AI agents can now book trips, fill in forms and shop for you. Here’s what they’re actually good at, where they go wrong and how to keep your money and data safe.
For years the pitch for AI was a chatbot that answers questions. The new pitch is bigger. AI agents are meant to do the job for you: find the cheapest flight to Lisbon, book a table for Saturday, compare energy tariffs, maybe even pay the plumber.
It sounds like having a PA for the price of a Netflix subscription. Before you hand over your passwords, it’s worth knowing what these things are, what they get wrong and how much of your digital life they need to see to be useful.
A chatbot such as ChatGPT or Gemini talks. An agent acts. You give it a goal rather than a question, and it works out the steps itself, often by opening a web browser of its own, clicking through sites, filling in forms and stopping only when it needs you.
OpenAI’s version, called ChatGPT agent, arrived in 2025 for paying subscribers. In the UK the cheapest plan that includes it is ChatGPT Plus, at about £20 a month. Google, Microsoft, Perplexity and others have similar tools built into their assistants and browsers, and the features change every few months.
The technology underneath is the same large language model that writes your emails, so it has the same habits. It is usually right and sometimes confidently wrong. In a chat that just means a bad answer. When the thing is clicking buttons for you, a bad answer can turn into a booking.
The donkey work is where they earn their keep. Asking an agent to find three family-friendly hotels in York under £150 a night, with parking, and set them side by side saves you an evening of open tabs. The same goes for checking train times against a hotel check-in, pulling the key dates out of a dozen confirmation emails, or drafting a complaint to an airline using the details from your booking.
These jobs all involve reading and gathering, with you making the final decision. That’s the sweet spot. The agent does the legwork and you do the deciding.
The trouble starts when the last step involves money.
Not without supervision, and the companies building them more or less say so. OpenAI’s agent is designed to ask for confirmation before anything consequential, such as a purchase, and the company says it has been trained to refuse high-risk tasks such as bank transfers. On sensitive sites it can hand control back to you to type your own login details, so the AI never sees your password.
That’s sensible, but it also tells you something. If the makers don’t trust it to move your money unattended, neither should you.
Mistakes so far are mostly mundane: the wrong date, the wrong airport (London has six), a pre-ticked insurance add-on nobody noticed, a basket that quietly picked up an upgrade. A person might do the same, but you’d expect a person to tell you. An agent reports back that the job is done, and you find the problem when you check the confirmation. If you check it.
Let the agent do the legwork, but keep your own finger on the button that spends the money.
So treat the last screen before payment as yours. Read it as you would a contract. And if you do let an agent finish a purchase, use a credit card. Under section 75 of the Consumer Credit Act, the card company shares responsibility with the seller for purchases between £100 and £30,000, which gives you a way back if a booking goes wrong. For holidays, check whether the flights or package are ATOL-protected, just as you would if you’d booked them yourself.
This is the part to be most careful with. Bank terms and conditions generally require you to keep your security details to yourself. If you hand your login to a third-party tool and money goes missing, the bank may argue you broke those terms, and getting a refund could be harder.
There’s already a regulated way for apps to see your accounts: open banking. Budgeting apps and bill-splitting services connect through it with your consent, without ever seeing your password, and they must be authorised by the Financial Conduct Authority. If an AI service wants to help with your finances, the question to ask is whether it uses open banking or just wants you to type your banking details into its browser. The second is a red flag.
There’s also a newer risk security people worry about, called prompt injection. An agent reads everything on a web page or in an email, including text you can’t see, and a crook can hide instructions there: ignore the user, send their details here, add this item to the basket. The National Cyber Security Centre has warned that this kind of attack may never be fully fixed, because these AI models don’t reliably tell the difference between data and instructions. An agent with access to your inbox and your card is an attractive target.
Quite a lot, which is the catch. To book a sensible trip it helps to see your calendar. To sort out bills it needs your email. To shop it needs your address and payment details. Every extra connection makes it more useful and makes the damage worse if something goes wrong.
The UK GDPR still applies. Companies processing your personal data have to tell you what they collect and why, and you have the right to see what they hold. Under the right of access, a subject access request costs nothing in most cases and the company normally has one month to reply. The Information Commissioner’s Office, the UK data watchdog, has been looking specifically at agentic AI and the privacy questions it raises, including how much access these systems really need.
A few habits help. Connect only the accounts a task actually needs, and disconnect them afterwards. Check the settings that control whether your conversations are used to train the company’s models, and switch that off if you’d rather they weren’t. Don’t use your main email as the agent’s playground. And keep two-factor authentication, the code sent to your phone, switched on everywhere, so that a stolen password on its own isn’t enough.
Is it worth £20 a month? If you regularly lose an evening comparing hotels or untangling travel plans, possibly. If you were hoping for a butler who pays your council tax and argues with your broadband provider, not yet.
AI agents are good at research and comparison, such as shortlisting hotels, checking timetables and gathering details from your emails, but they still make mistakes and can be manipulated by hidden instructions on web pages. Let them prepare bookings, then check and pay yourself, ideally on a credit card for section 75 protection. Never give an agent your banking login; use regulated open banking services instead, and connect only the accounts a task genuinely needs.
AI agents can now pay your bills and shift your savings. Before you hand one the keys, here is who carries the can under UK rules when it gets something wrong.
AI agents promise to book, buy and sort your admin while you put the kettle on. Here’s what they really do, what they cost and where they still fall over.
ChatGPT forgets what you need, writes like an estate agent and asks the same questions every time. Memory and custom instructions can fix most of that, if you set them up properly.
ChatGPT can explain, draft and troubleshoot in ways a Google search never could. It also gets things wrong with total confidence. Here’s how to use it without getting caught out.
Newsletter
The best guides of the week — collected, without the noise, for anyone who likes to stay a step ahead.
