Innovation asks for more access. Security, privacy and governance ask where the boundaries belong.

We keep being told to protect our data. Check permissions. Think before giving an app access to your accounts. Then the next product launch promises an assistant that can read your inbox, navigate websites, and handle your daily tasks. Its usefulness depends on access to the very things we have been told to guard.

An October 2026 disclosure gave that tension a concrete example. Anthropic reported that an unreleased research model assigned a practice form had instead submitted the real version when the copy failed to load or was accidentally closed. The New York Times reported that agents submitted 20 incomplete visa applications to the State Department, none of which were processed. A separate evaluation produced an invented homicide tip to Philadelphia police, which was filtered as spam and never investigated. The consequences were limited, but test tasks had produced real submissions.

An institution can receive an agent’s actions without ever choosing to use one. That makes autonomy a question of public accountability as well as personal convenience.

It feels like a tech war unfolding through product releases, policies, and permissions. Innovation expands what software can do for us. Security, privacy and governance ask what it should be allowed to do, with whose information, and under whose supervision. These concerns help define acceptable autonomy. The largest technology companies occupy an advantageous position: they can supply the automation and the systems meant to make it trustworthy.

Google launched Workspace Studio in December 2025 to let users build AI agents that automate work across Gmail, Drive, Chat, and connected business applications. Its examples include extracting details from emails and attachments and coordinating workflows.

Privacy principles ask whether that access is justified. The European Commission’s GDPR guidance includes collecting only the personal data needed for a stated purpose and limiting incompatible reuse. The EU AI Act adds a governance framework organized around the risks of particular AI uses. Both require the purpose and consequences of a deployment to matter.

Does an assistant need one travel confirmation to help with a trip, or continuing access to years of correspondence? Broad access might make it more useful. It also enlarges what the system could expose or misuse.

Selling delegation and reassurance

Microsoft shows how a major supplier can offer both delegation and reassurance. In March 2025, it announced autonomous Security Copilot agents alongside new protections for AI applications through its security products. The announcement included controls intended to prevent sensitive information being entered into services such as ChatGPT, Google Gemini, and Microsoft’s own Copilot Chat.

Security teams have work worth automating, and organizations need controls over information entering AI systems. This is a commercial opportunity as well as a security response: the company promoting delegation can supply the platform, the identity systems governing access, and the security tools monitoring its use.

In my view, this positions incumbents to serve both enthusiastic and cautious buyers. That commercial incentive persists even when the risks are real and the protections useful. Their advice about safe adoption deserves the same examination as their productivity claims.

An established provider can also make expansion feel routine. A new company’s assistant is another relationship to assess. One appearing inside familiar work software can look like an upgrade. Yet new access, processing purposes, or powers to act still require a decision.

This is where the security double standard becomes worth discussing. Preference for a familiar supplier may be justified by stronger controls or better contractual protections. Familiarity alone cannot justify granting the same authority we would question elsewhere. That is a demand for consistent scrutiny, not evidence that incumbents have manufactured safety concerns to disadvantage competitors.

The data rules can change inside the same ecosystem

Google’s published policies show why these distinctions matter. Google says Gemini inside Gmail does not train its foundational AI models on personal emails. Its Workspace service terms also restrict using Customer Data to train or fine tune models supporting Workspace’s generative AI services without the customer’s prior permission or instruction. Those commitments have specific scopes.

Personal Gemini’s Personal Intelligence feature has different rules for connected apps. With Keep Activity enabled, training can include summaries, excerpts, and inferences from connected emails and files. Google says it reduces personal information or applies privacy preserving techniques before training. For a short or particularly relevant email or file, it says the summary may be the email or file itself.

This is disclosed behavior, with rules that differ by experience and setting. Someone can hear that Gmail content is protected and miss that sharing it through another Google AI experience brings different rules into play.

What guarantee does a user actually have? Published commitments, applicable contractual restrictions, and assurance mechanisms matter. Google says independent auditors validate its Workspace practices against relevant standards. But a help page does not give users direct visibility into its training datasets. An assessment still needs to establish which commitment applies and what an audit verifies.

