Is your personal information safe when you use a virtual assistant?

AI-powered virtual assistants can become an entry point that puts a business’s security at risk if their access and functions are poorly protected. A weakness could expose information about you or your family. [S6]

If your bank or your child’s school uses one, what can it access and what happens to what you type? Security depends on the assistant’s access and the institution’s controls. Its appearance or answers cannot, on their own, establish that your information is protected.

Where does the risk come from?

A virtual assistant is a programme you can talk to when seeking information or using a service. Some provide prepared answers and others use AI. Among AI services, some only show public information while others connect to files or user accounts.

That difference matters. An assistant giving a school’s opening hours needs little information. One retrieving a pupil’s record must check who is asking and show only what that person is authorised to see. These are illustrative uses, rather than incidents attributed to an institution.

Someone could try to manipulate the conversation so the assistant acts beyond its purpose. If the system allows access to another person’s data or changes without checking permission, the consequences can extend beyond an incorrect answer. OWASP, an organisation focused on application security, covers these risks in its guidance. [S6]

In an educational demonstration on 20 October, Chema Alonso showed a comics assistant responding beyond its intended role. The case illustrates why service boundaries need testing. An assistant answering a query correctly or refusing an off-purpose request is not enough to assess its security. [S1]

What you can do as a user

Use a channel you recognise

Open the official app or the organisation’s address that you already use. Avoid an unexpected link asking you to resolve something urgently. If you are unsure, find the contact details independently before continuing the conversation. [S8]

Share only what is needed

Asking about opening hours or general requirements does not require complete documents or private family information. Before sending personal data, ask why it is needed and which channel to use. Read the notice explaining how the conversation is used, and contact a person if it is unclear. [S9]

Protect passwords and codes

Do not paste passwords or verification codes into the conversation. If you need to identify yourself, use the official sign-in screen you recognise. Codes authorise access or transactions; giving them to someone else can allow that person to act through your account. [S7]

Ask a person for help when needed

If the task involves a payment, your child’s information or an important change, confirm the process with the organisation whenever you are unsure. You can ask: “What information does this chat retain, who can see it and how can I speak to a person?” Information about data handling and responsibility should be easy to find. [S9]

What to do if something seems wrong

If information appears that does not belong to you, stop and notify the organisation through another channel. Do not keep testing what you can see or share that information. Note the time and the problem without copying someone else’s data.

If you shared a password in a suspicious interaction, change it through the official service and wherever you reused it. If you supplied banking information or a code authorising a transaction, contact your bank immediately. These steps respond to possible exposure; they do not, by themselves, establish that theft occurred. [S8]

What a business or institution should check

The organisation needs to know what information its assistant handles and who is responsible for it. Prevention requires controls that the team can explain and test.

Limit what it can see and do

An assistant answering frequently asked questions does not need access to complete personal records. If it retrieves account information, the system must check the user’s identity and permissions. On 19 October, Microsoft stressed that these restrictions must sit outside the model: giving the assistant a written instruction does not replace a system control. [S2]

Review how conversations are handled

Ask the supplier what information it receives, who can see it, how long it is retained and what it is used for. Define which data the chat should not request, and provide an appropriate channel for tasks that require private information. [S9]

Assess, fix and check again

Arrange authorised tests with fictional data to check that one person cannot see another’s information or make changes without permission. Request a clear report, fix weaknesses and repeat the check. OWASP recommends combining these assessments with limited access and oversight. [S3]

Prepare to respond to problems

Assign someone to review alerts and to stop the assistant or disconnect it from other services when needed. The team should know how to investigate what happened and help those affected. [S3]

Learn ethical hacking to help prevent harm

Ethical hacking means assessing security with permission to find and fix weaknesses. You can start by understanding accounts, permissions and web applications. PortSwigger provides learning materials and labs using systems designed for practice. [S4]

The goal of that training is a verifiable improvement: explaining what failed, who could be affected and how to check the fix. As a user, you can take care with what you share and ask questions; protecting the service and its connections is the responsibility of the organisation providing it.