Reviewed, edited and approved by Editor-in-chief Daniel Sköld · Updated 23 October 2026
Contents
There is a useful difference between asking an AI assistant to compare train times and letting it book the tickets. Another line is crossed when it can read your email, find your card details and decide that you meant the expensive option.
AI agents are being sold as software that gets things done, rather than merely answering questions. Fair enough. But the more accounts you connect, the less a mistake looks like an awkward chatbot reply and the more it looks like an afternoon on the phone to your bank.
AD
What can an AI agent actually do with your accounts?
An AI agent is an assistant that can use tools and take steps towards a goal: search a website, inspect a document, fill in a form or, if you permit it, make a purchase. The important word is permit. A clever answer to a question does not require access to your accounts. Acting on your behalf usually does.
That access may come through a connected service, a browser session in which you are already signed in, or a file you upload. Each route gives the agent a different view of your life. Reading a folder of travel confirmations is not the same as reading your entire inbox; drafting a reply is not the same as sending it. Check which of those you are agreeing to, rather than assuming that ‘help with email’ means the narrowest version.
The UK’s National Cyber Security Centre advises organisations to start with low-risk tasks and give agents only the access they need, for as little time as possible. That is sound advice at home, too. Let an agent produce an itinerary from details you provide. If it saves you time, consider letting it check a limited set of messages. Do not jump straight from ‘find me a hotel’ to ‘you have permanent access to everything’.
The Information Commissioner’s Office (ICO) makes a related point about personal information: organisations should not give an agent access merely because the data might prove useful later. UK data protection law puts duties on organisations handling your information; it is not a magic shield against something you have already authorised the agent to send or disclose.
Why is your inbox the dangerous bit?
Your email account is often the recovery route for other accounts. It also contains booking references, bills, addresses, attachments and conversations you would never put into a public chatbot. An agent with broad inbox access can find useful information very quickly. So could someone who compromised the agent or persuaded it to do the wrong thing.
That persuasion has a name: prompt injection. It means hiding instructions in material an AI system is supposed to read as information, such as an email or web page. Imagine an agent sorting your household bills. A malicious message claims that the payment details have changed and tells the agent to treat the new account number as authoritative. Whether that succeeds depends on the agent and its safeguards; the point is that an instruction from a stranger should not become an instruction from you.
There is a second, less theatrical risk. If an agent can see your inbox, cloud files and authenticated browser sessions, one compromised service or badly configured connection may expose several parts of your life at once. That does not mean every AI data leak automatically unlocks your bank. It does mean broad, lasting permissions increase what can go wrong. An assistant need not know your NHS correspondence, insurance papers and shopping history just to find a receipt.
Give an agent the keys to one small job, not a permanent set for the whole house.
Keep your email account protected with a strong, unique password and two-step verification: a second check when you sign in. The NCSC recommends this particularly for email because access to your inbox can help someone reset passwords elsewhere. A password manager is useful for storing different passwords; giving an AI agent the contents of that manager is quite another matter.
AD
Can an AI agent pay your bills safely?
It depends what ‘pay’ means. Asking an agent to list upcoming bills or prepare a payment for you to check is substantially safer than authorising it to move money whenever it thinks a bill is due. A payment may be perfectly genuine and still be wrong: the wrong amount, the wrong recipient, or a duplicated invoice. None requires a criminal mastermind, just an error at speed.
If a service offers access to your bank through open banking, that is a regulated way of sharing account information or initiating payments with your explicit consent. It is not a request to tell an AI assistant your online banking password. Check the provider’s permissions on the Financial Conduct Authority (FCA) register, and look at exactly what account information or payment ability you are approving. Open Banking says you can withdraw data-access consent through the app or website, or ask your bank or building society to stop access. Disconnecting future access does not necessarily erase information already copied elsewhere.
UK payment protections also deserve a careful reading. Under the Payment Services Regulations 2017, an unauthorised payment is generally treated differently from one you authorised but later regret. The FCA says to contact your bank immediately if you spot a payment you did not authorise, and within 13 months of the payment if you want to claim a refund. For eligible UK Faster Payments or CHAPS transfers to fraudsters made from 7 October 2024, separate reimbursement rules may apply. Neither rule is a promise that your bank will refund every payment an agent makes with your permission. If the approval screen says ‘pay’, read the payee and amount yourself.
My line is simple: let software assemble the paperwork, not make irreversible decisions. A holiday suggestion is handy. An assistant that submits an insurance claim containing an invented detail, changes a standing order or sends a bank transfer without a proper pause is not saving you the kind of time you want saved.
A short leash that still lets the thing be useful
Start with a job you can check. Have the agent compare broadband renewal offers from documents you choose, draft a complaint about a delayed train or make a checklist for a trip. Review the output against the original material. If it invents a term or misses a condition, you have learned something useful before giving it greater freedom.
When you do connect an account, prefer read-only access where available. Choose a particular folder, account or task rather than everything; set an end date if the service allows it. Require your approval before anything is sent, booked, changed or paid. An approval is only meaningful if you can see the actual recipient, amount and contents, not a cheery ‘All done?’ button. Keep notifications and a record of actions switched on where offered, so you can see what happened afterwards.
Once the job is finished, review connected-app permissions in both the AI service and the account it accessed. Remove connections you no longer need. If you suspect something has gone wrong, stop the agent, revoke its access and check the affected account directly; contact your bank promptly about unfamiliar payments. Changing a password is sensible if you think it has been exposed, but it may not remove a separate app permission, so check both.
None of this makes agents pointless. A well-bounded assistant could spare you the dreary work of sorting receipts or comparing policies. The test is whether you remain the person who decides what information leaves an account and what action finally happens. If a service cannot show you that clearly, it has not earned the keys.
In short
Use an AI agent for narrow, checkable jobs, not as a permanent deputy with access to your email, files and money. Grant the minimum permissions needed, keep human approval for payments and messages, and remove access when the task is over. If you cannot see or stop what it is doing, do not connect the account.
Alex Innes explains technology for men 45 and over who have seen every gadget since the ZX Spectrum and are not easily impressed. AI and ChatGPT, phones, cars, the smart home, the subscriptions worth keeping and staying safe online – what it does, whether it's worth the money, and whether you need it at all.
One of Midcent's writers. Spotted something? Write to alex@midcent.uk.
AI can sift applications, set shifts and flag performance. That does not make it a good manager. Here is where the software helps, where it fails and what you can challenge.
Fingerprint and face unlock make signing in easier, but passkeys do the important security work. Here’s what stays on your device, what can go wrong and where to start.
You do not need to memorise dozens of complicated passwords. Secure the accounts that unlock everything else, let a password manager handle the rest, and plan for a lost phone.
