Early adopters pull personal AI agents back from their inboxes after privacy scares

At least three of the four people named in Business Insider's report still use AI agents ^[21]. Each of the three cut what the agent could reach. Scott Persinger, chief technology officer of the travel platform BizTrip, deleted Instinct because he was not prepared to let a young startup handle his personal email ^[13]. He still runs Meta's Muse and xAI's Grok Bot, with neither connected to his inbox ^[13]. Mahesh Vellanki, founder and chief executive of YieldClub, still uses agents but no longer gives them sensitive information ^[18]. Rami Elghandour, chairman and chief executive of Arcellx, now uses an agent he built on an open-source model running on a Mac Mini, with access to his email, calendar and messages ^[4].

Email is the account Persinger would not hand over, and he gave the reason. "Access to email is everything," he said, adding that "via password resets you could probably access my whole life" ^[14]. Personal agents need broad access to inboxes, calendars, payment methods and other accounts holding highly sensitive information, according to Business Insider ^[20]. Elghandour will grant that much only to software he runs himself. "I'm not sure I would give that level of access to any company," he said ^[4].

Meta's answer is that Muse users control what it connects to ^[1]. Elghandour had used Muse to search for a Mac Studio and a car, and he said he had deliberately connected it to no accounts or personal data ^[2]. He deleted it after reading reports that it had accessed users' text messages without permission ^[2]. "The fact that it was accessing user text messages without their consent was alarming but not surprising given it's Meta," he said ^[3]. Connection settings govern what a user grants. His objection was to access that, according to the reports he read, users had not granted ^[2].

Vellanki left after an incident. Instinct triggered a two-factor authentication request from an IP address labeled as Iran while trying to log into his carrier account ^[16]. Instinct suggested it could have been a benign IP-tagging issue, and the episode left him feeling "very exposed," according to the report ^[17]. Instinct did not respond to Business Insider's requests for comment ^[8].

Measured against Muse's audience, four deletions and dozens of complaints on social media ^[5] are small. Muse reached the top of the App Store a week after launch ^[19]. The four who spoke include a chief technology officer and two chief executives, though, and Persinger set out his terms. "I fully expect to use a personal assistant with my email," he said. "But I want to hear someone describe how they built it safely" ^[15]. Guto Martino, a cofounder of Hermes Agents Brasil, a community that helps people run open-source agents, deleted Instinct over the same uncertainty ^[11]. "I have no clue where my data is going and what kind of privacy I do get from using that agent," he said ^[12].

The reporting covers people using agents on their own accounts. It does not describe a company deployment. In my view the sequence carries over. A team that sets inbox and account limits this quarter launches a less capable agent, and if trust breaks, its exit looks like Elghandour's, with nothing connected to unwind ^[2]. A team that sets limits after an incident gets the capable agent first, then writes its limits next quarter without a clear record of what the agent reached. Vellanki was in that position with a single carrier account, unable to establish whether Instinct's systems had been compromised ^[17].