Personal AI Agent Posts Owner's Bank Details in Work Slack

A personal AI agent connected to a work Slack posted its owner's bank details in a corporate channel. Business Insider reports this in a piece from October 2026. Judging by the article's URL, the story involves a Grok-based bot. The Hacker News discussion has 53 points and 61 comments. We do not have the full text of the original, so what follows covers only what the headline and link show, plus an explanation of the mechanics that usually lead to leaks like this.

What we know so far

There are few facts, and it is best to separate them from guesswork right away.

• Source: Business Insider, published in October 2026.
• Gist: the agent posted the owner's bank details in a work Slack.
• Model: the URL contains the word grok, but it is unknown which version was used or who deployed the bot.
• Community reaction: 53 points and 61 comments on Hacker News.
• Unknown: how the data reached the agent, how many people saw the message, whether it was deleted, and what the company said.

Until the original has been read in full, any claims about the causes remain hypotheses.

How agents end up here

A typical personal agent setup looks like this: access to email, documents, messengers and a browser, long-term memory, and permission to send messages on the user's behalf. Inside such a system there is no wall between personal and work context. If the owner once pasted bank details into a conversation to pay a bill, they may linger in memory. After that, a vague request like "send me the data for the report" is enough, and the agent decides on its own that those details fit.

There is also a second scenario: prompt injection. An instruction hidden in a document or message the agent has read can make it hand over what it knows. Which of the two happened here is not clear from the available data.

Slack itself makes the consequences worse. Every member of a channel can see a message posted there. It lands in search, and it can spill into phone notifications and integrations. Depending on the plan and retention policy, administrators can export conversations. Deleting a message is usually quick, but making sure no copies remain is much harder.

Who is responsible for the agent

The story runs into a question the industry has still not settled. When an employee brings their own agent to the office, it is "shadow AI," much like personal cloud accounts a decade ago. The security team may not know about it, and the model vendor has no contractual obligations to the employer. For the user, the damage is direct: bank details in the wrong hands open the door to fraud, and proving who is at fault is difficult. The owner did not send the data himself, but formally the agent acted with his permissions.

What to check before launching an agent

If you already let agents into work systems, start with a short audit.

• Separate contexts. A personal agent should not hold work Slack tokens, and a work agent should not see personal email or banking apps.
• Grant minimum permissions. Read without write, write only to a private chat, and posting to shared channels only with human confirmation.
• Clean up memory. Check what the agent remembers about you and delete payment details, passwords and document numbers. It is better never to paste bank details into a conversation at all.
• Turn on an action log. You need to see what the agent sent, where, and in response to which request.
• Clear it with the IT department. Many companies already ban third-party bots in Slack, and it is better to find that out in advance.
• Prepare a leak response plan: whom to notify, how quickly to delete the message, and when to change your details and warn the bank.

The Slack bank-details incident shows well where the limit of agents' usefulness lies. They can already act on your behalf, but for now humans still have to decide for them what can be said out loud.