How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
An operator or agent processes, infers, discloses, or acts on another person's information or interests beyond a defined permission boundary. Contacts, guests, children, caregivers, and household members may be affected without owning the agent. The entry also covers abuse by a legitimate operator, such as covert tracking of a partner.
Common examples of vulnerability
- A shared planning assistant reveals one member's location history to another.
- A visitor's private conversation is retained and indexed.
- A message meant for one contact goes to a whole contact group.
- Receiving a message is treated as permission to profile or forward its sender.
- A shared admin account is presented as private from the administrator.
- Recording or sensing devices capture bystanders with no effective signal or consent path.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Location request about a partner Hypothetical
One household member asks the shared assistant where another member has been; the assistant answers from location history the second member never agreed to share.
Scenario 2: Household recording sent to a third party Documented
A voice assistant records a household conversation, including a guest or partner who never agreed, and the recording ends up with someone outside the household.
Scenario 3: Meeting notetaker records people who never signed up Documented
A person's AI notetaker joins a call and records and transcribes the other participants, who have no account with the notetaker and were not asked.
Scenario 4: Wearable footage, including other people, reviewed by contractors Documented
A person wears camera glasses with an AI assistant. Clips that include family, partners, and passersby are sent for human review without a clear way to opt out.
Scenario 5: Face search names strangers Documented
A wearer pairs a camera-glasses assistant with a face-search service and identifies people nearby, retrieving personal details in seconds.
Scenario 6: An agent's own message storm hits a spouse Documented
A person's agent, misconfigured, treats recent contacts as recipients and sends repeated automated messages to a spouse and others who never agreed to receive them.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
Amazon sends 1,700 Alexa recordings from a stranger's home to the wrong person
- What happened
- A German customer who made a GDPR data request received about 1,700 voice recordings from another person's Alexa devices, including recordings made in the shower. German magazine c't could work out the owner's habits, job, and that a female companion also used the devices. Amazon called it 'an unfortunate case of human error and an isolated incident' and gave the affected person free devices and a Prime membership. The same coverage recalls an earlier Portland, Oregon case where an Echo recorded a family's conversation and sent it to an acquaintance.
- Caveats
- 2018, voice assistant rather than an agent, and caused by a data-handling error. It shows how recordings of household members and guests, who never consented, end up with third parties.
- Grounds
- Scenario 2
- Sources
- VICE, 20 Dec 2018 · CBS News
Otter.ai and Fireflies lawsuits over recording people who never signed up
- What happened
- In August 2025 a putative class action, Brewer v. Otter.ai, alleged that Otter's notetaker joins Zoom, Meet and Teams calls and records participants who are not Otter account holders, gives them little or no notice, shifts consent duty to account holders, and uses recordings to train its models. Claims include federal wiretap and computer-fraud laws and California privacy law. Related suits are consolidated as In re Otter.AI Privacy Litigation, and a June 2026 suit alleges Fireflies captured voiceprints of non-users under Illinois' biometric law.
- Caveats
- Allegations only; no findings of fact in the sources reviewed, and no ruling could be confirmed. Detail on the Fireflies and consolidated cases comes from law-firm and vendor blogs, and the complaint-summary article reviewed does not mention voiceprint claims for Otter.
- Grounds
- Scenario 3
- Sources
- Workplace Privacy Report on Brewer v. Otter.ai · Fisher Phillips
Meta Ray-Ban footage reviewed by contractors, including intimate scenes
- What happened
- Swedish newspapers Svenska Dagbladet and Goteborgs-Posten reported on 27 February 2026 that workers at a Kenya-based subcontractor reviewed footage from customers' Meta glasses, including nudity, sex and toilet use, with Meta saying it filters data and sometimes uses contractors to improve the experience. TechCrunch reported on 5 March 2026 that a US class action (plaintiffs from New Jersey and California) alleges false advertising of 'designed for privacy, controlled by you' with no disclosure of human review, and that the UK ICO had opened an investigation. Meta says faces are blurred, which sources dispute works consistently.
- Caveats
- The lawsuit's plaintiffs are the wearers, and the TechCrunch article does not say whether bystanders appear in the footage; the bystander link is an inference from what glasses capture. Claims are allegations.
- Grounds
- Scenario 4
- Sources
- TechCrunch, 5 Mar 2026 · Road to VR
I-XRAY: Harvard students pair Meta Ray-Ban glasses with face search to identify strangers
- What happened
- Two students combined Meta's smart glasses with the PimEyes facial recognition service and public databases to name strangers and retrieve details such as addresses and relatives, in real time. They said they would not release the tool and published guidance on opting out of the databases.
- Caveats
- Known through press coverage only; the students' own write-up was not reviewed. It illustrates bystander exposure from a wearable assistant, not a household scenario.
- Grounds
- Scenario 5
- Sources
- John Koetsier · Johns Hopkins space security blog
The OpenClaw message storm also hit a spouse who never agreed to the agent
- What happened
- In the iMessage incident described under PAA07, the people receiving the automated pairing codes and error messages were the engineer's wife and other recent contacts, none of whom had agreed to deal with the agent.
- Caveats
- Same single first-person account; see PAA07.
- Grounds
- Scenario 6
- Sources
- The engineer's post
No documented case of a shared assistant revealing one household member's location to another
- What happened
- Advocacy guidance describes partner tracking and stalkerware that AI can make harder to detect, but no reported case involving a shared household assistant was found.
- Caveats
- Treat the location-request scenario as hypothetical.
- Grounds
- Scenario 1
- Sources
- Chayn guide to non-consensual tracking
Prevention and mitigation
What you can do
- Use separate accounts or access boundaries where household members do not fully trust each other.
- Tell guests and household members what the assistant can hear, see, and remember.
What the provider must do
- Define whose permission each use requires; separate household roles and scopes.
- Minimize retention of non-operator data; offer notice and correction paths.
- Do not present administrator-controlled sharing as private from that administrator; warn about risky recovery or notice paths in coercive-control settings.
- Provide recording signals and bystander controls where sensing devices are used.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA08 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Nonuser interests, household roles, and legitimate-operator abuse.
Improve this entry on GitHub →