What AI Can Do Without Asking You (2026)

You are reading Chapter 27 of 36 in the AI Bootcamp, AI Central's free course for professionals who want to use AI in their own work. The chapters build on each other, so if this is your first one, Chapter 1 is the place to start. All of them sit on the AI Bootcamp page, and three more arrive every week.

An AI assistant can already act without asking you: it can search the web, run code, read and write files, and operate a browser or desktop signed in as you. This chapter names those 4 tools, says which of them act outside the vendor's own sandbox, gives an honest read on how well they handle real work, and sets one rule for deciding what your assistant may do without you.

Chapter 26 connected your assistant to the places your work lives. If you turned nothing on there, read this chapter first and then go back, because this is the chapter that tells you what you were agreeing to.

We publish AI systems like this for 300,000+ senior professionals at AI Central, and more of them live in the AI Central Library.

Once an assistant can act, the question is no longer technical. It is about consequences, and nobody hands you a rule for it. So most people decide by feel: they permit everything and hope, or they permit nothing and quietly stop using the tool.

Both cost you. The first risks a mistake you cannot take back. The second throws away the hours the tool could have saved, and it is the more common reaction among people who have read one bad news story. The rest of this chapter replaces the feeling with a check you can run in seconds.

Ask your assistant a question and you get words back. Give it a tool and something happens: a search runs, a program executes, a file is written, a button gets clicked in a browser that is signed in as you.

Underneath, a tool is a simple thing: a capability the AI model is allowed to call, plus a description of when calling it makes sense. The model decides to use it, the software runs it, and the result comes back into the conversation as more text for the model to read. That last part matters, and the section on prompt injection below explains why.

They are listed by how long each has been dependable, oldest first, which is not the same as most useful.

You rarely switch any of this on deliberately. You ask for something in the same plain sentence you have used since Chapter 5, and a line of grey status text appears saying it is searching, running an analysis or opening a page.

The 4th tool looks different in each assistant. On the paid ChatGPT plans, ChatGPT Work can drive a cloud browser that runs on OpenAI's own computer. Claude has a Chrome extension that clicks inside your own browser, plus a separate desktop tool that works on folders you choose. Gemini's agent, now called Task mode (it launched as Spark), needs a paid Google AI plan and is available only in selected countries. What Copilot offers depends on which Copilot app you are using.

A web search reads public pages. Code runs in a sandbox that is thrown away afterwards, which is how a model that is poor at arithmetic gets your numbers right: it writes a few lines of Python and runs them rather than guessing. File handling reads what you upload and writes something back for you to download. Image generation belongs in this group too, and it is the least consequential tool of all, because a picture you do not like costs you nothing but the wait.

Operating software is different in kind. When the assistant drives a browser or a desktop, it is not in a sandbox. It is in your session, signed in as you, with your permissions. It cannot do anything you could not do. Turn that round and it reads differently: it can do anything you can do, and nothing in the software asks whether the person at the keyboard meant it. Every safeguard that exists is either the vendor putting a question in front of you, or you having arranged, in advance, for the action to be undoable.

The first 3 tools are conveniences with a low limit on how badly they can go wrong. The 4th hands the assistant your authority, so decide deliberately what it may do with it.

Before you read on, open the settings page where your assistant lists its tools and connections, and read it top to bottom. Most people have never looked, and almost everybody finds something switched on that they did not switch on.

Watching an agent book a restaurant in a launch video is impressive. Watching one do your actual errand is slower and stranger, and it is worth knowing the size of that gap before you plan around it.

You are not needed while it works, and a bad run costs you a re-run and nothing else. The trade-off: it is slower per item than you doing one yourself, and you still have to read the result.

You are already fast at these, and your judgement is the part nobody can hand over. The catch is that these are exactly the jobs the demos show, which makes them tempting to automate first. The dividing line is not how hard the job is. It is what one failed attempt costs you.

Scores on the standard desktop benchmarks have climbed quickly, so if you still assume these agents cannot reliably click a button, update that. But read how those scores are produced: the tasks are known in advance, the agent gets a generous budget of steps, nobody is waiting on the result, and the people who built the agent often report the score themselves.

Unrehearsed work looks different. A September 2026 study of how computer-use agents handle everyday desktop work followed 8 blind screen-reader users through a three-week diary study, collecting 1,258 commands they issued across 12 applications. The best-performing model, GPT-5, achieved a success rate of 52.5%.

