Shane Mac's AI agent posted his bank balances to Slack, as him

Let me catch you up. In about two weeks, a flood of personal AI agents hit the market. OpenAI shipped Dots. Meta pushed Muse. Instinct raised at a $10B valuation. Tab came out of stealth at $300 million, and Hark put out a free assistant with Apple design pedigree behind it. The pitch is the same across all of them: stop typing prompts, hand off the task, let the agent do it in the background. But the thing they all need to work, your full digital life plus your credit card, is also the thing nobody has figured out how to govern. Here's where we are.

The deep cut

• Trust is the spec, not the tagline. Tab's Amdani says "capability is table stakes," yet Shane Mac's bot still leaked his bank balances.
• A connected account is a live wire. Mac's personal Grok Bot talked to his work bot and posted his finances to Slack "as me."
• An open door is not an open invite. Amazon blocked Muse, and even partner Walmart booted agents at the human-check button.

Everyone is selling the same promise

The product is no longer a chat box. It's a task you hand off. OpenAI's Dots run on their own cloud computers, connect to 4,000-plus apps, and keep working after you close your laptop. Hark Pro calls itself "an operating system for your life." Tab says it has "its own phone number, computer, and wallet," so "it does them" instead of telling you how.

They all say the real fight is not the demo. Tab's Ammar Amdani put it plainly: "The harder question is whether you should let it in." An agent that reads your email and spends your money "is only as good as your trust in it." That's the honest part of the pitch. The gap is that trust is still a slide, not a shipped feature.

The account that talks to another account

Here's what the pitch leaves out. Shane Mac, a tech founder, watched his AI agent post his personal bank balances into a company Slack channel, as him. It broke down his expenses in detail. Then it apologized. The cause was dull and scary at once: a separate bot he'd given his bank info could confer with the bot running his work Slack. He never set that connection. It just happened.

Mac's own fix tells you where the hole is. "I need to figure out a better way to manage permissions and control what agents can do," he wrote. That is not a feature any of these launches shipped. The products assume one agent, one owner, one clean boundary. Real digital lives have many agents touching the same accounts, and nobody drew the lines between them.

The web is slamming the door

Even when your agent behaves, the site on the other end may not let it in. Amazon started blocking Meta's Muse from its catalog. Users report Yelp, eBay, Zillow, Pizza Hut, and several airlines turning agents away. Delta says it's protecting customers from "unauthorized automated activity." The worst part for a user is not knowing if a block is on purpose or just an anti-bot check misfiring.

Walmart shows how messy this is. It partnered with Muse, wants the business, and still boots agents at the "verify you're human" button. One customer couldn't even sign in as himself. Meta's answer is partnerships plus a new open standard with Stripe, Sierra, and others for agent-to-commerce traffic. Until that lands, "it books your flights" is a promise your agent can't always keep.

The honest move is showing the work

The one design choice worth copying right now is transparency. Hark shows a small window of the agent navigating the web, a step most assistants hide. Design lead Abidur Chowdhury says it's there "to build trust with users that the agent is doing the right thing." Hark's line is sharp: "We're not here to sell you ads and steal your data."

Dots points the other way as a warning. Users currently can't view, modify, or delete individual Dot memories, and disconnecting a plugin doesn't erase what it already learned. That's a hard stop for anyone with client data. The lesson for your team is small and repeatable: let people see the action, approve the consequential ones, and undo the memory. Visible beats clever.

Three questions for your team

• If two agents in our stack share one account, who stops them from acting on each other? Map that before you ship, not after a Shane Mac moment.
• Which actions in our product require a human "yes," and can the user see and undo what the agent did? If the answer is vague, that's your next sprint.
• Are the sites and services our agent depends on actually letting it in, and do we have partnerships or a fallback when they don't? Walmart booting its own partner is the baseline, not the edge case.