It’s not just about what AI agents can do — it’s about who they’re working for. This week’s Security Bite Podcast features Ron Zayas, CEO of Ironwall by Incogni, who joins host Arin Waichulis to pull back the curtain on the hidden privacy risks tied to AI agents and question whose interests those agents actually serve.
AI Agents and the Data Brokers in the Background
Zayas’s specialty is online privacy — specifically, helping public figures and private individuals get their personal data removed from data brokers and people-search platforms. He argues that while AI agents promise convenience, they also rely on vast amounts of personal data collected by entities most people rarely think about. Much of this data, including personal details and behavioral indicators, is available via brokers and search sites, forming the raw material AI agents often consume. What’s worse, this data can be used in ways the user neither expects nor authorizes.
Who Is Your Agent Working For?
During the podcast, the discussion turns to how AI agents might be acting in more than just your best interest. Zayas explores how agents built by large platforms or developed using external training data may optimize for goals that don’t always align with yours — whether those goals are engagement, data collection, or partnerships with third parties. Because AI agents often operate behind the scenes, it becomes hard for users to tell when the agent’s priorities deviate from their own.
Beyond detecting misalignment, there’s a deeper concern: accountability. Who is responsible if an AI agent uses personal data inappropriately or exposes sensitive information? Zayas considers the risks when agents pull from brokered data, especially for individuals who may be vulnerable or identifiable. He also notes that people often underestimate how much of their behavior, preferences, even location data agents can access or infer — either through persistent memory, continuous context, or background collection done by the service provider.
The Privacy Trade-Off: Convenience vs. Control
One recurring theme: users often trade privacy for convenience. For many, granting permissions or letting the agent integrate with services feels like a small cost to pay for time saved or tasks automated. But Zayas warns that this trade-off isn’t being framed transparently — many agreements are opaque, data sharing policies are complex, and the long-term implications of building a profile through brokers or persistent interaction are often underappreciated.
Policy and technical design both matter. From how agents request data permissions, to how much data brokers collect, to what recourse users have when something goes wrong — all of these elements are part of the equation. Zayas calls for more visibility, tighter regulation, and clearer defaults that favor user control over background incentives.
The episode ends by urging listeners to think critically about their AI agents: what data has been shared, who built the agent, what its real incentives are, and what mechanisms exist to hold creators accountable
Why This Matters: As AI agents become more embedded in daily life — managing calendars, communicating on our behalf, possibly even making decisions about finance or health — the question of for whom they’re really working becomes increasingly urgent. Lack of clarity here can lead to misuse of personal data, manipulation of behavior, or breach of trust.
What to Watch: Users should demand better transparency from companies; privacy regulations (especially around data brokers and AI alignment) are likely to tighten; product designers will need to bake in control and accountability; and AI agents may soon be considered in the same realm as legal or fiduciary agents when it comes to obligations and trust.
