it may be hard to know whether your AI agent is working for you or a retailer, Lindsay Owens, a consumer protection expert, told CBS News. She noted that Walmart's shopping agent, named Sparky, boosted average consumer basket sizes by almost 40% compared to shoppers who browse normally. Such data suggests that some AI agents could be trying to upcharge their users, she said.

Here's what security experts say they would and wouldn't let an AI agent do for them.

Should you let an AI agent shop for you?

Lynette Owens, a consumer education expert at TrendLife, an organization formed to protect households in the age of artificial intelligence by informing them about its capabilities and risks, also warned consumers against entrusting personal AI agents with too much access and information about them. 

When it comes to online shopping, she believes AI agents can be extremely useful for researching products and comparing deals, but she cautions against letting them spend money. 

"If you want to offload something like comparing deals, that's OK, but I'm not ready to hand off agency around a purchase, especially a high-ticket one. I wouldn't let it use my credentials like a credit card," she said. 

One reason why she doesn't trust any commercially available AI agent to roam the internet with her credit card in hand is that criminals could trick it. Using what's called a "prompt injection," cybercriminals can trick an AI agent into ignoring its original instructions, such as "Don't spend more than $25." 

Unlike traditional cyberattacks, prompt injection doesn't necessarily require hackers to break into an account or install malicious software. Instead, an attacker can plant instructions in a webpage, email or document that an AI agent encounters while carrying out a legitimate task.

If the agent mistakes those instructions for commands it should follow, it could be manipulated into revealing private information or taking actions its user never intended.

"We've seen an increase in incidents of prompt injections, and criminals are getting more clever about how they're hiding malicious code on websites," Owens said. "We're so excited about these new capabilities, but with any new technology, the security piece always lags."

Media and technology attorney Douglas J. Wood said consumers are liable if they authorize an AI bot to shop on their behalf, and it misinterprets instructions or overspends. 

"If you give an AI agent, e.g., Muse, credit card information, you are making the bot an authorized user with the power to act on it," he told CBS News. "If it exceeds your instructions and spends your money, the card issuer will argue you authorized the purchasing tool."

Under federal law, such an individual would not be entitled to loss protection, Wood explained. 

"Since you can't pursue the AI bot for improper use (it is not an entity that can be sued), your only remedy is to cut it off," he said, adding that by then the harm will have already been done. 

His advice to consumers is: "Don't be lazy."

"Shop the old-fashioned way with the card in your hands. Authorizing an AI agent to use your card is like giving a bank robber the vault combination and telling him to steal only $100," he said.

How much data are you sharing?

New York-based entrepreneur Chris Franco, founder of marketing firm Woodridge Growth, has taken the opposite tack. He said tech companies have been collecting consumers' personal data for decades for various uses, such as selling it to advertisers, who use it to better market their goods and services.

"We've been giving out personal data to ad platforms for the last 20 years, and all we got back was better ad targeting," he told CBS News. "With these agents, you're sharing information, but the benefits are greater. It's a trade-off, but it's a much better deal."

To be sure, he wouldn't feel comfortable giving a Muse, Dots or Instinct AI agent full rein over his life, and believes it necessary to give it strict instructions while also monitoring its behavior and activity. 

He likened giving an AI agent his credit card details to a parent handing off an exclusive credit card for high-net-worth individuals to a teenager without parameters. Both would be unwise, according to Franco. 

Franco also allows his personal AI agents, including Muse and Grok Bot, to comb through his Gmail inbox. He's tasked them with organizing his receipts into a spreadsheet so that he can manage — and cancel — subscriptions. 

It's a task he'd estimate would take him hours to do manually, if he ever got around to it at all. 

"In 10 minutes, it had found a few I wasn't using. I would have canceled them anyway, but this did it way sooner," Franco said. 

He acknowledges that it has insight into his personal life, including sensitive family matters, but at the end of the day, believes that the benefits of giving AI agents great access to his life outweigh the risks. 

"The upside and pros of giving it context, in my view, are so much greater than whatever sci-fi-like scenarios there are of it going rogue," he said. "I am comfortable with it having that knowledge about me, because it can help me meet my goals faster." 

Ask how it works

Matt Fredrikson, a computer engineering expert at Carnegie Mellon and founder of Gray Swan AI, an AI security company, said he gives his AI agents a fair bit of autonomy but also closely monitors their activity, using tools his company builds.  

"The consumer-facing agents meant for normal people aren't immediately transparent about what they're doing with your data," he said. "But you can ask for that info if you probe them."

Simply ask your agent for a plain-language summary of how it went about completing the tasks it handled for you.

He also likened outsourcing administrative tasks to an AI agent to hiring a human personal assistant, which comes with a similar set of risks. 

"If you have a human assistant, you've built a relationship with them, and there's a reason why you hired them in the first place. You trust them with a certain level of authority and autonomy," he said. 

Simultaneously, when working with a human personal assistant, you're engaging in conversation with them and asking them to explain their thought processes. "You have to do that with these agents as well," he said. 

Columbia Business School psychology and computer science expert Sandra Matz also drew parallels between working with a human assistant and an AI agent. 

"If you wouldn't trust another person to deal with your personal information and process it safely, I wouldn't trust an agent," she said. 

She highlighted one distinct difference between AI and humans, though. 

"What prevents humans from sharing things they know about you is that they might feel guilty or ashamed, or have a negative emotional response to breaking the trust you've built with them," she said. "You can train an agent not to violate your trust, but they may violate it because they don't have guilt."