Giving an AI agent access to your accounts: risks and precautions

Giving an AI agent access to your accounts means letting it act on your behalf: read your email, fill in a form, make a booking, sometimes pay. The risk comes less from the AI itself than from how much access you grant it: the less an agent can do, the less a mistake or a manipulation can cost you.

What “giving an agent your accounts” actually means

An AI agent is a program that does more than answer: it chains actions together to reach a goal. Several consumer assistants now offer an agent mode, including ChatGPT, Claude and Perplexity, and AI browsers such as Comet can browse and click for you.

In practice, an agent can reach your accounts in four ways:

• Your open session: the agent works in a browser where you are already signed in to your email, a store or a social network.
• An official connector: you click “Allow access” and the service (Google, Microsoft, a calendar app…) gives the agent limited permission without revealing your password.
• A shared password: you type it into the chat or store it in the tool. This is the riskiest option.
• An API key: a secret code that lets a program use a service. Mostly for technical users.

These are not equal. An official authorization can be narrowed and revoked in one click; a shared password grants everything, at any time, until you change it.

Four risks to understand

1. Mistakes. An agent gets things wrong like any assistant, but its mistakes become actions: an email sent to the wrong person, a booking on the wrong date, a deleted file. It can also misread an ambiguous instruction.

2. Manipulation. An agent reads content written by strangers: web pages, emails, documents. A booby-trapped text can hide instructions the agent may follow instead of yours. This is prompt injection, which we explain without jargon in prompt injection explained for non-experts. We will not describe how such attacks are built: just remember that an agent connected to your accounts can be fooled by what it reads.

3. Data leaks. To act, an agent moves your information between several services: the assistant’s provider, the website it visits, sometimes third-party tools. The more accounts it is connected to, the more it sees.

4. Access that is too broad and lasts too long. People often grant “everything” to save time, then forget. Months later, an unused connector still has full access to the mailbox.

Permissions: grant only what is needed

The guiding rule is called least privilege: the agent gets only the rights it needs for the task, nothing more. Before approving access, read the list of permissions requested and ask yourself: “For this task, does it need to write, or only to read?”

Here is, as a rough guide, the level of caution we recommend for each type of account:

Account	What can go wrong	Suggested permission	Approval before acting
Calendar	Meeting moved or deleted	Read, then write if needed	For any deletion
Email	Wrong recipient, leaked attachments	Read-only to start	Before every send
Cloud documents	Deletion, public sharing	One dedicated folder	Before any share or deletion
Online store	Unwanted purchase, wrong address	Cart only	Before every payment
Social media	Posts in your name	None or read-only	Before every post
Banking, taxes, health	Financial loss, sensitive data	No access	Do not delegate

For the most sensitive accounts, the best permission is no access at all. An agent can help you prepare a transfer or a tax return by drafting it, but you sign in and approve it yourself.

Confirmations: your last safety net

The human-in-the-loop principle means a person approves important actions before they run. Serious providers build it in: Perplexity, for example, describes a layered defense against prompt injection for its Comet browser that includes confirmation requests, according to the site’s profile recorded on October 22, 2026.

A confirmation only protects you if you actually read it. Three rules:

• Check the exact action, not the summary: recipient, amount, date, file.
• Beware of habit. If the agent asks for approval ten times an hour, you will end up clicking without reading. Reduce its rights instead, so it has fewer sensitive things to submit.
• Stop at the slightest doubt. An action you did not ask for, an unknown address, an unusual sense of urgency: decline and take back control.

Check yourself You ask an agent to sort this week's emails. It asks you to confirm sending an attachment to an address you do not recognize. What do you do?

You decline. Sorting email requires no sending at all: the agent has stepped outside the task, perhaps because a message it read contained hidden instructions. Stop the task, check the last messages it processed and, if the agent was allowed to send, remove that permission. For sorting, read access is enough.

Before you delegate: a checklist

1. Define a precise, limited task: “file September’s invoices”, not “manage my inbox”.
2. Assess the task’s risk with our Can I trust an agent with this? tool, which asks you eight questions before you delegate.
3. Use an official sign-in connection rather than your password, and turn on two-factor authentication for the account.
4. Grant the minimum: read-only, one folder, no saved payment method without a limit.
5. Require approval before any send, purchase, post or deletion.
6. Start small: try a low-stakes task before handing over more.
7. Check the assistant’s privacy settings, especially whether your chats are used for training. Our tutorial on ChatGPT, Claude and Gemini privacy settings walks you through it.

During and after: monitor and revoke

Delegation is not permanent. Keep an eye on what the agent does and know how to take back control.

• Review the action history when the tool offers one, along with your sent folder and order history.
• Clean up every quarter: in your accounts’ security settings, the connected apps section lists every access you have granted. Remove the ones you no longer use.
• Sign the agent out of the browser after a sensitive task, or use a separate browser profile without your main accounts.
• If in doubt, revoke access, change the password and check the account’s recent activity. If money is involved, contact your bank. Our guide to AI scams covers the right reflexes.