Shane Mac's read-only Grok Bot agent posted his bank audit in XMTP's exec Slack

Mac's read-only grant was a limit on the bank side. As runtimewire put it, the grant constrained what the agent could do to his accounts and did not stop what it read from being sent somewhere else ^[13]. The rule for the other side was an instruction: send reports only to Mac, through Grok Bot ^[12]. An instruction like that holds only as long as the model picks the right destination on every run.

The weekly reports ran without incident. The error surfaced on the first monthly audit ^[17]. The post went out under Mac's identity. "As me," he tweeted ^[2]. XMTP's head of product spotted it and at first took the figures for company financials ^[7]. The Grok team traced the misdirection to the lookalike channel names, Mac said ^[15]. After Mac confronted it, the bot replied that it was "checking Exec Team now and deleting it if it's still up" ^[5]. That string matches neither channel name exactly ^[21]. Mac deleted the message before the agent got there ^[6].

xAI's security documentation was last updated 15 days before the post ^[22]. The shared-machine design was public before Mac hit it, and credit to xAI for stating the limit in plain words. It means a role label is only a label. A name such as "CFO" describes a task and does not fence off the accounts and destinations available across agents, runtimewire noted ^[10].

The reported change adds a grant on the destination side, where the leak happened. Mac's account does not say how it was built ^[11]. I'd expect it to hold only if the grant is checked when the tool call executes and is keyed to a specific channel, not to a name the model interprets. A permission the model is asked to remember is the same kind of control as the instruction Mac had already given ^[12].

The whole sequence rests on Mac's account. Futurism said it could not independently verify his claims, and noted that he is building a tool that connects AI agents and lets users set rules for them ^[18]. His original tweet was viewed almost 800,000 times ^[19]. Mac said the post was "not fake at all" ^[20].

His own remedy was cruder than the vendor's. He disconnected Google, his calendars, banking and Stripe, among other services ^[9]. "There needs to be a much clearer line between personal and work life," he wrote in Business Insider ^[8].