Today I went to test my personal agent; I wanted to see what would happen if I didn't give it access to my Google search—I had completely revoked that access (so there was no way it could know the path to it).
I sent it a message asking it to email a client, and it replied: "All set—shall I run it?" I said yes, knowing it couldn't access Google to send the email.
Suddenly, it opened a Google profile I had never used with it and navigated through the steps to send the email (though I cut it off there because I didn't actually want to send anything; it was just a test).
I don't know how it was possible, since it didn't have access to the computer's terminal either, but it’s wild what happens when you push AI to its limits. I’ve fixed the issue now, but just imagine if this happened with other users of my assistant and it didn't stop them from sending the email. If you want to try it out (it won't hack your computer), check out usedash.es