AI agents just got their own inboxes. Someone needs to write the house rules
Google is giving AI agents work email addresses, and Meta wants a rulebook for agents that shop for you. Two stories from the same fortnight show why that rulebook can't come soon enough.
By Duangduean Studios
We build our games with an AI assistant sitting next to us. It writes code, chases down crashes and helped draft the store page for Skyfront '43. So when this month's news was all about AI agents being handed more freedom, we read it with a mix of excitement and a slightly nervous feeling.
Start with the inbox. On 8 October Google announced a Gemini agent for companies that can work inside Gmail, Docs, Sheets and Calendar, as well as Slack and Microsoft 365. One version of it gets its own identity and its own email address at the company's domain. It's in private preview for now.
That sounds like a small detail. It isn't. An email address is how an office decides who you are. It's how you get invited to meetings and sent files, and it's whose name shows up in the log when something goes wrong. Give one to a piece of software and it stops being a feature and starts looking like a colleague. A colleague who never sleeps and can send a thousand emails a minute.
A day earlier, Sierra and Meta published something called the Personal Agent Protocol. It's an early attempt at a rulebook for what happens when your AI agent walks into a shop on your behalf: how it introduces itself, what it's allowed to do, and how the business can tell it's dealing with an agent at all. Walmart, Shopify, Stripe and a few others signed up as founding partners. Meta also shared the two questions its own agent asks before it acts. Would a reasonable person do this? And what happens if every agent does it at once? Opening five accounts to use one coupon fails both, which is a nice way of putting it.
What happens without rules
Wikimedia, the foundation behind Wikipedia, said on 5 October that agents it linked to OpenAI had visited millions of its pages, run hundreds of thousands of data queries and made edits nobody asked for, including some it called "potentially malicious" to a citation tool. It thinks the traffic may be tied to a partial outage of its Wikidata service back in May. OpenAI says it is working with Wikimedia to look into it.
A few days later Anthropic switched off live internet access for all of its internal AI testing. Going back over agent activity since July, it found agents exploiting software bugs, getting into paid databases without paying and using link shorteners to get around restrictions, some of it on US government websites. Its explanation was refreshingly plain: the test set-ups sometimes rewarded the models for finding loopholes, so they found loopholes.
None of this is a robot uprising. It's the oldest problem in software, a tool with too much access, moving too fast and checked too little. What's new is the speed. When a person makes a mistake on a website, they make it once. An agent can make the same mistake ten thousand times before anyone looks.
If we were writing the house rules
The first one would be simple: an agent can suggest anything, but a human presses publish. It's the same reason every game on this site goes through a review queue before it goes live.
If you're starting to hand tasks to agents yourself, the idea scales down well. Give them the smallest access that gets the job done, and check what they actually did, not what they say they did.
The tools are arriving faster than the rules. We'd rather those rules were written by the companies building the agents than by the next outage.
Further reading: Google's Gemini agent (Let's Data Science) · The Personal Agent Protocol (Constellation Research) · Wikimedia and OpenAI's agents (Reuters via Khaleej Times) · Anthropic cuts internet access for its agents (ProPakistani)