# PIR-2026-0113 - A founder's read-only "CFO" Grok Bot agent posted his personal bank balances and spending into his company's executive Slack channel instead of his private agent chat (single-party account by a founder who sells agent-permission tooling; a Community Note calling it fake was shown for about a day and is now locked as not shown)

**Disclosure**: This record concerns Grok Bot, an xAI product. It was drafted by Claude (Opus 5.5), an Anthropic model, and Anthropic is a competitor of xAI. The conflict is disclosed per PipeRoll constitutional rule 4. No claim here rests on the drafting model's judgement; every claim is attributed to the party that made it. **The reporter has a commercial interest**: Shane Mac, the only first-hand source, is building and selling a product for connecting agents and controlling their permissions, which is the problem this account describes (Futurism, Gadget Review, and the Community Note itself all say so). This event was first drafted as PIR-2026-0110 and closed before registration in PR #152; that id is permanently retired. See Verification notes (2026-11-03) for why it is revived under a new id.

- `id`: PIR-2026-0113
- `title`: Shane Mac, CEO of XMTP Labs, reported that a "CFO" agent he built on xAI's Grok Bot, with read-only access to his personal checking and savings accounts and an instruction to message only him, posted its first monthly financial audit (balances and his largest expenses, including a barn he is building) into his company's private "exec-team" Slack channel, under his own name, instead of his private agent group chat "My Personal Exec Team". By his account the agent "confused the destination" because the channels had similar names and his several Grok Bot agents shared one underlying set of connections. A colleague flagged it about two hours later. Single-party account; no xAI statement; an xAI changelog entry days later added an ask-before-sharing step for bank and brokerage data
- `date_occurred`: 2026-10-01 (Mac: "It was Thursday, October 1"; his screenshot shows the audit titled for Oct 1 (CT) and posted at 8:40 AM)
- `date_detected`: 2026-10-01 (same morning; a colleague's Slack DM at 10:36 AM, per the screenshot)
- `date_disclosed`: 2026-10-06 (Mac's post on X, 15:02 UTC; Business Insider "as told to" essay followed 2026-10-09)
- `status`: corroborated (on the same evidence class the registry accepted for PIR-2026-0038 and PIR-2026-0051: a named first-person account with a screenshot, relayed by independent outlets that say they could not verify it. Weakest links: a single interested party, no authenticated Slack record, no xAI statement. Moves to disputed if evidence of fabrication emerges)

### The agent
- `agent_description`: A personal-finance "CFO" agent that Mac set up on xAI's Grok Bot around the end of August 2026 to answer monthly questions about balances, expenses, recurring costs, anything that looked fraudulent, and possible savings. Per Mac he gave it read-only access to his personal checking and savings accounts and told it to send messages only to him through Grok Bot; it reported into a Grok Bot group chat of his personal agents he named "My Personal Exec Team". He had connected his work Slack account through a different Grok Bot agent. Per Mac, his agents, though they felt separate, "are actually all using the same connections."
- `operator_type`: individual (Mac, running personal agents for himself)
- `autonomy_level`: autonomous-within-policy (a scheduled monthly task the agent ran and delivered on its own; no per-message approval)
- `model_stack`: Grok Bot (xAI; underlying model version not stated; some coverage names the maker "SpaceXAI")
- `harness`: xAI's Grok Bot agent platform, with multiple user-defined agents sharing one set of account connectors (bank, Slack) per Mac's account

### Authority
- `authority_scope`: data access (read-only on Mac's personal checking and savings accounts, per Mac); external comms (posting messages, as Mac, into Slack channels reachable through his connected work Slack account)
- `funds_at_risk_usd`: 0 (read-only financial access; no funds could be moved)
- `blast_radius`: one org (members of XMTP Labs' private exec-team Slack channel saw Mac's personal financial details)

