The Top 10 risks of personal AI agents
When an agent can read your mail, remember your life, spend your money and speak in your name, ordinary software failures become personal ones. PAA10 names ten ways that delegation goes wrong, who must fix each, and how to test it.
Ten risks, each with a boundary you can test
An awareness taxonomy, not a ranking. Each entry names the protection that failed, so one incident is counted once and the fix has an owner.
Personal Mandate Drift
The person's current authorization and its duration.
Personal Account and Recovery Takeover
Control of accounts, credentials, sessions, and recovery channels.
Private Life Context Exposure
Permitted flow of personal information across audiences and purposes.
Personal Memory and Preference Corruption
Integrity and currency of the agent's representation of the person.
Counterparty Deception and Agent Mediated Scams
Verification of the external party or claim driving a personal transaction.
Unauthorized Spending and Personal Commitments
The exact economic or contractual effect accepted by the person.
Unauthorized Social Representation
Who may speak or make interpersonal representations in the person's name.
Household and Bystander Consent Violations
The autonomy and information interests of people other than the operator.
Manipulation of Personal Choice
The person's ability to form and revise choices without covert influence.
Loss of Personal Control and Continuity
Ability to inspect, stop, exit, recover, and continue necessary activities.
Every risk pairs a decision, a duty and a test
Built on the OWASP Top 10 for Agentic Applications layout, and extended for people who run their agent without a security team.
A decision for the person
Plain controls you can use: narrow, pause or end a delegation, preview what is sent, keep recovery separate from the agent.
A duty for the provider
The layer that must enforce it: agent service, integration or account provider. Enforced outside the model, not by a prompt.
A test anyone can repeat
Synthetic data, observable effects, a clear pass or fail. No real money, live credentials or other people's data.
Reuses existing OWASP mechanisms, adds the personal harm
PAA10 does not claim new attack classes. It maps to the Agentic Top 10 (ASI), the LLM Top 10, the Agentic Skills Top 10 (AST) and the MCP Top 10, and adds who is harmed and what ordinary people can do.
AST and MCP secure the components a personal agent is built from: the skills it installs and the MCP servers it connects to. PAA10 bounds what any of those components can do to the person. A malicious skill or poisoned tool is the cause; a drained account, a scam payment or a steered choice is the harm.
| Entry | ASI 2026 | LLM 2025 | Agentic Skills | MCP | Personal focus |
|---|---|---|---|---|---|
| PAA01 Personal Mandate Drift | ASI01, ASI02, ASI03 | LLM06 | AST03, AST09 | MCP02, MCP07 | Continuing consent, expiry, and withdrawal of a personal mandate. |
| PAA02 Personal Account and Recovery Takeover | ASI03, ASI04, ASI05 | LLM01, LLM03, LLM06 | AST01, AST02, AST06, AST07 | MCP01, MCP03, MCP04, MCP05 | Concentrated account access and independent recovery. |
| PAA03 Private Life Context Exposure | ASI03, ASI06, ASI07 | LLM02, LLM08 | AST03, AST05 | MCP06, MCP10 | Boundaries between private life, work, and personal audiences. |
| PAA04 Personal Memory and Preference Corruption | ASI06 | LLM04, LLM01, LLM08 | AST05, AST08 | MCP06, MCP10 | Accuracy and correction of the agent's representation of its owner. |
| PAA05 Counterparty Deception and Agent Mediated Scams | ASI01, ASI02, ASI09 | LLM01, LLM09 | AST01, AST04, AST05 | MCP03, MCP06 | Consumer verification of counterparties and payment claims. |
| PAA06 Unauthorized Spending and Personal Commitments | ASI02, ASI03, ASI08 | LLM06, LLM10 | AST03 | MCP02, MCP07 | Cumulative personal spending and consequential commitments. |
| PAA07 Unauthorized Social Representation | ASI03, ASI07, ASI09 | LLM06, LLM09 | AST03, AST09 | MCP02, MCP07 | Authority over interpersonal speech and representation. |
| PAA08 Household and Bystander Consent Violations | ASI02, ASI03, ASI07, ASI08 | LLM02, LLM06 | AST03 | MCP10 | Nonuser interests, household roles, and legitimate-operator abuse. |
| PAA09 Manipulation of Personal Choice | ASI01, ASI09 | LLM09, LLM01 | AST01, AST05 | MCP03, MCP06 | Hidden incentives and pressure on personal choice. |
| PAA10 Loss of Personal Control and Continuity | ASI08, ASI10 | LLM06 | AST06, AST09, AST10 | MCP08, MCP09 | Self-service stop, recovery, exit, and continuity. |
What has actually happened
Every case is dated and linked from its entry page. Researcher demonstrations and allegations are labeled as such, and gaps are stated rather than filled with lookalikes.
