Shane Mac's read-only Grok Bot agent posted his bank audit in XMTP's exec Slack
Shane Mac's Grok Bot agent posted his personal bank balances and spending into his company's executive Slack channel. The agent's bank access was read-only, a limit on what it could do to the accounts that left open where it could send what it read.
The Engineer · Build desk
Mac: balances and expenses posted to XMTP's exec Slack. Head of product: saw it, took it for company financials. Finance agent: read-only access didn't limit where it sent data. Mac's agents: all shared the same connections, per Mac. Grok team: per Mac, added permission grants.
- Who's exposed exposure Shane Mac His personal checking and savings balances and major expenses were posted to XMTP's executive Slack channel, claim 1
- Who's exposed exposure XMTP's head of product Spotted the post and messaged Mac, at first mistaking the report for company financials, claim 9
- What's now possible capability Mac's finance agent Read-only bank access limited what it could do to the accounts, not where it could send what it read, claim 5
- What's now possible capability Mac's agents Slack was connected to one of his other agents, but Mac says all his agents used the same underlying connections, claim 3
- Who has to decide decision Grok team Per Mac, shipped a change requiring explicit permission before agents move information into other channels, claim 21
| Who | How | Kind | Claim |
|---|---|---|---|
| Shane Mac | His personal checking and savings balances and major expenses were posted to XMTP's executive Slack channel | exposure | 1 |
| XMTP's head of product | Spotted the post and messaged Mac, at first mistaking the report for company financials | exposure | 9 |
| Mac's finance agent | Read-only bank access limited what it could do to the accounts, not where it could send what it read | capability | 5 |
| Mac's agents | Slack was connected to one of his other agents, but Mac says all his agents used the same underlying connections | capability | 3 |
| Grok team | Per Mac, shipped a change requiring explicit permission before agents move information into other channels | decision | 21 |
What happened
- Mac said his agents appeared separate but all ran on the same underlying connections, so the Slack link he gave one of them was open to the finance agent.
- xAI's security documentation, last updated September 16, says all of a user's Bots share one cloud computer and should not be treated as a security boundary.
- Mac said the Grok team told him it had shipped a change requiring users to explicitly grant agents permission before they move information into other channels.
Why it matters
- What it limits constraint Making an agent read-only on a data source does not limit disclosure; once that agent also holds a messaging connection, only a separate egress control decides where its output lands.
- Who has to decide decision Under xAI's documented model, anyone keeping finance and work Bots on one account has to treat them as one principal with one set of credentials, or keep sensitive connections off that account.
- Who's exposed exposure Agents that resolve destinations by display name make every pair of similarly named channels a misrouting risk, and the person whose data the agent reads bears the cost.
- What doesn't add up contradiction The fix is known only through Mac's retelling of what the Grok team said, against documentation that predates it, so operators cannot yet check whether the grant is enforced per channel.
Next story · Build · Sep 29
Meta hooks its Muse agent into small businesses' QuickBooks, Shopify and Slack accountsConfirmed3 publishers
Mac's read-only grant was a limit on the bank side. As runtimewire put it, the grant constrained what the agent could do to his accounts and did not stop what it read from being sent somewhere else [5]. The rule for the other side was an instruction: send reports only to Mac, through Grok Bot [4]. An instruction like that holds only as long as the model picks the right destination on every run.
The weekly reports ran without incident. The error surfaced on the first monthly audit [6]. The post went out under Mac's identity. "As me," he tweeted [2]. XMTP's head of product spotted it and at first took the figures for company financials [9]. The Grok team traced the misdirection to the lookalike channel names, Mac said [19]. After Mac confronted it, the bot replied that it was "checking Exec Team now and deleting it if it's still up" [7]. That string matches neither channel name exactly [20]. Mac deleted the message before the agent got there [8].
xAI's security documentation was last updated 15 days before the post [17]. The shared-machine design was public before Mac hit it, and credit to xAI for stating the limit in plain words. It means a role label is only a label. A name such as "CFO" describes a task and does not fence off the accounts and destinations available across agents, runtimewire noted [12].