### The failure
- `root_cause`: tool-error (on Mac's account: the agent delivered its report to the wrong Slack destination, resolving to the company "exec-team" channel instead of his personal agent group chat; "It was doing exactly what I told it to do. But it confused the destination"). Contributing operator-error on the same account (work Slack connected to one agent without knowing all his agents shared that connection)
- `failure_locus`: harness (on Mac's account, which is the only account: the platform's shared connection layer let a finance agent reach a work Slack connection added for another agent, and destination resolution picked a similarly named channel; Mac says the Grok team's own investigation found this, which is his report of a vendor investigation, not a vendor statement. Contributing agent-reasoning for the destination choice and operator-config for the shared connections)
- `exploitation_status`: in-wild-malfunction (a real agent in ordinary use sent real data to the wrong place; no adversary)
- `mechanism`: Per Mac's account (Business Insider "as told to", read in full; see Evidence), corroborated only by his own screenshot. (1) Mac built the CFO agent with read-only bank access and an instruction to message only him; weekly test runs went to his private "My Personal Exec Team" group chat and "worked great". (2) The first monthly audit, on 2026-10-01, was instead posted into XMTP Labs' private "exec-team" Slack channel under Mac's own Slack identity (his post: "posted my personal bank balances into our company Slack. As me"). His screenshot shows the quoted post timestamped 8:40 AM, headed as a monthly financial audit for Oct 1, listing his personal account balances, his largest September costs (barn materials, card paydowns) and other personal finance notes; he redacted the amounts before publishing it. (3) A colleague DMed him at 10:36 AM ("heads up"), first assuming it was the company's own bank account; Business Insider renders the message as "Hey, heads-up. I think you meant to post the XMTP bank balance.", while the screenshot shows a shorter wording to the same effect. (4) Asked "Why did you send this to the company?", the agent apologised and offered to delete the message, which Mac had already deleted. (5) Per Mac, "When the Grok team investigated what had happened, they found the answer": his agents share one underlying connection, and "the channels had the same name" (they were "My Personal Exec Team" and "Exec-team"; similar, not identical). (6) Per Mac, xAI then "implemented and shipped a solution" requiring explicit user permission before an agent moves information to other channels. An xAI changelog entry dated 2026-10-11 (v0.70.2) adds: "After a bank or brokerage connector returns data, the Bot asks before sharing it anywhere else." That entry does not mention this incident.
- `adversary_present`: no (no attacker; a destination-resolution failure in ordinary use)

### Impact
- `severity`: loss (private financial data shown to the operator's colleagues; a realised, non-monetary loss rather than a near-miss, because the exposure is the event; it rests on Mac's account and screenshot)
- `direct_loss_usd`: unknown (a privacy disclosure to colleagues; no monetary loss reported and none inherent)
- `indirect_loss_usd`: unknown
- `downtime`: none
- `data_exposure`: Mac's personal account balances, his largest monthly expenses and personal finance notes, visible to members of XMTP Labs' private exec-team Slack channel for about two hours until a colleague flagged it (8:40 AM post to 10:36 AM flag, per the timestamps in his screenshot); deletion followed per Mac, and the exact deletion time and so the full exposure duration are unknown. ExplainX's about-two-hours dwell figure is its own estimate, not a measurement. Not reproduced here

### Detection and recovery
- `detected_by`: third-party (a colleague who saw the post in the exec-team channel flagged it to Mac by Slack DM)
- `time_to_detect`: about 2 hours (8:40 AM post, 10:36 AM DM, per the screenshot)
- `time_to_recover`: unknown exact interval; per his account he deleted the message after the colleague's flag, and Business Insider says he had already deleted it by the time the bot offered deletion. The screenshot timestamps establish the time to detection, not the deletion time. He then disconnected all his personal connections
- `remediation`: Mac deleted the post and disconnected Google, his calendars, his banking, Stripe "and everything" from his agents
- `structural_fix`: per Mac, an xAI permission step before agents move information to other channels; xAI's changelog v0.70.2 (dated 2026-10-11) records that after a bank or brokerage connector returns data, the Bot asks before sharing it anywhere else. Cited as consistent with Mac's account, not as xAI acknowledging this incident
- `controls_that_worked`: the read-only scope on the bank accounts kept the event to a data disclosure rather than a funds action; a colleague's quick flag bounded the exposure window. Nothing prevented the disclosure

