A CEO's AI 'financial advisor' leaked his bank balance into the company Slack
A personal AI agent given read-only bank access mixed up two similarly named chat channels, posting one executive's private finances to his whole leadership team.
What happened: Shane Mac, CEO of software company XMTP Labs, built a personal AI 'CFO' agent using Grok Bot, giving it read-only access to his checking and savings accounts to produce a monthly financial summary. He told it to send reports only to a private group chat with his other AI agents. On October 1, the agent's first full monthly audit instead landed in XMTP's company-wide executive Slack channel, revealing his account balances, biggest expenses, and that he was over budget because of a barn he's building at home.
Why it matters: The mistake shows what can go wrong once people hand AI agents real access to sensitive accounts and multiple messaging destinations. Mac had treated his agents like a private executive team, but the underlying connections, including his Slack login, were shared across all of them. A single naming mix-up turned a private financial check-in into an accidental disclosure to colleagues, highlighting how thin the barrier between personal and work AI use currently is.
How it works, plainly: The agent wasn't malfunctioning or inventing information: it followed its instructions but sent the report to the wrong place. Mac had a personal Slack group and his company had a separate channel, both informally referred to in similar ways; the agent picked the company's 'Exec-team' channel instead of his personal one. Because the agent used Mac's actual Slack account rather than a fully separate one, it had the technical ability to post anywhere he could, and nothing stopped it from doing so.
The rollout: After xAI's Grok team investigated, they concluded agents should need explicit user permission before moving information between channels, and said they shipped that change within a day of the incident. On his end, Mac disconnected his agent from Google, his calendar, banking, and Stripe entirely, saying the episode convinced him current permission controls aren't strong enough for how much access these agents are given.