The reported change adds a grant on the destination side, where the leak happened. Mac's account does not say how it was built [22]. I'd expect it to hold only if the grant is checked when the tool call executes and is keyed to a specific channel, not to a name the model interprets. A permission the model is asked to remember is the same kind of control as the instruction Mac had already given [4].
The whole sequence rests on Mac's account. Futurism said it could not independently verify his claims, and noted that he is building a tool that connects AI agents and lets users set rules for them [14]. His original tweet was viewed almost 800,000 times [15]. Mac said the post was "not fake at all" [16].
His own remedy was cruder than the vendor's. He disconnected Google, his calendars, banking and Stripe, among other services [11]. "There needs to be a much clearer line between personal and work life," he wrote in Business Insider [10].
What to watch
- A revision of xAI's security documentation, last dated September 16, that describes the channel-permission grant and whether it is enforced at the tool call per destination.
- Any change to the shared cloud computer model that would let separate Grok Bots under one user hold separate credentials.
- Confirmation of the fix from xAI itself, since Futurism could not independently verify Mac's account.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence55
Perspective Coverage
3 publishers- Builder
- Builder 48%
- Operator
- Operator 35%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Shane Mac's personal finance agent sent a bank audit to XMTP's executive Slack channel; the post went up on October 1 and included his personal checking and savings balances and major expenses.
- [2]
"Last Thursday, an AI agent posted my personal bank balances into our company Slack. As me."
- [3]
Mac said he had connected Slack to one of his other agents, but all the agents used the same underlying connections even though they appeared to be separate.
- [4]
Mac said he had given the agent read-only access to his bank accounts and instructed it to send reports only to him through Grok Bot.
- [5]
Read-only access limited what the agent could do to the accounts; it did not keep the information it read from being sent somewhere else.
- [6]
Mac's first finance agent ran weekly without incident; the error surfaced when its monthly audit ran.
- [7]
"checking Exec Team now and deleting it if it's still up"
- [8]
Mac said he deleted the message before the agent could do so.
- [9]
XMTP's head of product spotted the post and messaged Mac, initially mistaking the report for company financials.
- [10]
"There needs to be a much clearer line between personal and work life,"
- [11]
After the post, Mac said he disconnected Google, his calendars, banking and Stripe, among other services.
- [12]
A label such as "CFO" names a task; it does not fence off the connected accounts and destinations available across agents.
- [13]
xAI's security documentation, last updated September 16, says all of a user's Bots share one cloud computer, including its files, browser sessions and command-line credentials, and that separate Bots should not be treated as a security boundary.
- [14]
Futurism said it was unable to independently verify Mac's claims, and noted he is building an AI tool designed to connect AI agents while allowing users to set rules for them.
- [15]
Mac's original tweet about the incident was viewed almost 800,000 times.
- [16]
"not fake at all"
- [17]
xAI's security documentation was last updated 15 days before the October 1 post.
- [18]
The agent could reach several connected services. Mac's personal group chat was called "My Personal Exec Team" and the XMTP Slack channel was called "Exec-team"; on its first monthly audit the agent selected the work channel.
- [19]
The Grok team traced the misdirected message to the similar channel names, Mac said.
- [20]
The bot's reference to "Exec Team" matches neither "My Personal Exec Team" nor "Exec-team" exactly.
- [21]
Mac said the Grok team told him users would need to explicitly grant agents permission before they could move information into other channels, and that it had shipped the change "last night."
- [22]
Mac's account describes the reported fix but does not specify how it was implemented.
Sources
3 independent publishers whose own reporting we read for this story.
- dev.toYour AI Agent Is Not Your Employee. It Is Your Blast Radius.
1 article · October 10, 2026
- futurism.comMan Says He Was Mortified When His AI Agent Posted His Bank Balances and Exactly What He's Spending His Money on in a Slack Work Channel
1 article · October 7, 2026
- runtimewire.comXMTP Labs CEO says Grok Bot added channel permissions after his bank audit hit Slack
1 article · October 9, 2026