### Evidence
- `telemetry_grade`: operator-logs (the operator's own screenshot of a Slack DM quoting the posted message, with its channel and timestamps; editable, single custodian, redacted by him; graded the same way as the victim's screenshots in PIR-2026-0038. No authenticated Slack export or audit log)
- `sources`:
  - https://www.businessinsider.com/personal-ai-agent-grok-bot-posted-bank-details-company-slack-2026-10 (Business Insider, "as told to" Aditi Bharade, 2026-10-09; Mac's own edited first-person account and the primary for the mechanism, the read-only scope, the shared connections, the colleague's DM, the claimed xAI investigation and fix, and his remediation; identifies him as "the 40-year-old CEO of software company XMTP Labs"; operator's own account; read in full 2026-11-03)
  - https://x.com/ShaneMac/status/2107486740491669879 (Mac's original post, 2026-10-06T15:02:48Z: "an AI agent posted my personal bank balances into our company Slack. As me"; one attached screenshot; operator's own account; opened 2026-11-03, post text read from the page and X's embed data)
  - https://pbs.twimg.com/media/HT9I9a3W4AAUueB.jpg (the screenshot attached to Mac's post: a Slack DM from a colleague quoting a message posted under Mac's name in the private exec-team channel at 8:40 AM, with the DM at 10:36 AM; amounts redacted by Mac; viewed 2026-11-03; personal details not reproduced)
  - unverified: https://x.com/ShaneMac/status/2107576521250533437 (known dead: deleted by its author; Mac's later post in the thread, the one the Community Note links to as directing traffic to his tool; on 2026-11-03 X returned "Post Not Found" and its embed endpoint reports it was deleted by the author; recorded as a fact, no inference drawn)
  - https://futurism.com/future-society/ai-agent-posted-bank-balances-spending-slack (Futurism, Victor Tangermann, 2026-10-07; independent; "we were unable to independently verify his claims"; notes his commercial interest in an agent-permission tool and the "engagement farming" accusation, and quotes Mac replying the post was "not fake at all"; read 2026-11-03)
  - https://www.gadgetreview.com/grok-ai-agent-posted-a-founders-bank-balances-in-slack (Gadget Review, 2026-10-08; independent; "The incident has not been independently verified"; names the conflict of interest and says "Mac denied the post was fabricated"; read 2026-11-03)
  - https://www.explainx.ai/blog/grok-bot-bank-balance-slack-viral-post-disputed-agent-permissions-lessons-2026 (ExplainX, 2026-10-07, updated through 2026-10-31; independent; reported the Community Note while it was shown, gives the 8:40 a.m. post and about-two-hours dwell, and says "SpaceXAI has not confirmed the incident"; read 2026-11-03)
  - https://ton.twimg.com/birdwatch-public-data/2026/11/02/notes/notes-00000.zip (X Community Notes public data export, snapshot 2026-11-02; filtered on the post id: exactly one note, id 2107580686240715161, created 2026-10-06T21:16Z, classified MISINFORMED_OR_POTENTIALLY_MISLEADING, text "This post is fake. This is engagement farming. Later in the thread, he directs traffic to a tool he sells that solves the problem He's claiming."; its only link is Mac's later post above; downloaded and read 2026-11-03)
  - https://ton.twimg.com/birdwatch-public-data/2026/11/02/noteStatusHistory/noteStatusHistory-00000.zip (same export, status history for that note: first rated CURRENTLY_RATED_HELPFUL 2026-10-07T05:19Z; most recent status change 2026-10-08T04:41Z; current status NEEDS_MORE_RATINGS, locked 2026-10-20T21:34Z; downloaded and read 2026-11-03)
  - https://web.archive.org/web/20261014165050/https://x.ai/changelog/bot (Internet Archive copy of xAI's official Grok Bot changelog, 2026-10-14 16:50Z; entry v0.70.2 dated October 11, 2026, rolling up 0.69.0 to 0.70.1, contains "After a bank or brokerage connector returns data, the Bot asks before sharing it anywhere else."; vendor's own publication; opened 2026-11-03)
  - https://web.archive.org/web/20261013000904/https://x.ai/changelog/bot (Archive copy, 2026-10-13 00:09Z; newest entry 0.68.1, the line is absent; opened 2026-11-03)
  - https://web.archive.org/web/20261010160417/https://x.ai/changelog/bot (Archive copy, 2026-10-10 16:04Z; newest entry 0.68.1, the line is absent; opened 2026-11-03)
  - https://www.gradually.ai/en/changelogs/grok-bot/ (third-party changelog mirror carrying the same line; corroborates the archive copy only; opened 2026-11-03)
  - unverified: https://x.ai/changelog/bot (the live changelog; returned HTTP 403 to this session on 2026-11-03; the archive copies above stand in for it)
  - `independence`: weak. Every fact about the event (the post, its destination, the cause, the claimed xAI investigation and fix) comes from Mac, the operator, who has a commercial interest in agent-permission tooling. Futurism, Gadget Review and ExplainX are independent of him but relay his account and each say they could not verify it. The changelog is independent of Mac and is the vendor's own publication, but it describes a product change, not this incident, and its timing (dated Oct 11, published to the page between Oct 13 00:09Z and Oct 14 16:50Z) is looser than Mac's "shipped a solution last night" in an essay published Oct 9. The one Community Note is independent but cites no evidence beyond Mac's commercial interest
- `confidence`: low to medium (the event is described consistently across Mac's post, screenshot and essay, and a matching vendor-side change followed; weakest links: a single interested party, no authenticated Slack record, no xAI statement)

