Personal agent

What is a personal agent?

A personal agent is an AI assistant that one person runs for themselves, with access to their own files, mail, browser and accounts. It sits on their laptop, or on a service they signed up for with their own card.

A chatbot answers you. A personal agent goes and does the thing: it opens the mailbox, reads the attachment, fills in the form, sends the reply. To do that it needs logins, and the logins it uses are the person's own. So every action arrives at the other end under that person's name. The mail server did not see an assistant send a mail. It saw a colleague send a mail, because as far as the mail server is concerned, that is what happened.

It is also not an agent your company deployed. A company agent has an owner, a scope somebody signed off on and usually a login of its own. A personal agent has one user, and that user is also its administrator, its security review and its only witness.

The three shapes you meet in practice

A hosted assistant on a personal mailbox and calendar. You sign in once and tick a consent screen. From then on it reads your mail, drafts replies and moves things in your agenda. That screen is the whole access decision, and nothing asks again.

A self-hosted agent on the laptop. This one has the file system and usually a shell. The permission models are thought through: Claude Code reads inside the working directory without asking and stops for approval on shell commands beyond a built-in read-only set, with allow, ask and deny rules you write per command. It also has a mode that skips the prompts, which Anthropic's documentation says to use only in isolated environments such as containers or virtual machines where it cannot cause damage. All that care then rests on one tired person clicking through prompts at half past five.

A browser agent that is already logged into everything. An agentic browser works inside your session, so it inherits every site you are signed into. Anthropic's permissions guide for Claude in Chrome describes a per-site model: allow once, always allow here, or decline, with downloads, entering sensitive information and granting authorisations kept behind a confirmation regardless. For work involving money, messages sent under your name or important files, its own advice is to stay close and watch. Admin controls for that extension exist on Team and Enterprise plans, so on a personal subscription nobody is administering anything.

Why staff install one without asking

Verizon's 2026 Data Breach Investigations Report put regular AI use on corporate devices at 45 percent of employees, up from 15 percent a year earlier, and 67 percent of those users reach the service through a non-corporate account. That second figure is the one that matters here, because a non-corporate account is where a personal agent lives.

None of it is misconduct. Somebody had ninety mails to triage, found something that got it down to twenty minutes, and used it. The wider pattern is shadow AI, and a personal agent is its most capable form, because it does not stop at answering.

What it exposes, and one way that plays out

Company documents in a service you never assessed. Contracts, personnel files and client data go to a provider you have no agreement with, under terms nobody read, possibly outside the EU.

Access nobody granted. The agent has whatever the person has, including the folders they can reach and never open.

Instructions from outside. A web page or an incoming mail can carry text meant for the agent rather than the reader. Something that reads untrusted input, holds private data and can send is the shape described in the lethal trifecta, and a personal agent is usually all three at once.

Here is how that becomes a leak with nobody meaning harm. A payroll administrator at a twenty-person accountancy office connects a hosted assistant on her own account to her work mailbox, so it can sort and draft. A client sends the year-end payroll file as an attachment. She asks for a summary, dropped into her own notes app so she can finish reading at home. The assistant does that: it pulls the attachment, sends it to the provider to be read, and writes names, gross salaries and national register numbers into a personal account outside the office. Every step was reasonable to the person taking it, and the office ends up with no agreement covering the transfer and a mail log showing only that she opened a message.

Six months later she moves on. Her mailbox is closed on her last day and her laptop is wiped. Nothing in that process touches the assistant, because it was never on any list, and the summary stays where it is.

A personal agent versus a company-deployed agent

Both do the same work. They differ on one dimension, and the rest follows from it: whose identity the actions land under, and therefore who answers for them.

A company-deployed agent gets its own login in your directory, which makes it a non-human identity with a named owner. You grant it rights instead of it borrowing a colleague's, it writes its own lines in the log, and you can switch it off in the afternoon without touching anyone's account.

A personal agent borrows a person. Its rights are whatever that person has, its log lines are their log lines, and switching it off means asking them or disabling their account. Accountability then splits badly: the colleague carries actions they may not have watched, and the company carries a tool it never chose. Neither of them can show afterwards which actions were whose.

What you answer for as the employer

Under the GDPR you are the controller for personal data about your staff and your clients. The EDPB says it plainly in its guidelines on the concepts of controller and processor, adopted in July 2021: some processing is naturally attached to the role of an entity, and the example it gives is an employer processing data about its employees. That does not change because the software was picked by the person doing the work.

The AI Act lands the same way. Article 3(4) defines a deployer as a person or body using an AI system under its authority, except where the system is used in the course of a personal non-professional activity. An assistant your employee uses to get the job done is not that exception, so the deployer duties are yours, along with the obligation in Article 4 to take measures supporting AI literacy among the people operating AI systems on your behalf. That is where an AI usage policy stops being paperwork.

"An employee installed it" is not a control. It is a description of the gap.

What a small company can do, in order of usefulness

1. Write down what is allowed, on one page. Name the tools people may use, the data that never leaves and one person to ask. A ban nobody follows just moves the same behaviour onto private phones.

2. Give people a sanctioned equivalent. This is the only step that changes behaviour instead of describing it. It has to be there the week the policy lands and good enough for the everyday case, or the personal one stays.

3. Keep company data where access can be granted and taken back. Documents in a managed workspace can be shared with an agent and unshared from it. Documents in a private notes app cannot be reached, which also means they cannot be pulled back.

4. Separate the identities. Where the work genuinely needs an agent, give it its own login with its own rights, so the log can tell the two apart and you can revoke one without the other.

None of that needs a platform purchase. It needs a decision about which agents you know about, and most companies have not made that one yet.