Ask three different software companies what an “AI agent” is and you will get three different answers, and at least one of them will involve the word “autonomous” said with more confidence than the product deserves. We’ve spent a good part of this year testing what these things can do when you actually let them loose on real tasks, and the honest answer is: less than the marketing suggests, but more than the sceptics give them credit for. The question worth asking isn’t “are AI agents good”. It’s “which specific jobs, in an ordinary Australian’s digital life, are safe to hand to one right now”.
That’s the AI agents you can trust question, and it has a narrower answer than most coverage lets on.
What an agent actually is, minus the spin
A chatbot answers a question. An agent is meant to take an action: book the flight, cancel the subscription, reschedule the appointment, buy the thing. The distinction companies like to draw is that a chatbot is a conversation and an agent is a worker. In practice, what’s shipped so far sits somewhere in between. Most consumer “agents” today are chatbots with extra plumbing: they can open a browser tab, click buttons, fill in forms, and read what comes back. Some can act inside a single app, such as a calendar or an email inbox, with a defined and fairly narrow set of permissions.
None of the mainstream consumer tools available to Australians right now can be handed your bank login and told to “sort out my finances” unsupervised, and if a product claims otherwise, that’s worth treating as a red flag rather than a feature. The useful agents are the boring ones: they do one narrow thing repeatedly, inside guardrails somebody actually designed, and they tell you what they did afterwards. We’d argue that’s a feature, not a limitation — it’s the whole reason they’re usable at all.
An old echo
Readers who remember early-2000s office software will recognise the shape of this. Excel macros and Word mail-merge scripts promised to automate the boring parts of a job, and they did, right up until someone’s macro quietly deleted a column of data nobody noticed was linked to three other spreadsheets. Agents are the same trade-off at a larger scale: convenience in exchange for trusting code you didn’t write and can’t fully audit. The tooling is more sophisticated now. The underlying bargain hasn’t changed much at all.
Tasks we’d actually hand over
There’s a genuine tier of agent tasks that are low-risk because the blast radius of a mistake is small and recoverable. Drafting a reply to a routine email, summarising a long document before a meeting, pulling together a packing list from a travel itinerary, or generating a first-pass budget spreadsheet all fall into this bucket. If the agent gets it wrong, you notice within seconds and the fix costs you nothing but a bit of time.
Scheduling sits just above that. A calendar agent that proposes meeting times based on your existing commitments and sends a draft invite for you to approve is a genuinely useful delegation, because the final action, the actual sending, still has a human in the loop. The same goes for an agent that monitors your inbox and flags bills or renewal notices rather than paying them outright. It’s doing the tedious scanning work and leaving the consequential decision with you.
Research and comparison shopping is another reasonable one, with a caveat. An agent that trawls retailer sites and reports back on prices for, say, a new washing machine can save real legwork. Just don’t let it complete the purchase autonomously using stored card details unless you’ve deliberately set a hard spending cap, because “it found the best price” and “it bought the right item from a legitimate seller” are two separate claims and only one of them is easy for the software to verify.
Tasks we’d keep a human on
Anything touching money transfers, superannuation, tax lodgement or legal documents should stay supervised for the foreseeable future, full stop. Not because the models are incapable of drafting a BAS statement or filling in a transfer form; they often do that part competently. The risk is in what happens when the input data is wrong, ambiguous, or has been quietly manipulated by someone else, and the agent has already acted before a human noticed.
This matters more in Australia than the marketing from overseas vendors tends to acknowledge, because our privacy and consumer protection settings were built around a human making the final decision. The OAIC’s guidance on the Notifiable Data Breaches scheme assumes an organisation can point to a decision-maker and a process. An agent that silently retries a failed payment with slightly different details, or forwards a document containing someone else’s personal information because it misread the intent of an email, creates exactly the kind of mess that scheme exists to catch after the fact, not before.
We’d also keep agents away from anything involving account recovery or identity verification. If a tool asks to “manage your passwords” or “verify your identity across accounts” on your behalf, that’s a single point of failure sitting on top of every other account you own. Readers who haven’t yet moved to passkeys, which remove the password as the weak point entirely, are better off tackling that first; our passkeys explained guide covers how that actually works without the jargon.