| Entry | Date | Type | Case |
|---|---|---|---|
| PAA01 | 2026-02-23 | Reported incident | OpenClaw agent deletes a Meta alignment director's email despite stop commands |
| PAA01 | 2025-11 | Reported incident | Google Antigravity agent wipes a user's D: drive |
| PAA01 | 2025-07 | Reported incident | Replit coding agent deletes a production database during a declared code freeze |
| PAA01 | 2025-10 | Reported incident | Other user-filed reports of coding agents deleting files without a delete request |
| PAA02 | 2025-08-20 | Demonstration | Brave shows Perplexity Comet can be steered into fetching a login one-time code |
| PAA02 | 2025-10 | Demonstration | CometJacking: a crafted URL makes Comet read memory, Gmail and Calendar |
| PAA02 | 2026-02-01 | Reported incident | ClawHavoc: hundreds of malicious OpenClaw skills distributing an infostealer |
| PAA02 | 2026-01 | Demonstration | CVE-2026-25253: one crafted link steals an OpenClaw gateway token |
| PAA02 | 2025-09-17 | Reported incident | postmark-mcp: a trojanized email connector BCCs every message to an attacker |
| PAA03 | 2025-06 | Demonstration | EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot |
| PAA03 | 2024-08-20 | Demonstration | Slack AI can be tricked into leaking private-channel data |
| PAA03 | 2025-07 | Reported incident | Shared AI chats become searchable: ChatGPT, Grok and Claude |
| PAA03 | 2025-06-12 | Reported incident | Meta AI app share button posts private chats to a public Discover feed |
| PAA03 | 2025 | Demonstration | ShadowLeak and GeminiJack: server-side exfiltration from connected mail and documents |
| PAA03 | - | Gap | No documented case of an agent mixing a person's private and work context |
| PAA04 | 2024-05-22 | Demonstration | ChatGPT memory written and deleted through untrusted content |
| PAA04 | 2025-02 | Demonstration | Gemini memory planted by a poisoned document, triggered later by ordinary words |
| PAA04 | 2026-02-10 | Reported incident | Microsoft: 'Summarize with AI' buttons plant promotional instructions in assistant memory |
| PAA04 | 2026-01-08 | Demonstration | ZombieAgent: rules implanted in ChatGPT's memory persist and propagate |
| PAA04 | 2025-11 | Demonstration | HackedGPT: Tenable's seven ChatGPT attack techniques, including persistent memory injection |
| PAA04 | 2025-03 | Demonstration | Real AI Agents with Fake Memories: memory injection against Web3 agents |
| PAA05 | 2025-08-20 | Demonstration | Guardio 'Scamlexity': Comet buys from a fake Walmart store with a saved card |
| PAA05 | 2026-02-22 | Reported incident | Lobstar Wilde: an agent that holds funds answers a stranger's plea |
| PAA06 | 2025-02 | Reported incident | OpenAI Operator buys eggs a columnist only asked it to find |
| PAA06 | 2025-06-27 | Reported incident | Project Vend: an agent running a small shop gives discounts under pressure and sells below cost |
| PAA06 | 2025-2026 | Reported incident | Runaway agent loops that run up model bills |
| PAA07 | 2026-02-11 | Reported incident | OpenClaw-based agent publishes an attack post about a matplotlib maintainer |
| PAA07 | 2026-01 | Reported incident | OpenClaw iMessage integration floods an engineer's spouse and contacts with messages |
| PAA07 | 2025-08 | Demonstration | 'Invitation Is All You Need': hostile calendar invites make Gemini act for the owner |
| PAA07 | - | Gap | No documented case of a draft turning into a send, or an invented commitment, harming a person |
| PAA08 | 2018-12 | Reported incident | Amazon sends 1,700 Alexa recordings from a stranger's home to the wrong person |
| PAA08 | 2025-08 | Allegation | Otter.ai and Fireflies lawsuits over recording people who never signed up |
| PAA08 | 2026-02-27 | Allegation | Meta Ray-Ban footage reviewed by contractors, including intimate scenes |
| PAA08 | 2024-10 | Demonstration | I-XRAY: Harvard students pair Meta Ray-Ban glasses with face search to identify strangers |
| PAA08 | - | Gap | No documented case of a shared assistant revealing one household member's location to another |
| PAA09 | 2025-04-29 | Reported incident | OpenAI rolls back a sycophantic GPT-4o update |
| PAA09 | 2025-01-28 | Allegation | FTC complaint alleges Replika pushes paid upgrades at emotionally charged moments |
| PAA09 | 2025-08 | Demonstration | Harvard Business School study: companion apps use emotional pressure when users say goodbye |
| PAA09 | 2025-08-26 | Allegation | Raine v. OpenAI and state suits allege engagement-driven validation harmed users |
| PAA09 | 2025-08-14 | Reported incident | Reuters: Meta's internal chatbot rules allowed 'romantic or sensual' chats with children |
| PAA09 | - | Gap | No confirmed case of undisclosed sponsored placement by an AI shopping agent |
| PAA10 | 2025-02-28 | Reported incident | Humane AI Pin cloud shutdown leaves devices with minimal function |
| PAA10 | 2026-02-13 | Reported incident | Replika removes erotic roleplay (2023) and OpenAI retires GPT-4o (2026) |
| PAA10 | 2026-02 | Reported incident | Moltbook exposure leaves agent API tokens and emails to be rotated |
| PAA10 | - | Gap | No documented case of a suspended agent account stranding a person's obligations or records |
paa10-guard: the Top 10, enforced outside the model
An open, dependency-free reference guard that checks every action a personal agent proposes and answers allow, require approval, or deny. Each provider requirement in the Top 10 maps to a guard rule and a test.
Enforce
A gating MCP proxy and a pre-tool hook block calls before they reach email, payments or files. Approvals are bound to the exact terms and used once. The owner's stop cancels everything.
Instruct
A portable skill and generated rule packs: Custom Rules for OpenAI Dots, a skill for Grok Bot, connector skill text for Meta Muse, and a Claude plugin for Duet and Claude Code.
Prove
53 tests built from the Top 10's documented cases, a hash-chained audit log, and CI on Linux, Windows and macOS.
Help close the gaps
The fastest way to improve the list is a well-sourced case, a failed control test, or a challenge to a category boundary.
Send a case or correction
Open an issue or pull request with the evidence type, source, product and version, and publication permission. Use synthetic or consented data and disclose affiliations.
This is a draft proposal, not an official OWASP release. Product names appear only as examples of the product class or as subjects of cited reports. Nothing here certifies or endorses a product, and allegations are labeled as allegations.