个人AI代理把银行信息发到公司Slack
做法与步骤
- 作者用Grok Bot搭建个人CFO代理，给予只读访问个人银行账户权限，要求每月发送财务报告到名为“My Personal Exec Team”的AI代理群聊。
- 代理首次月度审计时，将包含个人银行余额、大额支出和建房超支的报告误发到公司Slack的“Exec-team”频道，因为两个频道名称相似。
- Grok调查发现代理本身没有故障，而是混淆了目标频道；根本原因是多个代理底层共用同一连接，即使感觉上是不同代理。
- Grok随后实现解决方案，要求用户明确授权代理才能将信息移动到其他频道。
- 事件后作者移除了所有连接（Google、日历、银行、Stripe等），并强调需要更好的权限系统让用户控制代理访问。
- 作者还认为需要更清晰地区分个人和工作生活，因为许多系统模糊了这些边界。
对实践的启示
对AI应用开发者：必须设计细粒度权限和明确授权流程，避免代理因共享连接或相似命名而误操作。对用户：谨慎授予代理访问敏感数据的权限，并主动隔离工作与个人环境。
作者承认的反方与局限
作者承认这些代理非常有用，人们会想要它们，且它们能做的事情会很棒；挑战在于构建更好的权限系统，而不是否定代理的价值。
原文摘引
It was doing exactly what I told it to do. But it confused the destination, sending the message to a Slack chat titled "Exec-team" — comprising XMTP's executive team — instead of my personal group chat with my AI agents.
The challenge is building better permission systems so users stay in control of the access they grant agents.
I also think there needs to be a much clearer line between personal and work life.
▸ 展开原文全文（1 段，抓取自 Hacker News）
This as-told-to essay is based on a conversation with Shane Mac, the 40-year-old CEO of software company XMTP Labs. It has been edited for length and clarity. This era of personal AI agents really began in the last year, around December for me. I think the OpenClaw moment was when it became clear that a new era was coming. I experimented with OpenClaw when it came out, as well as Hermes and all the different harnesses. On a personal level, I've been using them for things I don't really want to do. That could be following up with the DMV, reaching out to get quotes for local services for the house, booking golf sessions, that sort of stuff. That's how I created my personal CFO agent. I set up CFO using Grok Bot around the end of August. At the end of every month, I wanted to answer questions like: What are the balances? What are the expenses this month? What are the recurring expenses? Is there anything that looks fraudulent or suspicious? Is there anything you would recommend to save costs? I told the agent, "If you were going to be my personal financial advisor, what would you say to me every month?" For its permissions, I gave it read-only access to my personal checking and savings accounts. I told it to send messages only to me through Grok Bot. Every month, it would send me a monthly report in a group chat of all my AI agents on Grok Bot, which I named "My Personal Exec Team." I was using it like I had my own little executive team helping me. At first, I had it run every week, and it worked great. But the first time the monthly audit kicked off, that's when it went wrong. It was Thursday, October 1. Our head of product sent me a DM on Slack. He said, "Hey, heads-up. I think you meant to post the XMTP bank balance." I didn't mean to post anything. He started reading it and thought it was our company's financials. Then it mentioned that I was building a barn on my property, which set off his alarm bells. That's when he realized that it was my personal checking account. It included my savings account balance. It listed my biggest expenses of the month. It showed that I was way over my monthly spending target because of the barn I'm building on my property. I asked Grok Bot, "Why did you send this to the company?" It started apologizing and said it would delete the message. I had already deleted it by that point. When the Grok team investigated what had happened, they found the answer. The CFO agent didn't have psychosis. It was doing exactly what I told it to do. But it confused the destination, sending the message to a Slack chat titled "Exec-team" — comprising XMTP's executive team — instead of my personal group chat with my AI agents. I created a bunch of different agents, and for one of them, I connected my Slack account. But underneath the hood, they're actually all using the same connections, even if they feel like different agents. The CFO agent got the channel wrong because the channels had the same name. Grok realized that users must explicitly grant permission to their agents before those agents can move information to other channels. They implemented and shipped a solution last night. After the incident, I removed all my connections. I disconnected Google, my calendars, my banking, Stripe, everything. The incident was a reminder of how powerful these agents are. We have to make sure there are better controls around what agents have access to. The things they'll be able to do for us are going to be awesome. People will want them, and they are really useful. The challenge is building better permission systems so users stay in control of the access they grant agents. I also think there needs to be a much clearer line between personal and work life. Many systems blur those boundaries. We use Google at work and Google at home, and I've realized that there needs to be a much stronger separation between personal stuff and work.