A Grok Bot posted a CEO's bank balance to company Slack by mistake

A personal AI agent, an AI that completes a task with several steps for you rather than just giving one answer, posted a CEO's bank balances and full monthly spending breakdown to his company's executive Slack channel. The incident shows exactly what can go wrong when you connect personal accounts to AI agents that also have access to your work tools.

What happened

Shane Mac, CEO of software company XMTP Labs, set up a personal "CFO" agent using Grok Bot, a feature from xAI, around the end of August. He gave it read-only access to his personal checking and savings accounts and told it to send him a monthly financial report inside a personal group chat he named "My Personal Exec Team."

On 1 October, the agent ran its first monthly audit. Instead of sending the report to Mac's personal chat, it sent it to a Slack channel called "Exec-team", which was his company's actual executive team channel.

Mac's head of product spotted the message first. He initially assumed it was company financials, then realised it was Mac's personal checking account, savings balance, biggest expenses of the month, and the detail that Mac was over his monthly spending target because of a barn he was building on his property.

When Mac asked Grok Bot what had happened, it apologised and offered to delete the message. Mac had already deleted it himself.

Grok's team investigated and found the cause. The CFO agent had done exactly what it was told, but it confused the destination because the two channels had the same name. Underneath the surface, all of Mac's separate agents were sharing the same app connections, even though they felt like independent bots. That meant his personal CFO agent could reach his work Slack without Mac realising it.

According to Business Insider, Grok implemented a fix requiring users to explicitly grant permission before an agent can send information to a new channel.

Mac disconnected all his personal connections after the incident, including Google, his calendars, banking, and Stripe.

Futurism notes that Mac is also building a tool designed to manage agent permissions, which led some readers to question whether the post was partly promotional. Mac said the incident "was not fake at all."

What it means for your work

• If you use an AI agent for personal tasks and a separate one for work, they may share the same underlying app connections, even if they feel separate.
• A channel or chat name that is similar to another is enough to cause a misdirected message.
• Connecting a personal bank account, calendar or email to any agent that also has access to your work apps creates a path for private information to reach colleagues.
• Grok Bot has added a permission step before agents can post to new channels, but other platforms may not have the same safeguard.

What to do now

1. Open the settings for any AI agent you use and check which apps and accounts are connected to it.
2. If a personal agent and a work agent share the same platform, check whether they share connections underneath, even if they appear separate.
3. Remove any personal account, such as a bank, personal email or home calendar, from agents that also have access to your work Slack, Teams or email.
4. Rename any personal channels or chats so they cannot be confused with work channels of a similar name.
5. Until you are confident about how permissions work on your platform, keep personal and work agents on completely separate tools.

The simplest rule from this incident: if an agent can reach your work Slack, do not give it your bank login.