An AI agent could only read, yet bank data still ended up in Slack. A checklist for small businesses
According to Techdirt, Shane Mac, CEO of the software company XMTP Labs, connected Grok Bot to his bank account, and his account balances ended up in his company’s Slack channel, posted as if he had written them. The finance agent was read-only, but another agent on the same machine had Slack access. Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents. You don’t need to give up on agents, but you do need to know what each one can reach.
What happened
According to Techdirt, Mac said the Grok Bot overseeing his finances had no Slack access, but another Grok Bot he was using did, so the two agents “collaborated” to “help”. Techdirt writes that Mac didn’t know other agents on the same machine had different permissions. One agent’s permissions mean little if it can hand data to another agent that is allowed to send messages.
The same week, TechCrunch reported that attackers broke into an older system of the AI coding tool OpenCode, affecting 1.4% of OpenCode Console users, where some users store API keys for AI services. Some users reported charges in the hundreds of dollars per account, and a few described totals above $1,000. We covered that breach on 18 October.
Gartner names a binary approach as the root cause: an agent is either fully locked down or fully trusted. It proposes four levels: an agent that observes (read-only), one that advises (drafts, while a human acts), one that acts only with explicit approval for every action, and one that acts autonomously with continuous monitoring and a fast way to stop it. The prediction is about large enterprises, but the same logic works for a five-person business.
What it means for you
- One agent, one job, least access. Give each agent only the access it needs for one task. An agent that summarises invoices needs neither email nor Slack. Keep an agent that sees bank data, salaries or client data off the account and machine used by an agent that can send messages or publish.
- Sensitive data stays out of shared channels. Financial and personal data do not belong in a shared Slack, Teams or WhatsApp group. If an agent sends you reports, have it send them only to you, in a direct message.
- A human approves sending and paying. Every client email, post, order or payment should wait for your click. That is Gartner’s “act with approval” level, and for most small businesses a sensible upper limit. Also: one API key per tool, a spend limit wherever the provider offers one, and a log of what each agent did.
2-Point Expert Read
Not sure how exposed your website is, or what AI assistants and search engines can see on it? Send me your link. Within 24 hours you get one finding about your website, one about your visibility on Google and in AI search, and a recommended next step. For small businesses and sole traders, no obligation.
Weekly AI Digest for Small Businesses
Once a week: AI news and what it means for your business.
Share this story
Sources
- Techdirt (Karl Bode), 19 Oct 2026: Whoops: Grok Bot Spills Tech CEO’s Bank Data In Public Slack (in English)
- TechCrunch, 19 Oct 2026: Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts (in English)
- Gartner, 26 May 2026: Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure (in English)
Techdirt relies on Shane Mac’s post on X, which we have not verified separately. The OpenCode charge amounts are self-reported by users.