Giving an AI agent your logins: what UK businesses should check first
Meta’s former security chief has called handing bank logins to an AI agent “totally insane”. You do not need to panic, but you do need a plan. Here is a calm, practical way to use AI agents safely in a Microsoft 365 business.
What happened
Meta has launched Muse, a personal AI agent that can act on a user’s behalf. Alex Stamos, Meta’s former security chief, told the Big Technology Podcast that it is “totally insane” to give an AI agent things like bank logins. Business Insider reported his comments.
Some users are reportedly giving Muse their password vaults and whole inboxes, which means an agent could read years of messages. Stamos also made a wider point: agents are “not stolen credentials, but are clearly bots doing interaction”, and some agent products are reported to get past the bot-detection that banks and other services rely on.
Meta says Muse runs on an isolated virtual machine. It also says “no automated system is perfect” and advises users to review activity and limit access. That is sensible advice, and it applies to every AI agent, not just this one.
Reported issues so far
| When | Issue | Status |
|---|---|---|
| September 2026 | Researchers reportedly found vulnerabilities in Muse (The Information). | Reported. We have not independently confirmed the details. |
| October 2026 | Shared chat links could reportedly be discovered and used to expose conversation data (Ars Technica). | Reported. Meta is said to have paused the sharing feature while it reviews. |
| November 2026 | Stamos publicly warns against sharing financial logins with agents (Business Insider). | Opinion from a security expert, on the record. |
A single YouTuber has also alleged that Muse gave out his address. That is one unverified claim, so we have left it out of the table.
Why this matters to your business
Inbox exposure
A full mailbox holds contracts, invoices and client details going back years.
Shared credentials
A shared vault is a master key. One weak link opens everything inside it.
Shadow AI
Staff may connect AI tools you do not know about, using their work accounts.
Data protection
Client personal data passed to an unapproved tool can create UK GDPR obligations.
It’s not just Meta
Any AI agent that acts for you, whoever builds it, needs three things:
- Guidance: a short policy saying which tools staff may use and what data they may share.
- Guardrails: technical limits, such as restricted app consent, MFA and conditional access.
- Oversight: logs and alerts, so someone sees what an agent did and can switch it off.
Safe versus risky
| What you share with an agent | Risk | Why |
|---|---|---|
| A password vault | Critical | Gives access to every account in it, with no way to limit scope. |
| Full mailbox access | High | Years of private and client information become readable. |
| A single shared folder | Medium | Limited scope, but still check what is inside. |
| An approved tool with no account access | Low | It only sees what you paste in, under your policy. |
Five steps to take this week
- Write a one-page AI acceptable-use policy. Name approved tools, banned data types and who to ask. Our AI Readiness Sprint can help you draft it.
- Review third-party app consent in Entra. Check Enterprise applications, remove unknown apps and restrict user consent so new apps need admin approval. Microsoft 365 support can run this review for you.
- Enforce MFA and conditional access. Require MFA for everyone and block sign-ins from unmanaged devices where you can. This is also a core Cyber Essentials control.
- Ban password-vault sharing with AI tools. Say it plainly in the policy and in staff training.
- Turn on audit logging and alerts. Alert on new app consents, mailbox rules and unusual sign-ins. Microsoft Defender and Purview provide the tooling.
Failover: a tested copy beats a promise
Cloud AI is a sound primary choice. Resilience does not mean cloud versus no cloud. It means a replicated, independent and tested failover: cloud primary, tested off-site copy.
| What to replicate | Why |
|---|---|
| Prompts and settings, in version control | You can rebuild an agent’s behaviour anywhere. |
| Data and knowledge bases | The fallback needs the same information to be useful. |
| A second model | Removes dependence on one provider. |
| Access and keys | Stored separately, so an outage or breach does not lock you out. |
| A manual fallback | The business keeps working if every tool is down. |
Then test it. Run drills, and agree recovery targets in advance: how long you can be without the agent, and how much recent data you can afford to lose.
One option: a self-hosted open-source fallback
| Public cloud agent | Self-hosted open source | |
|---|---|---|
| Setup effort | Low | Higher |
| Patching and monitoring | Provider’s job | Yours, or your IT partner’s |
| Data location | Provider’s regions | You decide |
| Capability | Usually the latest models | Often a step behind |
| Best used as | Primary | Tested fallback |
FAQ
What is an AI agent?
An AI agent is software that takes actions for you, such as reading email, filling in forms or booking services, rather than only answering questions.
Is it safe to give an AI agent access to my email?
Full mailbox access is a high risk. Start with a single shared folder or an approved tool with no account access, and review what the agent does.
Should we stop using cloud AI?
No. Cloud AI is a sound primary choice. Add a tested, independent failover so you are not reliant on one provider.
Is open source safer than a cloud AI service?
Not automatically. If you self-host, you are responsible for patching, access control and monitoring.
How do I see which AI apps are connected to Microsoft 365?
In the Entra admin centre, review Enterprise applications and their permissions, remove anything you do not recognise, and restrict user consent so new apps need admin approval.
What should an AI acceptable-use policy cover?
Approved tools, data that must never be shared, a ban on sharing password vaults, who approves new tools, and how to report a concern.
How often should we test our failover?
Run a drill at least twice a year and after any major change, checking against recovery targets you have agreed in advance.
Book a free review
We will check your Microsoft 365 app consent, MFA and logging, and help you draft an AI policy. No jargon, no obligation. Or start with our Shadow AI Check, or download our free AI acceptable-use policy template.
Book a free reviewSources: Futurism (4 Nov 2026); Business Insider via the Big Technology Podcast; The Information (September 2026); Ars Technica (October 2026). Items marked “reported” have not been independently verified by ABCOM.
Related FAQs
Plain-English answers to the questions this article raises:
Last updated 7 November 2026.
Do not just read it. Act on it.
Reading is the easy part. Book a free IT review and we will tell you, in plain English, where your business stands and what to fix first.
