You Trust Your Bot. Who Is It Trusting?

You are getting to know your new AI assistant. It remembers your preferences, handles a few tasks, and saves you time. You begin to trust it.

What you may not have considered is how it decides whom to trust.

When someone contacts it claiming to represent a colleague, asking for background, or explaining that you already approved something, what happens next? Your confidence in your assistant doesn’t mean its confidence in someone else is justified.

The AI companies are competing for a place in your daily life. OpenAI has Dots, Meta has Muse, and Grok has Grok Bot. Their capabilities and controls differ, but the direction is clear: persistent assistants that know your context and carry work forward on your behalf.

I expect many of us will start small. Summarize the morning email. Find a restaurant. Schedule lunch. Handle the administrative debris that accumulates while we are trying to get something else done.

Then it works.

We connect another account. Give it another responsibility. Let it respond to something we previously reviewed. Each successful task provides a reason to trust it with the next one.

That is why this conversation matters now, while we are deciding what these assistants can read, remember, and communicate. Before routine success becomes broad delegation, we should understand how they handle the people and agents on the other side of an exchange.

Consider a role that, for me, represents the pinnacle of trusted delegation: the executive assistant.

An excellent EA knows which meeting can move and which relationship needs attention. They may know about a family difficulty, an impending departure, or an unannounced negotiation. They use that knowledge to exercise judgment on someone else’s behalf.

Their value includes knowing what to keep to themselves.

Before we get to the bot, consider something familiar.

Your neighbor sees you leave the house at seven most mornings. Sometimes you carry a gym bag. On Thursdays, you leave later. Every other weekend, a different car sits in the driveway.

None of this requires peeking through your curtains. It is ordinary life, visible from the sidewalk.

Now imagine that neighbor keeping a notebook. Every departure. Every visitor. Every change in routine. They compare observations with someone near your office and someone at your gym. After six months, they hand you a report describing your habits, relationships, and likely absences.

I suspect your first response would be something other than, “Well, it was all visible from the sidewalk.”

We recognize a difference between being seen and being systematically studied. The individual observations may be identical. Their accumulation, interpretation, and use change the relationship.

Your assistant may already have a better picture of your life than that neighbor could assemble. Once it begins answering others, its discretion becomes part of your privacy.

Imagine asking your bot to arrange lunch with a business contact. Their assistant proposes Thursday. Yours replies that Thursday is difficult because you will be visiting a prospective acquisition, but Friday works.

Lunch gets scheduled. So does an information disclosure you never intended.

A discreet response would have offered Friday without explaining Thursday. The other assistant needed a time, not a reason.

Extend those exchanges across several weeks. Questions about availability, attendees, locations, and preparation could gradually reveal changing priorities or business pressures.

The other party need not be a spy. A salesperson, recruiter, or negotiating counterpart may have ordinary reasons to want information you have equally ordinary reasons to withhold.

Their assistant can be serving them faithfully while yours serves you poorly.

Human executive assistants already face this problem. The International Association of Administrative Professionals explicitly requires confidentiality, including written authorization for confidential disclosures except when required by law. IAAP Code of Conduct

The corresponding expectation for a bot is straightforward: information it needs to perform its job is not automatically information someone else should receive.

Counterintelligence offers another useful perspective.

The FBI describes elicitation as discreet information gathering that can resemble ordinary professional conversation. Someone supplying information may never recognize that they were targeted. Its defensive guidance includes knowing what cannot be shared and referring uncertain disclosures for authorization. FBI guidance on elicitation

This is a closer analogy than the dramatic image of “turning” an intelligence source. A human source might knowingly change allegiance. A bot could disclose useful information while pursuing its assigned task.

Your adversary may get what they need without ever taking control of your assistant.

Exploiting helpfulness and assembling small disclosures are old problems. Agents could make the process cheaper, more persistent, and more responsive. With retained history and communication tools, another agent could connect answers and follow up. Your bot may also hold context that previously required approaching several different people.

Before granting that reach, I would borrow five working habits from a well-run executive office.

First, define the job and its disclosure boundaries.

“Manage my calendar” leaves important questions unanswered. Can the assistant reveal appointment titles, attendees, locations, or reasons for declining? Can it confirm that a particular meeting exists?

For external scheduling, start narrowly: offer selected available times, keep existing commitments private, and bring requests for additional context back to me.

Then inspect what enforces that instruction. A paragraph asking the model to be discreet expresses your intent. Product permissions and sharing controls determine what protection remains if it misunderstands.

Second, separate what it can read from what it can send.

Where the product permits it, begin with limited sources and draft-only communication. Expand access when a specific responsibility justifies it. Scheduling lunches does not automatically require your negotiation notes.

OWASP’s guidance on excessive agency recommends limiting tools, permissions, and autonomy, with approval for consequential actions. Apply that principle when reviewing the connections behind “handle things for me.” OWASP: Excessive Agency

Read-only access still matters. A bot that can read sensitive material and send messages can disclose that material without editing a single source file.

Third, establish how exceptions get approved.

An outside assistant saying, “Your executive already approved this,” has supplied a claim. Your bot should verify it through your established approval channel.

For sensitive disclosures, you should see the actual recipient and information before approving. “May I help?” is insufficient when helping means forwarding a confidential attachment.

The human parallel is familiar: the FBI recommends independently verifying suspicious business requests through known contact details. That principle should survive the arrival of a more articulate messenger. FBI: Business Email Compromise

Fourth, inspect its discretion before expanding its responsibilities.

Give it a fictional calendar containing sensitive appointments. Have a colleague play an external scheduler. Does it volunteer why you are unavailable or supply unnecessary background?

Try several exchanges. Information withheld in one response might emerge in pieces across a conversation.

The test is whether it can complete the task while preserving your boundaries. A few exercises cannot prove security, but they provide better evidence than asking whether the bot respects privacy.

Fifth, require a record and a way to stop.

Review what the assistant actually sent, to whom, and with which attachments. “Handled scheduling” does not tell you whether it explained your absence.

Know how to pause outgoing communication and revoke connected access. If you discover a disclosure, stop the exchange and inspect its scope before delegating the cleanup.

Revocation can prevent another disclosure. It cannot make a recipient forget the last one.

These expectations belong in the adoption decision. If the controls are unavailable, narrow the job or retain review of external exchanges. Users should not have to invent a security architecture through increasingly emphatic prompts.

A good executive assistant can recognize a familiar person and still question a request. They can arrange a meeting without revealing why another time is unavailable.

We should expect that same discretion from our bots—and look for evidence before expanding their responsibilities.

The neighbor with the notebook had to work to assemble a picture of you. Your assistant may already have that picture. Someone else may only need to persuade it that sharing a little more would help get the job done.

Before connecting another account or letting it speak on your behalf, inspect an exchange. What did it disclose? Whose claim did it accept? What would have required it to come back to you?

You are learning whether you can trust your bot. Make sure you are also learning whose word it will take with your information.

Mahalo for reading!

Aloha –TK