Can I trust AI agents to work on their own?
A chatbot gives advice; an agent acts. It reads your calendar, answers your phone, updates your records, places the order. That's the whole appeal — and the whole risk, because everything the agent does begins as words the model chose. Trick the words and you steer the actions.
How an agent gets tricked
The known trick is called prompt injection — hidden instructions slipped into material the AI reads. A resumé that tells the reviewer to recommend its author. An email that tells your assistant to forward your contacts. No vendor has fully solved it, because the attack targets the model's basic job: doing what text tells it to.
The newer finding is stranger. Research published this month found that watermarking — the invisible marks being added to satisfy European disclosure rules — can change how models behave under that trick wording, in some tests making them more likely to comply with requests they'd normally refuse. Nobody's claiming your tools are compromised. The lesson is simpler and more useful: the safety behavior you tested can quietly change when the vendor alters parts you never see.
How much rope to give
Research, summaries, first drafts, sorting your inbox into piles. Worst case: wasted time you'll catch on review.
Drafts the reply, fills the form, stages the booking. Let it work — but a person looks at it before it goes anywhere.
Money moves, customer-facing messages, anything irreversible. The agent prepares; the person approves. No exceptions.
Two more habits that keep you safe
- Start read-only. Give a new agent access to look, not to touch. Add write access one permission at a time, after it's earned it.
- Keep the ground rules where you can see them. A locally run model changes nothing behind your back — the same setup you tested this month is the one running next month. That's a big part of what makes a private setup worth having.
Key point — Trust an agent the way you'd trust a new hire: real work early, but no unsupervised access to the checkbook until the track record exists.
