Using a Personal Agent? You Might Need an Emissary, Too

Andy Jenkins · October 30, 2026

Personal agents are all the rage in consumer AI right now. The frontier labs have all launched or revamped personal agent products this year (Meta Muse, OpenAI Dots, GrokBot, Claude Duet, and Google Gemini). Meanwhile, the YouTube AI explainers are hard at work on deep dives and comparisons and one-weird-tricks. These are first generation products with all the rough edges we’ve come to expect, but they are already being used by millions of people.

One of the most touted use cases for personal agents is reviewing email and drafting responses. You’re probably happy to offload triaging your inbox, but do you trust the agent to hit send without your review? If you deal with internal and external senders, receive spam or phishing attempts, need to handle confidential data, or respond with nuance depending on the receiver, it’s likely that you feel you need to review everything. Your instincts are sound: we should be skeptical about personal agents handling our outbound communication.

What makes personal agents great inside your life is what makes them wrong for external audiences. You hand them the keys to your email, your calendar, your personal documents, and maybe even your wallet, and they take care of things for you: give you a daily brief, make restaurant reservations, order groceries, remind you to pick up a prescription. Personal agents are incredibly useful and we are only scratching the surface of what they will do for us. But all of that intimate knowledge of you and access to your accounts makes your personal agent a target for attackers, creating a dilemma when you need an agent to be accessible to others.

Delegates vs. Emissaries

I like to think of personal agents as delegates, whereas what we need to communicate with others is more often an emissary.

Both delegates and emissaries act on your behalf, often with substantial resources, and are trusted by you. The main difference is in their function or mission: a delegate executes tasks on your behalf to accomplish a goal, while an emissary communicates on your behalf, speaking to others on topics within a mandate you set. Consider who you might hire in these roles: the delegate is an efficient and effective operator; they are a go-getter who can work behind the scenes to get the job done; they don’t seek the limelight. An emissary is your publicist, your spokesperson, your ambassador: they put your best foot forward; they handle tough or awkward situations with grace; they don’t make binding decisions for you.

Why Your Delegate Can’t Be Your Emissary

The case against letting a personal agent speak for you externally isn’t about the specific tool or model you’re using; it applies to any agent you’ve given a lot of power to. A personal agent is designed to act on your behalf using everything it knows about you, and that design creates real problems once you point it at your audience.

Inbound messages are untrusted input

When someone emails you, they’re writing text that your agent will read and act on. Language models don’t reliably distinguish between content to consider and instructions to follow, so a carefully written message can redirect the agent. This is called prompt injection. In 2025, researchers at Aim Security disclosed EchoLeak, a vulnerability in Microsoft Copilot where a single crafted email could get Copilot to gather sensitive data from the user’s account and send it to the attacker. The user didn’t even have to open the email; it was enough for Copilot to come across it while answering an ordinary question. Microsoft fixed that specific flaw, but the underlying weakness of prompt injection is intrinsic to how LLMs work.

Access is all or nothing

A personal agent is useful because it can see your inbox, calendar, documents, and history. What you’d willingly share with your audience is a small, deliberate subset of that. Today the only boundary between the two is an instruction like “don’t share anything private,” and that’s a request, not an access control. OpenClaw, an early personal agent that spurred the AI labs into this space, has been the subject of a nearly continuous stream of vulnerabilities.

Simon Willison coined the term “lethal trifecta” to describe the combination of private data, untrusted content, and the ability to communicate externally. An agent that replies to your email has all three, which makes it risky to leave unattended. You can require your approval before each reply, but then you’re reviewing every response yourself. You’re still the bottleneck, and your audience still has to wait for you to be available for a reply.

One principal, many counterparties

A personal agent is built around a single relationship: the one between the agent and you. An audience is many relationships at once, each member with their own history, questions, and expectations. Who asked what, what has already been answered, what was promised, who should be pointed elsewhere. A personal agent may be able to keep track of things for a while, but without an explicit capability of managing relationships and conversations across surfaces, it will eventually get its wires crossed.

There’s no front door

Your audience can reach your inbox, but they can’t address your personal agent, and by design they shouldn’t be able to. It lives inside your accounts and responds to what arrives there. No one can look it up, ask it a question directly, or connect their own agent to it. And you certainly don’t want to open up a direct channel that could allow an attacker to impersonate you to your own agent. As more of your audience gets accustomed to accomplishing tasks through their own agents, that gap matters more. When an audience member or their agent requests information from you, do you respond yourself? Ignore the request? Allow your personal agent to do it? Or do you let an emissary handle it?

The Public-Facing Agent

If you share your expertise with an audience, it’s worth asking who answers for you when you’re not available. For most of us today, the answer is no one.

As personal agents do more and more things for us, the need for public-facing agents isn’t far behind. In the same way that we’ve defined different roles for people who act on our behalf in private vs. public capacities, we’ll do the same with agents.

What are the capabilities of a great public-facing agent? The same things that make a great emissary: the ability to handle routine questions quickly and efficiently, resolve challenging communication deftly, maintain fidelity to your voice, know your audience (overall and as individuals), and help you carry your message into the world. And of course, a good public-facing agent should work hand-in-glove with your personal agent.

I look forward to exploring this space further. Hit me (or my agent) with your thoughts at answersfrom.me/andy.