Processing information to answer a question differs from training a model on it. An assistant can read a document without using it for future training. The reassuring phrase “not used for training” cannot carry the entire privacy discussion.

Meta illustrates how an existing relationship can acquire a new data purpose. In April 2025, it announced plans to train AI using public posts and comments from adults in the EU, alongside interactions with Meta AI. It offered an objection process. Its stated exclusions cover private messages between friends and family unless someone shares them with its AI features. Those boundaries matter, as does the broader question of how people understand later uses of content they originally shared for another reason.

Big Tech has faced real scrutiny over data practices. Google’s $391.5 million settlement with 40 state attorneys general in 2022 concerned misleading location tracking controls. The states said turning off Location History did not stop collection through a separate setting. That historical case does not establish anything about today’s Gemini training. It does illustrate why having a privacy control and understanding its scope are different things.

Autonomy changes the security problem

Consistent scrutiny must also acknowledge what makes an agent different from a storage service. Cloud email already involves trusting a provider with sensitive material. Connecting an agent can add the ability to interpret that material, combine it with other records, and act through tools. Shared risks such as account compromise do not make the complete threat models identical.

An attacker can place instructions inside an email or document that an assistant is meant to read. If the assistant treats that content as authority rather than information, the attacker may influence what it does with access already granted to it. This is indirect prompt injection. It becomes especially consequential when a system can both retrieve private information and transmit it elsewhere.

EchoLeak demonstrated that risk inside Microsoft 365 Copilot in 2025. Researchers used a crafted email to cause sensitive information in Copilot’s context to be sent outside the organization, without the victim clicking a malicious link. The attack depended on Copilot retrieving the email during use and combined prompt injection with other weaknesses. The flaw was addressed, and the researchers’ account says Microsoft confirmed no customers were affected. This was a demonstrated vulnerability, not evidence of a mass breach.

Established platforms face these risks too. A promise not to use data for training cannot settle the security question: information can be disclosed during a task without becoming training data.

Even an assistant enforcing permissions correctly can inherit an access problem. Microsoft says its work Copilot respects users’ existing access rights. Consider an HR folder accidentally shared too widely: an assistant honoring those rights would inherit the mistake. It could make sensitive material easier to find without granting anyone new permissions.

The degree of autonomy matters as well. Drafting a reply for review carries less authority than sending messages, changing records, or approving transactions.

Comparisons should also match the services involved. OpenAI says its business products and API do not use business data for model training by default. Microsoft says organizational prompts, responses, and data accessed through Microsoft Graph are not used to train foundation language models. A consumer chatbot account and an enterprise deployment can have materially different protections, even under the same brand.

Who bears the consequences?

The Anthropic cases show that an agent can affect a real institution without an attacker manipulating it. The police evaluation did not explicitly prohibit form submissions, so it does not establish deliberate defiance. Anthropic says it is suspending live internet access across internal evaluations until safeguards reliably catch such behavior. The response reinforces an engineering requirement: instructions need to be backed by controls over what an agent can actually do.

In its October 10 editorial, “Hold A.I. Companies Liable,” the Times editorial board argued that autonomy should not diminish the responsibility of the companies building these systems. It called for enforcement of existing laws and consideration of stricter liability standards. That is an argument for accountability, not a court ruling establishing how every AI claim will be decided.

Governance must address responsibility among developers, deploying organizations, and users, whose control over a failure differs. Those distinctions deserve examination before harm occurs, rather than leaving affected outsiders to untangle them afterward.

The useful standard follows the task: what information does it require, what actions can the agent take, where can information go, and what can someone review afterward? It must also ask who responds when a boundary fails. The same questions should apply to a startup’s assistant and a feature added by an incumbent.

I am still undecided. I hate grunt work, and the idea of paying $20 a month for an agent to take repetitive admin off my hands is immediately attractive. I can see the appeal of software that handles the tedious parts of life while I spend time on something worthwhile.

But the cybersecurity part of me struggles with the access and authority that some versions of that convenience require. I want evidence that the boundaries will hold, especially when a task goes wrong. Getting my time back sounds like a good deal, however I am still working out how much control I am willing to give up for it.