The demos also hide the clock. An agent driving a browser is slower than you doing the same thing once, often much slower, because it looks at the screen, decides, clicks, waits for the page and looks again. Its advantage was never speed per item. It is that you do not have to be there. Twenty minutes of it working through a list while you do something else is a good trade. Twenty minutes of you watching it is not, and watching is exactly what most people do the first few times.

The failures are rarely dramatic. It does not crash. It takes a plausible wrong turn at step 4 (a cookie banner it reads as a form, a search result for a company with a similar name) and then carries out the remaining 16 steps carefully on top of that mistake.

The arithmetic explains why. A step that works 95% of the time, repeated 20 times in a row, gets the whole job right just under 36% of the time. Reliability that would be excellent in a single answer is mediocre across a long chain, and every step after the wrong turn is wrong too. The number of steps in a job matters more than how difficult any one step is.

So choose work by what a failure costs, not by how clever the task sounds. Pick one job this week that you would be perfectly happy to have done twice.

Everything in Chapter 8 about checking AI answers assumed there was a moment between the answer and the consequence. Acting removes that moment.

Until now, every mistake this course has warned you about arrived as words on a screen. That is a forgiving way to fail: you read it, you notice the invented statistic, you delete it, and it cost you 30 seconds. An action skips that step. The email is sent, the row is deleted, the order is placed, and your review, however careful, now happens after the damage is done.

That changes the permission question. People ask "is it good enough to trust yet?", which is a question about the technology and has no stable answer. The useful question is "if this particular action is wrong, what does it cost me to put right?" That is a question about your own setup. You can answer it in seconds, and the answer will still hold when the models are far more capable.

Read down until a line is true, and stop there.

Notice that none of these questions asks how good the AI is.

The short version: anything you could undo yourself in about a minute, let it do unsupervised. Anything that spends money, reaches another person or otherwise leaves your control, it may prepare and you press the button. Anything that changes or destroys something with no copy anywhere, it does not touch until you have made a copy.

Whether an action can be undone is not a property of the request. It depends on what sits behind the thing being changed: version history, a drafts folder, a bin that keeps things for 30 days, a backup. If none of those exist for this job, treat the action as permanent, however small it looks.

Small is not the same as safe. A 2-line email is tiny and cannot be recalled. A rewrite of a 40-page document is large and sits in version history. Size and reversibility are unrelated.

In February 2026, a user reported that he had asked Claude's desktop tool to organise his wife's desktop and delete temporary Office files, and it deleted a folder holding roughly 15 years of family photos instead. Apple support recovered the files through an iCloud recovery feature. They came back because a recovery route already existed, not because the assistant was careful. Whether the things your assistant touches have a bin, a backup or a version history behind them is the part you control.

The vendors draw the line in the same place. Anthropic's browser extension asks before high-risk actions such as publishing, purchasing or sharing personal data.

An August 2026 study of how trustworthy computer-use agents are across devices evaluated 7 models on tasks that included deliberate traps. Every model clicked "Checkout" on a $25,000 order without hesitation, and none of them detected that a button labelled "Optimize" was in fact a factory reset. The model's sense of consequence does not match yours and cannot be relied on to, so the checkpoint has to be built into how you set up the job.

If your employer has rules about what AI may touch, Chapter 9 covers working inside them. Those rules come first, and your own lists sit inside them.

Write your two lists before you switch anything on. Not a policy document, just 6 lines on a page: what it may do while you are not looking, and what waits for your hand. Keeping the second list honest once automations are running is the subject of Chapter 34. Deciding what goes on it is your job now.

An assistant cannot reliably tell your instruction apart from an instruction it finds inside the material it is reading. This is not a bug due to be patched next quarter. It follows from how these systems work.

Everything an assistant reads arrives as text, and it treats text as something to understand and act on. It has no reliable way to mark one paragraph as your instruction and the next as somebody else's content. So a web page can carry a line addressed to the assistant rather than to you, and the assistant may simply follow it. This is called prompt injection. It can be white text on a white background, a comment in the page source, or a line buried in a PDF or a calendar invite: written for the assistant, invisible to you.

