THE ECONOMIST: AI-powered personal assistants will reshape the digital economy, but are they safe?

Silicon Valley has long dreamed of building a digital assistant capable enough to rid users of many of the tedious personal tasks that gobble up time and attention.

Fictional representations, such as JARVIS (Just a Rather Very Intelligent System) in the Iron Man films, set expectations high.

In 2010 Apple, the iPhone-maker, acquired Siri, one such aide. It turned out to be disappointingly moronic.

Now, amid the current wave of investment in artificial intelligence, the era of personal AI agents may at last have arrived. In the past two months Meta, a social-media giant, and Instinct, a start-up, have released two such bots to great fanfare.

Instinct’s assistants, which users contact through Apple’s iMessage service or Meta’s WhatsApp, are already checking users into flights, hunting down sold-out concert tickets and arranging dinners with friends, among much else. (Your correspondent uses Instinct to update his calendar with earnings calls as they are announced.)

Muse, Meta’s offering, has similar capabilities, but can be accessed through WhatsApp, a web browser, a mobile app — or, from later this year, the company’s smart glasses.

The big difference from earlier generations of digital assistants, explains M.G. Siegler, an investor and blogger, is that these new bots can work proactively, rather than reacting only to what users explicitly ask for.

Instinct “really just works in the way I believe we all want AI to act”, says Noah Shinn, the start-up’s 24-year-old founder.

Uptake is soaring, so much so that Mr Shinn reckons “in a few years every user in the world that has an internet connection is going to have access to a product like Instinct”.

That may well prove true. Before then, however, the companies developing personal agents will have to overcome a variety of hurdles to more widespread adoption, including concerns over security and reliability and the reluctance of some big businesses to allow the tools to interact with their systems.

Instinct and Meta have pursued very different approaches to attracting users, but both have been wildly successful so far.

In Instinct’s case, users must be invited by a friend or hand-picked by the company from a waitlist. Even so, the number of users has been growing by about 10 per cent daily.

Simplicity keeps them coming back: around half of people who have signed up to Instinct continue using it at least once a week after the first month, according to the company. Giving the agent an instruction is as simple as writing a short text; it will then reply with updates on its progress.

If Instinct is the private party taking place behind a velvet rope, Muse is the open-invite rave anyone can partake in (so long as they live in America or Canada).

By all accounts, the party is heaving — and people are lingering, too. More than 10 million people have downloaded the Muse app since its debut a little over a month ago, according to Sensor Tower, a data provider.

ChatGPT, the hit chatbot from OpenAI that precipitated the AI boom, had only 3.7 million downloads of its mobile app in the same timeframe after its release, a few months after the web version was first unveiled.

Muse is retaining users at about the same rates as ChatGPT, too.

Persuading partygoers to expose their data, however, is not always easy. Personal agents need private information to reach their potential: without access to a calendar or a credit card they are little more than a glorified chatbot.

Some in techland fear that the bots will leave users vulnerable to new threats such as prompt injections, where an attacker sneaks text to an AI through a website’s computer code and deceives it into misbehaving.

The companies seem to be taking these concerns seriously. Meta assigns a private computer for each Muse user to hold their data and operate their assistant.

It has also taught Muse various ways to resist prompt injections, though some security researchers reckon it remains susceptible to malicious instructions.

Instinct has revealed less to the public about its cyber-security measures, but Mr Shinn says the service is designed around the principle that users “should always be in control of their data”.

On top of that are concerns that personal agents could wreak havoc out of sheer stupidity.

Meta has admitted that Muse will make mistakes, and has put a number of guardrails in place to minimise the potential damage when it does.

Even so, some users may baulk at handing over their credit-card details until they are confident their agent will handle them wisely.

Prolonged exposure appears to build that trust. About 40 per cent of Instinct users connect a credit card within three weeks, according to the company.

Instinct and Meta also work with Stripe, a payments company, to offer a digital wallet that allows users to make purchases without handing over their banking details directly, which may reassure some.

The other big challenge for bot-builders is to persuade other businesses to welcome their agents. Some appear happy to do so.

Shopify, a software platform for e-commerce businesses, is working to make it easier for Instinct and Muse to buy from its network of vendors.

Meta is also working with Walmart, America’s biggest retailer; Instacart, a grocery-delivery service; and Expedia, a travel-booking site.

But other companies remain unconvinced. Amazon, for instance, is currently off limits to both Instinct and Muse.

The e-emporium generates a good chunk of its profit from showing users ads, and currently has little need for the extra traffic that might come its way via personal agents.

Amazon has also complained that Meta failed to give it a heads up about Muse’s release.

Some Silicon Valley bosses say that they are waiting to see how the technology develops before opening their systems to personal agents.

In the meantime, the bot-builders are busily trying to win them over.

Mr Shinn gives the example of restaurant-booking companies, some of which Instinct has won over by agreeing to prevent its agents from booking vast numbers of reservations, only to cancel all but one.

Even Andy Jassy, Amazon’s boss, appears to be keeping an open mind about the future, saying on a recent earnings call he is “very hopeful” his company will eventually reach a fair deal that lifts the ban on agents.

Such agreements will be necessary if personal agents are to become a viable business.

Mr Zuckerberg has said that he envisages Muse will earn its keep from a combination of subscriptions and a cut of the transactions it facilitates.

Mr Shinn reckons that most online spending will eventually flow through personal agents.

Which bot-builder wins the biggest share of the business is still up for grabs.

Instinct has raised $1.4 billion to date, according to PitchBook, a data provider.

That is a tidy sum for a one-year-old start-up, but a pittance compared to what Meta has at its disposal.

OpenAI and Google, maker of the Gemini models, both offer their own personal agents. Although these are currently pitched more for business than consumer use, they could expand their focus.

Airbnb, a short-term rental platform that wants to make itself into a one-stop-shop for all manner of experiences, has also said that it plans to launch a personal agent next year.

Then there is Apple, which in June gave Siri a big makeover. Although the new assistant is widely viewed as an improvement on its brainless predecessor, it lacks most of the autonomous capabilities of the personal agents that are now winning over consumers.

Perhaps the iPhone-maker should consider messaging Instinct.