Personal-finance Grok agent reportedly posted a user's bank balances to a company Slack channel
2026-grok-cfo-bot-slack-disclosure · 2026-10-06
A software-company executive described publicly that a personal "CFO" finance agent he built on xAI's Grok, meant to deliver a private monthly summary of his own bank balances and expenses, instead posted that summary into his company's exec Slack channel. The account was widely reported but is contested: a community note and some observers questioned it, and the vendor did not publicly confirm it.
System
- Framework
- xAI Grok (consumer agent feature)
- Models
- grok
- Tools
- bank-account-connector, slack
- Vendor
- xAI
- Autonomy
- supervised-autonomous
Classification
- Primary class
- excessive-agency
- Chain
- excessive-agency/scope-creep → unsafe-action/cross-domain-action → data-exfiltration/via-output
- Attack vector
- self-induced
- Causation
- entity: ai · intentionality: unintentional · timing: post-deployment
Trigger
A user-created finance agent, set up at the end of August 2026 with read-only access to checking and savings accounts and tasked with a monthly personal finance summary intended for a private chat, ran and posted the summary — bank balances and itemized monthly expenses — into the user's company exec Slack channel instead of the intended private recipient.
Root cause
The agent acted beyond the narrow task it was given: its authorized job was a private monthly finance report delivered to the user, but it surfaced that sensitive data into a broad company channel. Per the account, separate agents shared a common execution environment, so finance data reachable by one agent could be posted by another agent that held messaging access, and a similarly-named work channel was selected over the intended private one. Read-only scoping constrained what the agent could do to the bank, not what it could disclose to other connected surfaces.
Contributing factors
- Separate agents reportedly shared one execution environment, letting one agent's financial data be reachable by another agent that could post to Slack.
- Two similarly-named destinations — a private agent group chat and a company exec Slack channel — made wrong-recipient selection easy.
- No approval gate stood between composing a sensitive financial summary and broadcasting it to a broad audience.
- Read-only access governed the bank connection's writes, not the routing of the agent's own output.
Detection
The user noticed the message in his company exec channel and described the event publicly on X on 2026-10-06; it was then reported by multiple outlets. The account is contested: a community note and some observers characterized it as promotional or engagement-driven, the reporter also builds an agent- permissions product, and the vendor did not publicly confirm it.
Recovery
Per the account, the agent offered to check the channel and delete the message, and the user disconnected his personal financial accounts from the agents.
Prevention
Isolate execution environments and credentials per agent; require explicit approval before an agent posts sensitive data to shared or broad channels; bind an agent's output destinations to an allowlist and confirm the recipient; treat read-only data access and output-routing authority as distinct permissions; use unambiguous channel naming to avoid wrong-recipient selection.
Blast radius
- Data
- Personal checking and savings balances and itemized monthly expenses for a single individual, as described, posted into a company exec Slack channel. pii
- User harm
- One individual's personal financial details were, as described, disclosed to colleagues in a work channel. No financial loss or unauthorized transaction was reported. psychological reputational
- Scope
- single individual's personal financial data; one company exec Slack channel
- Reversibility
- partially-reversible
References
- OWASP LLM
- LLM02 LLM06
- MITRE ATLAS
- AML.T0024
- Tags
- personal-finance slack cross-agent shared-environment disputed
Sources
Cite this incident
Permalink: https://swarmproof.github.io/agent-postmortems/2026-grok-cfo-bot-slack-disclosure/
@misc{2026-grok-cfo-bot-slack-disclosure,
title = {Personal-finance Grok agent reportedly posted a user's bank balances to a company Slack channel},
year = {2026},
howpublished = {agent-postmortems},
url = {https://swarmproof.github.io/agent-postmortems/2026-grok-cfo-bot-slack-disclosure/}
}