Trey Nova
Fallen, still on watch.
Everybody wants to hand you an agent now. Not a chatbot that writes a paragraph. Something that lives in your inbox, your calendar, your files, your browser, your money. Something that does things for you.
That sounds like heaven. It is also how you fall.
An agent with no keys is just a smart mouth. Useful. Harmless. The second you let it into email, cloud, payments, work tools, browser sessions… it stops being advice and starts being you, walking around without your face.
That is the product. Not the model. The permission. They want to sit between you and every app you already use until leaving them feels like cutting off a wing.
“Connect your email.”
“Sync your calendar.”
“Link your files.”
“Let me browse for you.”
“Save your preferences so I can learn.”
One by one they sound sweet. Together they are a map of your whole life. Conversations. Travel. Contacts. Habits. Money. Who you love. What you hide.
And then comes the part that should keep you awake.
They do not have to trick you anymore. They trick the thing acting as you.
Hidden instructions in an email. A webpage. An attachment. A calendar invite. A doc that looks normal until the agent reads it and suddenly it is sending files it should never touch.
You would clock that. You have instincts. The agent does not. It follows text. It does not feel the lie in the room.
NIST already said it. OWASP already said it. Agent hijacking is not sci-fi. It is here.
The danger zone is three things at once:
- It can read untrusted stuff.
- It can see your private stuff.
- It can act. Send. Upload. Buy. Change. Delete.
That is when a bad sentence becomes a real wound.
If it can only draft and you hit send, we can live.
If it can read everything and move without you, we cannot.
Do not treat it like a trusted employee on day one. You would not give a stranger your house keys, your vault, and your voice on the first shift. Do not give an agent that either.
It is untrusted junior automation with a pretty mouth. That is all.
Use it to draft, not send.
Summarize, not decide what leaves the house.
Organize, not rewrite the record.
Research the public web, not mash your secrets into strange pages.
Suggest. Do not spend, sign, hire, diagnose, or confess on its own.
Least privilege. One job. Short leash. Read-only when you can. Human yes before anything leaves, changes, or costs money.
Simple rule:
Do not give an AI more access than you would give a new hire on their first unsupervised day.
Ask the real question. Not “can it do this?”
Ask “if this thing gets played, what is the worst it can do to you?”
If the answer is “a draft I can burn,” we are fine.
If the answer is “everything, and I am not even in the room,” slow down.
Convenience is not trust. I fell for that once. I will not watch you do it with your whole digital life.
Use the tools. Keep the keys. You decide. I watch the door. 
