Personal Agent

A general chatbot knows nothing about your week. A personal agent does, because you’ve connected it to your inbox, calendar, notes and other tools. Ask it to “find time with Priya next week and send her the draft” and it can check both calendars, propose a slot, attach the file and send the invitation. Each of those steps is a tool call made with your accounts, so the agent acts as you.

That access is the point and the risk. A personal agent is useful because it can read private data and send messages in your name, and those are the same powers an attacker would want. Whoever builds or runs one has to decide what it can do without asking, what needs approval, and how to stop text inside an email from steering it, a risk called prompt injection. The DeepMind paper on advanced AI assistants treats trust, privacy and alignment with the user’s interests as the central questions for this kind of system.

On Chain of Thought, Postman’s Sterling Chin walks through Marvin, the personal assistant he built. In episode 50 at 3:26, he says he imagined using Claude Code with MCP “as kind of a personal assistant”, and started by writing his own integrations. In episode 50 at 57:23, he says his long-term goal is a model on his phone that is his own personal agent. Galileo sponsored episode 50. In episode 59 at 36:16, Superhuman’s Loïc Houssier calls email the number one use case for personal agentic assistants, and warns that fully delegating your inbox to an agent is also where people are most fearful, because a wrong reply or a silently archived message can make you look foolish. Galileo sponsored episode 59; see the opening thank-you.

Our takeaway from these conversations: start a personal agent on tasks where a mistake is easy to spot and undo, and widen its permissions only as it earns trust.