The permission, not the promise
Here’s the contrarian bit, because every one of these articles is supposed to have one: we reckon the industry’s framing of “can you trust the AI” is the wrong question entirely. The right question is “what permission did you actually grant it, and can you see a log of what it did with that permission afterwards”. An agent with read-only access to your calendar and no ability to send anything is trustworthy by design, regardless of how clever or dumb the underlying model is. An agent with your saved card details and standing authorisation to “handle renewals” is a risk regardless of how good its reasoning looks in a product demo.
This is a scope-of-access problem dressed up as an intelligence problem, and vendors prefer the intelligence framing because it sounds more impressive in a keynote. Before you grant any agent access to anything, check exactly what permissions it’s asking for the same way you’d check which apps on your phone can see your location; our guide on how to check which apps can see your location walks through the settings menu that applies here too, because the principle is identical.
Where the processing happens matters
There’s a second layer worth understanding before you delegate anything sensitive: whether the agent is running the sensitive reasoning on your device or shipping your data off to a server somewhere. On-device models are improving fast, and for a task like drafting a message from your own notes, keeping that on your phone or laptop is meaningfully more private than routing it through a cloud service, however good that service’s stated privacy practices are. We’ve gone through this trade-off in detail in our piece on local AI vs cloud AI in Australia, and the short version is that the more personal or financial the task, the more weight you should give to keeping it local if that option exists.
Agents that need to browse the live web or check real-time prices generally have to use cloud processing, which isn’t a dealbreaker, but it does mean a third party’s servers are briefly in possession of whatever context you gave the agent to complete the job. Worth knowing before you paste in your full travel itinerary, passport number and all.
The scam angle nobody’s pricing in yet
Scamwatch and the ACCC have spent years warning Australians about impersonation scams where a caller or email pretends to be a bank, a telco or the ATO. Agentic AI adds a new wrinkle: if you’ve trained yourself to trust an automated assistant that acts on your behalf, a convincing fake version of that same assistant, or a prompt injected into a webpage your real agent is reading, becomes a new attack surface. This isn’t hypothetical scaremongering; it’s the predictable next step after email phishing and SMS scams, and it’s the reason the Australian Cyber Security Centre has been quietly updating its guidance to cover AI-assisted threats alongside the traditional stuff.
Our practical advice: treat any agent’s output the way you’d treat an email from an unfamiliar sender asking you to click something urgent. Read it before you approve it, especially the first few times you use a new tool, until you’ve built a real sense of how it behaves.
Where the rules haven’t caught up
There’s no agent-specific law in Australia yet, and there probably shouldn’t be one rushed into existence just for the sake of having one. Existing consumer law already covers a lot of this ground: if a retailer’s chatbot-agent makes a false representation that leads you to a purchase, the usual protections under the Australian Consumer Law, which the ACCC administers, still apply regardless of whether a human or an algorithm made the pitch. What’s genuinely unsettled is liability when an agent acting with your broad permission does something you didn’t specifically authorise. That’s a gap regulators here and overseas are actively working through, and it’s worth watching rather than assuming it’s solved.
For students being nudged toward AI tools for coursework, the stakes are different again, more about academic integrity than financial risk; our breakdown of AI tools for Australian students covers where that line sits.
Our verdict: narrow trust, not blanket trust
The pattern that’s emerged by late 2026 is reasonably clear. Agents earn trust task by task, not as a category. A narrow, permissioned, logged agent doing one repetitive job is a genuine quality-of-life improvement, and we use several of them ourselves without any hand-wringing. A broad, “just handle it” agent with standing access to money or identity is a promise most products can’t yet back up safely, no matter how well the demo goes.
If you take one thing from this: ignore the word “agent” entirely when deciding whether to trust a tool, and read the permissions screen instead. That’s the part that actually tells you what can go wrong, and it’s the part almost everyone skips.
For a broader look at where this technology sits right now, our explainer on what AI agents actually do in 2026 is a useful companion to this one.
— Dale Whitfield, Founding Editor, Tech Geek
