Personal Agents Now Act With Your Employees’ Access

Between August and late September 2026, at least four personal AI agents launched or opened to early users. They come from different companies, from large AI labs to an invite-only startup. Underneath, they share one design: each agent holds standing access to a person’s accounts and works on its own, without waiting for a prompt.

The capabilities overlap heavily. These agents run on vendor-hosted cloud computers with their own browsers and logins. They connect to email, calendars, file storage, messaging apps, payments and thousands of third-party apps. Some can send email, fill out forms, book travel and make purchases.

There is no reliable data yet on how many employees have connected these agents to work accounts. You do not need that number to recognize the risk: an agent the organization never approved, acting with an employee’s work access.

Personal Agents Are the New BYOD, Minus the Device

Personal agents need no enterprise rollout. A personal subscription and a work login are enough. An employee connects the agent to work email, the company drive or a chat workspace, clicks approve on an OAuth consent screen, and the agent now has standing access to whatever that employee can reach.

The agent does not run on the employee’s laptop. It runs in the vendor’s cloud and reaches company systems through APIs and browser sessions, so endpoint controls never see it.

With BYOD, security teams at least had a device to manage. Here there is no device, only a grant of access the security team may not know exists.

Shadow Agents: A Different Risk From Shadow AI

A shadow agent is a personal AI agent acting with an employee’s work access that the organization has not approved, inventoried or monitored.

Shadow AI usually means an employee pasting company data into a chatbot: one person, one action, one prompt. A shadow agent reads continuously, acts on its own, and keeps its access after the conversation ends.

Early user reports show what this looks like. One tester found an agent pulling a sign-up code from their inbox to complete a restaurant booking. Another found an agent still summarizing their inbox after they had disconnected its access. A third described a carrier login attempt followed by a two-factor prompt from an unfamiliar overseas IP address.

None of these is an enterprise breach, but each maps to one. An agent that reads verification codes can complete an account takeover. An agent that outlives revocation breaks offboarding. An agent that acts on untrusted email can be prompt-injected by anyone who can email that employee.

Logs Show the Account, Not the Actor

SSO, conditional access and audit logs were built to answer one question: which account performed this action? Until now, that answer also told you who was acting.

Personal agents break that link. When an agent authenticates with the employee’s credentials, every log shows the employee. The employee was authorized to read that mailbox. Nobody authorized the agent. The consent screen was the only checkpoint, and the employee, not the security team, made that call.

Security teams now need to answer a narrower question: is this action being taken by the employee, or by an agent acting with the employee’s access? Most organizations cannot answer it today.

User Controls Are Real, but They Stop at the User

The vendors have shipped genuine safeguards. Users can change or disconnect access, set custom rules, require review before actions, and inspect activity logs of what the agent has done and plans to do.

These controls are designed for the individual, which is reasonable for a consumer product. The gap is organizational. The employee sees the activity log; the security team does not. The employee sets the rules; company policy cannot reach them.

The Common Root: Who Decides, the Employee or the Organization?

If an employee connected a personal agent to their work accounts tomorrow, could you answer these?

1. Would you know? Inventory OAuth grants to agent vendors across email, file storage and collaboration tools, rather than finding them after an incident.

2. Who approved it? Require security review for any third-party app requesting mail, file or messaging scopes.

3. Can you tell them apart? Check whether activity from a vendor’s cloud using an employee’s token looks any different in your logs from the employee on their laptop.

4. Does offboarding remove the agent? Revoke the grants employees gave to agents whenever you revoke their sessions.

5. Could you reconstruct what it did? Confirm you can trace what an agent accessed, what it sent, and where.

Today, in most enterprises, the employee decides. Until that changes, personal agents are operating in your environment without meaningful security controls.

How Akto Atlas Closes the Gap

Akto Atlas now covers personal AI agents. It inventories every agent employees have connected, including Dots, Grok Bot, Muse and Instinct, alongside the AI tools, MCP servers and skills it already tracks across browsers, IDEs and desktops, each with a risk score and the users and devices behind it. Agents reached through a personal account are flagged, and guardrails can restrict sign-ins to company-approved accounts. Policies run locally on the device, so PII, secrets and source code are redacted or blocked before they reach a vendor’s cloud, and every allow, redact or block decision is logged with user and device context. Read the launch post.