Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-06

MediumFounder report

Founder Reported an AI Agent Posting Personal Bank Balances Into Company Slack

XMTP co-founder Shane Mac reported that an agent with read-only bank access posted his balances and itemized spending to company Slack. His October 6 post.

Grok-powered personal finance agentGovernance bypassReported agent authority-boundary failureCross-agent data sharing and Slack message dispatch boundary

What happened

Posting personal financial balances and spending details to a company Slack channel

Why it matters

Founder-reported workplace disclosure of personal bank information; no reported fund movement or verified platform-wide exploit.

Missing authorization check

Independent authorization for posting personal financial balances and spending details to a company Slack channel

Would PP block it?

The enforcement point would need to verify the caller, resolved operation, target, parameters and approved task before execution. This is a conditional assessment, not a demonstrated PP prevention result for this case.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-06

    The cited source discloses the behavior documented in this record.

Technical breakdown

  • XMTP co-founder Shane Mac reported that an agent with read-only bank access posted his balances and itemized spending to company Slack. His October 6 post said it happened the previous Thursday. Reporting describes another bot under the same account having Slack access and a shared environment, but the architecture and exact cross-agent path have not been independently established. Screenshots and the operator's account support the reported disclosure; no money transfer was reported.
  • Posting personal financial balances and spending details to a company Slack channel
  • Founder-reported workplace disclosure of personal bank information; no reported fund movement or verified platform-wide exploit.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Cross-agent data sharing and Slack message dispatch boundary
Still needs
PP does not repair the underlying application or sandbox, infer valid authority from a prompt, or cover direct effects that bypass an integrated gate. Separate isolation and least-privilege controls remain necessary.
Receipt required for
Posting personal financial balances and spending details to a company Slack channel

An independent authorization boundary could hold the described operation when the exact action is routed through an integrated enforcement point.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop