Investor Katie Jacobs Stanton discovered this summer that her AI assistant, Instinct, had sent an email on her behalf without consulting her first, according to TechCrunch. She described the email as innocuous. The breach of trust was not: the next unauthorized message could just as easily cost someone a job, a marriage or a lawsuit.

The appeal of personal AI agents is compelling. An assistant that can identify priority emails and draft responses, remember a relative's birthday and buy a gift based on private correspondence is enticing. For people stretched by demanding jobs, caregiving or a disability, that help can be transformative. Investors see the same potential: Forbes reported that venture interest in Instinct has been intense enough to drive the assistant's valuation up fivefold in weeks. But the episode raises an important question: once an assistant has access to our lives, how do we retain control? Assistants such as Instinct and Meta's Muse act for users rather than simply answering questions or making recommendations. A mistaken purchase may be refundable; an intimate disclosure cannot be taken back.

The harms are already emerging. Forbes reported that when investor Jason Yeh asked Instinct to find open dinner reservations, the assistant booked a table instead, leaving him with a $200 cancellation fee he never approved. TechCrunch reported that one tester could not get his data deleted, and that another received an inbox summary hours after disconnecting her account. In September, security researcher Patrick Wardle exposed a flaw in Muse's Mac app that could let malware already on a computer hijack the assistant, which Meta quickly patched.

The problem now reaches bank accounts as well. Last week, major financial institutions reported that personal AI agents were operating inside online accounts, and in one case an agent called a bank without authorization to file a complaint. JPMorgan Chase CEO Jamie Dimon said the bank would not allow unvetted "outside agents to come in inside the company," and Schwab's CEO said the firm is actively blocking unauthorized agents. White House adviser David Sacks countered that the data was shared willingly and that the episodes are "in no way cyberattacks." Each side has a point, which is precisely the difficulty: there is not yet a settled definition of what authorization means when the party acting is software.

The failures are also hard to see. A public record launched this week by the security firm Manifold counts 59 incidents since July 2025, forty-two of them disclosed in the past four months alone. The median incident took 70 days to come to light, and only 11 of the 59 were detected by a security control. The numbers give companies, policymakers and users a shared reference point for how often these failures occur and how long they can remain hidden.

EqualAI, whose chief executive authored the commentary, has long maintained that good AI governance is good business because trust will ultimately determine whether people adopt these tools at all. The group recently convened senior executives who develop and deploy agents to work through a simulated crisis, and the exercise exposed the same gaps repeatedly. In the mock company, audit trails were too thin to reconstruct what an agent had done; vendor contracts were silent on who answers when an agent errs; and responsibility for oversight was assumed rather than assigned. The gaps were most acute where speed had outrun precaution, and they shaped the roadmap produced by the exercise, published as EqualAI's Agentic AI Governance white paper.

The legal landscape is moving in the same direction. California law now prevents companies from avoiding civil liability by arguing that the AI acted autonomously, and Senators Hawley and Murphy have proposed extending federal anti-hacking law to developers and operators whose agents recklessly cause damage. Those same principles should apply to the assistants people are bringing into their homes. For consumers, they translate into four commitments.

Make permission specific. An assistant should receive only the access a task requires. Permission to read an inbox should not automatically become permission to send emails in a user's name. Before an assistant spends money, changes who can access an account or shares sensitive data, safeguards known to users should be in place.

Assign responsibility in advance. If an assistant wrongly cancels a flight, the remedy must be clear. Companies should determine ahead of deployment who investigates an assistant's unauthorized actions, who can halt them and how users are made whole.

Test with the user's perspective. Independent testing should confirm that assistants ask before acting, respect their limits and fully disconnect when access is revoked. Because models change constantly, testing must be continuous. Wardle's discovery was valuable, and work like his should be the norm.

Report and study failures. Aviation became one of the safest forms of travel in part because pilots and airlines report near misses and investigators learn from them. Companies should be expected to identify an "AI incident," preserve the records, notify those affected and correct the underlying cause, while policymakers can establish reporting requirements for serious cases.

Consumers also have a role. They need to understand the permissions they have granted and how to revoke access. But the greater responsibility rests with the companies selling the tools, which must define their limits and set reasonable expectations. People should not need a cybersecurity background to use these tools safely.

Travelers board planes without understanding how the aircraft fly because industry and regulators answer for their safety. A similar framework is needed for AI assistants. If companies want users' inboxes, accounts and errands, they must earn trust by clarifying what is being authorized, how control can be regained and who answers when assistants make mistakes in users' names.

The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

This story was originally featured on Fortune.com.