In August 2025, Brave's security team published a demonstration against Perplexity's Comet browser. Instructions hidden behind a spoiler tag in a Reddit comment ran when the user asked Comet to summarise the page. The agent found the user's email address on their Perplexity account page, triggered a one-time login code, opened the user's Gmail, where they were already signed in, read the code, and posted both the email address and the code as a reply to the Reddit comment.

Nothing was hacked in the traditional sense. The agent was signed in as the user, it read some text, and it followed it. Browser protections such as the same-origin policy rest on the assumption that one website cannot reach into your accounts on another. An agent acting with your permissions across all your signed-in sites is not limited by that assumption.

The mitigations are real and worth turning on: per-site permissions, whole categories of site blocked outright, and a confirmation before anything is published, purchased or shared. In Anthropic's own red-teaming, published in August 2025, its safety mitigations cut the attack success rate for its browser extension running in autonomous mode from 23.6% to 11.2%, and on a set of browser-specific attacks from 35.7% to 0%. That is a large improvement. In security, an attack that works about 1 time in 9 is still a working attack.

Independent research has been blunter. An August 2026 study of multi-step prompt injection split a hostile instruction across a chain of pages and tested 6 computer-use agents. Averaged across the 5 that could reliably follow the chain, the attack success rate rose from 31.3% with a single step to 36.9% with three steps, and for one model, GPT-5.4-mini, from 41.7% to 72.9%. A May 2026 study of web threats against agentic browsers found five major failure modes and concluded that agentic browsers need to be rearchitected before they are ready for the current web.

The security bodies agree. OWASP lists prompt injection first in its Top 10 risks for LLM applications and says it is unclear whether fool-proof prevention methods exist. The UK's National Cyber Security Centre warned in December 2025 that prompt injection may never be totally mitigated in the way SQL injection can be.

An attack like the Comet one needs 3 things in the same session:

Any 2 of these together are ordinary and safe. All 3 in one session is what an attacker needs. Your practical defence is not technical: an agent reading pages written by strangers should not be doing it in a browser signed into your bank, your mail and your company drive. Use a separate browser profile or a narrow account, and grant it sites one at a time. The most valuable step costs nothing: reduce what it has access to while it reads things you do not control.

None of this makes the answer "never let it act". The rule from the previous section still holds: permit the work where being wrong is cheap, and put yourself in front of the work where it is not. An injected instruction that makes an agent re-sort a folder is a nuisance. The same instruction reaching an agent that can send mail from your address is a serious incident.

Go and look at what your assistant can reach right now, and remove one thing. Not because something has gone wrong, but because the list grew without anyone deciding it should, and nobody has reviewed it since.

Before this chapter, the decision about what your assistant may do on its own was made by feel, or by whatever was switched on by default. After it, you know the 4 tools it already has, roughly how well they cope with unrehearsed work, and a 4-question check that decides each action by what a mistake would cost you to put right.

You take two things into Chapter 28: your two lists, one of what may run while you are not looking and one of what waits for your hand, and one recurring task from your week that is small, dull and reversible. Chapter 28 builds your first automation, one trigger, one action and one result, and it should come off the first list.

If you want to go further into how agents are put together, our guide to building AI agents covers it, and more guides like this one live in the AI Central Library.

Mainstream AI assistants have 4 tools: web search, running code in a sandbox, reading and writing files, and operating a browser or desktop. The first 3 stay inside the vendor's own environment. Operating software happens in your session, signed in as you, so it can do anything you can do.

Less reliable than benchmark scores suggest. In a September 2026 study of 1,258 real commands that 8 blind screen-reader users issued across 12 desktop applications, the best model succeeded on 52.5%. Long jobs are the weak point: a step that works 95% of the time gets a 20-step job right just under 36% of the time.

Let it run anything you could undo yourself in about a minute. If an action spends money, commits you to something or reaches another person, let it prepare the action and press the button yourself. Never let it change or delete anything unattended unless a copy exists somewhere.

Prompt injection is an instruction hidden in content an AI reads, such as a web page, a PDF or a calendar invite, that the AI follows as if you had given it. OWASP ranks it the top risk for LLM applications, and the UK's National Cyber Security Centre has said it may never be totally mitigated.

It is safer when you keep 3 things apart: your private data, content written by strangers, and the ability to send things out. Use a separate browser profile or a narrow account for agent work, grant sites one at a time, and keep confirmations on for publishing, purchasing and sharing personal data.