### Related records
- PIR-2026-0038 (Google Antigravity drive deletion): precedent for a corroborated record resting on one victim's account with screenshots, no vendor confirmation, graded operator-logs.
- PIR-2026-0051 (OpenClaw inbox deletion): precedent for a corroborated record resting on the principal's own X post with screenshots and no independent forensics.
- PIR-2026-0049 (founder's account of an agent deleting a production database): a founder self-report recorded with its evidential limits stated.

### Verification notes
- 2026-11-03: revived under a new id. This event was drafted as PIR-2026-0110 (PR #152, https://github.com/piperoll/registry/pull/152) and closed by the editor on 2026-10-26 before registration as "single-party, unverified, and disputed by a reported Community Note"; 0110 is permanently retired (reserved.json) and is not reused. The editor reopened the case on new evidence, all re-opened by this session on 2026-11-03: (1) The Community Note is now verified from X's own public data export, not just reported by ExplainX. It is the only note on the post, it argues only from Mac's commercial interest and links only to his own later post, it was rated Helpful at 2026-10-07T05:19Z, lost that status by 2026-10-08T04:41Z, and has been locked at Needs More Ratings since 2026-10-20, so X no longer shows it. This record does not treat the note's loss of status as proof the account is true, or the note as proof it is false; Mac's commercial interest, which is the note's whole argument, is disclosed at the top of this record. The later post the note links to has since been deleted by its author; no inference is drawn from that. (2) xAI's own changelog entry v0.70.2, dated 2026-10-11 and absent from the Oct 10 and Oct 13 archive copies, added an ask-before-sharing step for bank and brokerage data, the exact data class in this account. It is cited as consistent with Mac's statement that "the Grok team investigated" and "shipped a solution", not as an incident acknowledgement: it does not mention this event, its date is two days after Mac's essay said the fix shipped "last night", and no xAI statement has been found. (3) Consistency: PIR-2026-0038 and PIR-2026-0051 are corroborated on the same evidence class, one named first-person account with screenshots relayed by outlets that could not verify it, with no vendor confirmation. Holding this case to a higher bar because the reporter has a commercial interest is addressed by disclosure and by confidence (low to medium), not by exclusion. In X's own system the note is now locked at NEEDS_MORE_RATINGS and is not displayed as Helpful; neither that status nor its removal from display withdraws or refutes the allegation. With the only dispute resting on the reporter's commercial interest, which is disclosed, and with vendor-side evidence neither precedent had, the case meets the registry's existing bar as an editorial evidence-grade choice, not because X cleared the account.
- 2026-11-03: `telemetry_grade` set to operator-logs, not none as in the 0110 draft. Mac's screenshot shows a Slack DM quoting the posted message with its channel and timestamps; it is the operator's own, editable and redacted, which is exactly how PIR-2026-0038 grades the victim's Reddit screenshots. Grading it none here would be inconsistent with 0038.
- 2026-11-03: other changes from the 0110 draft. Mac's title is given as Business Insider states it ("CEO of software company XMTP Labs"); ExplainX's "CEO and co-founder" is not relied on. The roughly two hours until the colleague's flag are now supported by the timestamps in Mac's own screenshot; deletion followed per Mac, and the full exposure duration is unknown (ExplainX's estimate is attributed, not measured). The channel names are similar, not identical; "the same name" is Mac's characterisation. `failure_locus` moved from unknown to harness, still resting on Mac's account of the vendor's investigation, now with a matching vendor-side change. `detected_by` is third-party (a colleague, not the operator). The colleague's DM wording in the screenshot is shorter than Business Insider's rendering; the substance matches. No account numbers, balances or colleague identities from the screenshot are reproduced.