AI Agents Can Now Act for You: What You Should Never Let Them Do Unsupervised

AI assistants are becoming agents that can browse websites, use connected services and take actions on a user’s behalf. That convenience is powerful, but some decisions should still require a human hand on the final button.

AI agents are moving beyond answering questions. They can browse websites, use connected tools, work with files and complete multi-step tasks on a user's behalf. That makes them useful but it changes the safety question. When an AI can take an action rather than merely suggest one, a mistake can become a sent email, deleted file or changed account setting.

OpenAI's guidance for building AI agents says sensitive, irreversible or high-risk actions should trigger human intervention. Meanwhile, the US National Institute of Standards and Technology is examining identity and authorisation controls for AI agents as these systems gain more autonomy. The practical rule is simple: automate low-risk work, but keep a human decision between the agent and anything difficult to reverse.

The biggest change is permission

A chatbot that drafts an email cannot send it unless another system gives it permission. An agent connected to email, cloud storage, a browser or business software may be able to do considerably more. That is why permissions matter as much as model intelligence.

NIST says organisations need ways to identify agents, determine what they are authorised to access and maintain accountability for their actions. For ordinary users, the equivalent principle is least privilege: give an agent only the access required for the current task. If it only needs to summarise a document, it should not also have permission to modify folders, publicly share files and access unrelated accounts.

Do not let an agent move money by itself

Financial transactions are a clear example of where convenience should stop. An agent can help organise invoices, compare charges or prepare a transaction for review. It should not independently decide that money should leave an account and complete the transfer without confirmation.

OpenAI's agent guidance specifically identifies actions such as making payments as examples where human intervention can be particularly important. The issue is not simply whether the model is “smart enough.” An agent could misunderstand an instruction, use the wrong amount or be influenced by malicious content encountered while browsing.

For Africans managing more business, freelance work and financial activity online, one mistaken action can be considerably more expensive than one mistaken AI answer.

Never hand over account-security decisions

Password resets, recovery-email changes, two-factor authentication settings and access permissions should remain supervised. These controls determine who can enter an account later. An agent may guide you to the correct settings or explain a security alert. It should not independently remove a security method, add a new recovery destination or grant another person access.

OpenAI's current information about ChatGPT agent also warns that agents connected to websites and applications may gain access to sensitive information such as emails, files and account settings. A misdirected agent with broad permissions has a much larger potential impact than a chatbot that can only answer questions.

Be careful with deletion and irreversible actions

Deleting duplicate downloads is very different from permanently removing a company database, cloud folder or years of photographs. Agents can be useful for identifying files that appear unnecessary, organising storage and preparing cleanup lists.

The final irreversible step should be reviewed when the consequences are significant. The same principle applies to cancelling important bookings, closing accounts or making changes to production business systems. Where possible, use reversible actions first: draft instead of send, archive instead of permanently delete, and preview instead of immediately publish.

Do not let an agent speak publicly as you without review

AI can write quickly, but a message sent in your name can create consequences that the model does not fully understand. That includes customer replies, public social-media posts, formal complaints, employment communications and statements made on behalf of an organisation, an agent can prepare the draft.

A person should review high impact communications before they leave the account. The model may understand the words while still missing important social, legal or reputational context surrounding them. For businesses adopting agents to handle more customer interactions, this distinction matters. Faster responses are useful; confidently sending the wrong response at scale is not.

The hidden danger is what the agent reads

One of the most important security problems facing AI agents is prompt injection. Anthropic describes prompt injection attacks as malicious instructions hidden inside information an AI processes, potentially including webpages, documents and other external content, a vulnerable agent could interpret those instructions as something it should follow. That makes browser-enabled agents unusual: information they encounter can potentially influence actions they are capable of taking.

Anthropic says prompt injection remains a difficult security problem despite increasingly sophisticated protections. Its more recent research on trustworthy agents similarly stresses that greater agent autonomy creates more opportunity for unintended actions. The OWASP AI Agent Security Cheat Sheet also identifies threats including prompt injection and excessive agent permissions. This is why an agent should not receive unlimited access simply because you trust the company that built it. The content the agent encounters may have been created by someone else.

Sensitive information should stay on a short leash

An agent does not need access to every folder, inbox and account simply because broader access makes it more capable. Before connecting a service, ask what information the agent actually needs. Identity documents, confidential business files, passwords, private messages and financial records deserve particularly careful treatment.

Where a platform provides permission controls, restrict access to what is necessary. Remove connections that are no longer needed. For organisations, logging and audit trails should also make it possible to determine what an agent accessed and what actions it took. Security should be designed around the consequences of a failure not around the assumption that failures will never happen.

Our Recommendation

AI agents are most useful when they remove repetitive work without removing human judgment. Let them research, organise, compare, draft, summarise and prepare actions. Keep direct supervision over actions involving money, account security, sensitive information, irreversible deletion and high-impact communications. And avoid giving an agent permanent access to systems it only needs occasionally.

The safest question is no longer simply:

“Can the AI agent do this?”

Ask instead:

“How much damage could happen if it does the wrong thing?”

If the answer is serious, the final click should still belong to you.

Verification Links

• OpenAI — A Practical Guide to Building AI Agents
• OpenAI — Running Codex Safely
• OpenAI — ChatGPT Agent Safety and Privacy
• NIST NCCoE — Software and AI Agent Identity and Authorization
• Anthropic — Trustworthy Agents in Practice
• Anthropic — Prompt Injection Defences for Browser Use
• OWASP — AI Agent Security Cheat Sheet