Can you trust an AI assistant to act for you?

What did Satya Nadella say about AI being compromised?

Satya Nadella said we should assume every advanced AI model is compromised and contain it from the start, with a person always able to pause or shut it down mid-task. Microsoft's CEO made the case in a long post on X on October 10, 2026. He described powerful models as insider risks: systems that companies give access to their most sensitive data and let take important actions on their behalf. His sharpest line was that we can't treat AI as a set of nested black boxes and simply accept or reject its recommendations, answers and actions. He called the fix an emergency brake that an authorized person can pull at any moment.

He also listed what containment should look like in practice. Safeguards should sit outside the model instead of trusting it to police itself. Every meaningful action should leave a log that people can read and nobody can tamper with. He added continuous testing, independent audits, public disclosure of incidents and not depending on a single model. He was blunt that having AI grade other AI, or reading a model's step-by-step reasoning, isn't enough. His summary was that we need to separate the supply of intelligence from the authority over it. In short, the model can be clever, but the power to act should stay with a human.

Nadella wrote this for large companies, but you're running a small version of the same setup. When you text an assistant "Remind me to call the accountant every Monday at 9", send it a contract or ask it to message a supplier, you're giving it some authority. You don't have a security team, but his ideas still apply to one person. Limit what it sees, keep a record of what it does, stay in the approval loop and keep a stop button handy. Here's an opinion: the 'assume it's compromised' mindset matters more for a solo owner than for a bank. A bank can absorb one bad message. Your business might rest on five client relationships.

What should an AI assistant be allowed to read?

An AI assistant should read only what you hand it for the task in front of it, not your entire digital life. An assistant you message has a built-in limit: it sees the PDF, voice note or invoice you send. It doesn't comb through your inbox, cloud drive and every chat you've ever had. That's the first thing to check with any tool. Does it ask for access to everything up front, or do you share things one at a time? Broad access is convenient until something goes wrong. A document or email can contain hidden instructions written to fool an AI, and the more the assistant reads, the more of those it can run into.

With documents, keep Nadella's warning about accepting answers blindly in mind. Send a lease and ask "What are the deadlines and penalties in this?" and you'll usually get a clear, useful summary in seconds. That saves you real time. Still, treat the summary as a map, not the territory. If you're about to sign, follow up with "Which clause lets them raise the rent?", then open the page and read that clause yourself. That isn't paranoia, it's how a careful person uses any second opinion. A good assistant points you to the part that matters. It doesn't stand in for reading that part before money or a legal obligation is on the line.

Connections deserve the same scrutiny. Agent Sonic can create and update events in Google Calendar and work with Sheets and Docs. Its Notion connection is read-only, which is worth looking for: it can look things up in your knowledge base but can't rewrite a word of it. For every tool you connect, ask what the assistant can read and what it can change. Memory matters too. Sonic keeps your notes and preferences so you don't have to explain them again, and you can check what it has stored by asking "What do you remember about my accountant?" Want a broader view of AI assistant privacy in 2026? Our buyer's checklist for WhatsApp assistants covers it in more detail.

Can you see every action your AI assistant takes?

You should be able to see every action your AI assistant takes. If you can't, don't let it act for you yet. Nadella asked enterprises for readable logs of every meaningful AI action. For a busy owner, that simply means a record you can read without calling IT. Many assistants work quietly in the background or hide their history in a dashboard you'll never open. The trouble is that mistakes then show up at the worst moment: a client asks why you cancelled, or a supplier mentions a message you never saw. If you can't scroll back and see what happened, when and in what words, you're trusting the assistant blind.

When your assistant lives in WhatsApp, the chat itself becomes the record. Every reminder you set, every confirmation, every summary and every outreach report sits in one thread you already check dozens of times a day. Text "Remind me to renew the van insurance on the 3rd of every month" and the reply confirms exactly what was scheduled. Weeks later you can scroll up and find it. Let's be honest, a chat thread isn't an enterprise audit system with tamper-proof logs. Still, a plain chat history you actually read does more for trust than a polished activity page you never open, because the record only helps if you look at it.

Before you hand over anything important, test the assistant on something small. Set a reminder, then ask "What reminders do I have this week?" and compare the answer with what you think you set. Next, ask it to cancel one and check that it confirms the change. Finally, ask what it did yesterday and see whether the answer matches the thread. If any of that comes back vague, you've learned something cheaply. For a fuller test, use our three checks for whether an AI stays inside what you asked. And if you'd like a record that stays in your chats, here's an assistant you text like any contact, with nothing to install.

Is it safe to let an AI agent send messages on your behalf?

Letting an AI agent send messages on your behalf is safe only if four things are true. It shows you the exact message before sending. It doesn't pretend to be you. It reports back the person's actual reply. And it stops the moment you, or the person it's messaging, say so. Outgoing messages are the riskiest thing you can delegate, because they reach people who never agreed to deal with your AI. Look at the case of an AI model that sent police a false tip without anyone approving it. A message that goes out unchecked is exactly the black box Nadella warned about.

Here's what that looks like with Sonic's outreach tasks, which are in Beta and may be paused from time to time. You write something like "Message the plumber and ask if Thursday works, then tell me what they say." Before anything is sent, Sonic shows you the exact first message. You reply "yes" to send it, "no" to drop it, or describe a change in plain words, like "friendlier" or "shorter, no emoji". Your notes apply to the whole conversation, not just the opening line, and the approved message goes out exactly as shown. Sonic writes from its own WhatsApp number and introduces itself as your assistant. It never poses as you.

Sonic asks the question and follows up at most once if the answer is vague. The conversation ends when it has the answer, the person declines or the person asks it to stop. When each thread ends, you get the result (an answer, a decline or no reply) plus a short summary. You can also ask in between: "Did the plumber answer yet?" /task status shows the latest messages, and /task cancel stops the task. That's your emergency brake, sitting in the chat. The limits below are deliberate, and they're a big part of why the feature is safe to use. The step-by-step outreach tutorial walks through a full example.

Which tasks should you keep on a short leash?

Anything that leaves your phone, moves money or can't be undone needs your approval every time. Private, reversible tasks can run on their own. That's the most practical way to use Nadella's advice without turning every reminder into a ritual. Reminders, to-dos and notes are low risk. If something goes wrong, a reminder fires at the wrong time and you fix it with one message. So let those run freely: "Remind me to send the VAT return every quarter" or "Note that the Cohen order needs gift wrap." Save your caution for actions where a mistake is public, expensive or permanent, because those are the ones people regret.

The middle tier is where you trust the assistant but still check its work. Web searches for opening hours, a supplier's phone number or a quick price comparison save you time, and a wrong answer usually costs you only a moment. Contract summaries and spreadsheet analysis come next: let the assistant do the first pass, then confirm anything you'll act on. Invoices are a good example of a sensible split. Forward a PDF and Sonic can flag a likely duplicate or a sum that doesn't add up, but you're still the one who presses pay. Calendar events belong here too. Read the confirmation before you send the invite to a client.

The top tier is messages to clients, anything legal and anything involving money. Keep yourself in the approval loop here, always. Outreach with a preview and a stop command fits, because you sign off on every first message. A few things should never be delegated, though: refunds, firm deadlines that carry legal weight, and hard conversations with someone you value. Those need your own voice. Even with friendlier tasks, like automatic group reminders for rent or practice schedules, check the first few to make sure they read right. For a short checklist to keep nearby, see four questions to ask before an AI messages anyone for you. Ready to hand off the safe stuff? Get access to Sonic and you'll receive its number and onboarding.

Frequently asked questions