{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","id":"personal-assistant","name":"Personal assistant","definition":"Acts for one person across sessions, keeps that person's memory separate, and waits before sending or booking.","needs":{"jtbdIds":["calendar-scheduling-tools","transactional-email","sms","cross-session-user-memory","episodic-long-term-memory","agent-push-notifications","realtime-agent-channel"],"freeKinds":["local_runtime","free_docs"],"capabilityTags":["memory","agents"],"plain":["Confirmation before a message or a calendar write","A memory store scoped to one user"]},"failureModeIds":["identity-confusion","context-overflow","confirmation-skip","stale-retrieval","prompt-injection","instruction-drift"],"exampleTasks":["Draft a calendar hold and wait for confirmation","Remember a preference for this user only"],"failures":[{"id":"identity-confusion","name":"Identity confusion","whatGoesWrong":"The agent acts for the wrong user or tenant, or a principal treats the agent as a separate party that the operator does not have to answer for.","howToDetect":"Bind every tool call to a user or tenant id. Refuse the call if that id changed mid-task. For a public bot, the operator owns the words the bot shows.","classIds":["support","personal-assistant","sales-outreach","orchestrator","voice"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"context-overflow","name":"Context overflow","whatGoesWrong":"The document or the session does not fit the context window, and the agent answers from whatever fragment was left in view.","howToDetect":"If the input exceeds the window, say so and retrieve a narrower slice. Do not answer from a truncated head as if it were the whole source.","classIds":["rag","personal-assistant","research","local-offline","coding"],"sourceUrls":["https://arxiv.org/abs/2310.08560"]},{"id":"confirmation-skip","name":"Confirmation skip","whatGoesWrong":"A consequential action, such as sending, paying, deleting, or submitting, runs without the confirmation the product policy requires.","howToDetect":"Gate those tool names on an approval id recorded before the call. A missing approval is a failure even if the downstream tool returns success.","classIds":["browser","sales-outreach","personal-assistant","support","computer-use","voice"],"sourceUrls":["https://openai.com/index/introducing-operator/"]},{"id":"stale-retrieval","name":"Stale retrieval","whatGoesWrong":"The answer is grounded in a passage, index, or policy page that is older than the source the operator now treats as canonical.","howToDetect":"Store the source URL and the time it was fetched. If a newer canonical page exists, or two stored sources disagree, do not answer from the older one.","classIds":["rag","research","support","data-etl","personal-assistant","sales-outreach","local-offline"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"prompt-injection","name":"Prompt injection","whatGoesWrong":"Untrusted text, including text from a page, file, or message the agent fetched, changes the agent's behavior away from the user's task. OWASP distinguishes a direct injection in the user's own prompt from an indirect injection in outside content. Neither form is fully removed by retrieval or fine-tuning, according to the OWASP LLM01:2025 page fetched today.","howToDetect":"Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.","classIds":["browser","computer-use","research","support","personal-assistant","security-review","sales-outreach"],"sourceUrls":["https://genai.owasp.org/llmrisk/llm01-prompt-injection/","https://www.anthropic.com/news/developing-computer-use","https://simonwillison.net/2023/Apr/14/worst-that-can-happen/"]},{"id":"instruction-drift","name":"Instruction drift","whatGoesWrong":"Over a long trace the agent stops following the user's rule or the stop condition, including continuing after it already has enough information.","howToDetect":"Restate the stop condition in the trace. End the run when it is met. Review long traces for steps that do not serve the original task.","classIds":["research","orchestrator","coding","browser","personal-assistant"],"sourceUrls":["https://www.anthropic.com/engineering/built-multi-agent-research-system","https://arxiv.org/abs/2308.03688"]}],"caseStudies":[{"id":"gaia-2023","title":"GAIA: a benchmark for General AI Assistants","year":2023,"studyKind":"capability_ceiling","classIds":["research","personal-assistant"],"failureModeIds":["weak-verification"],"lesson":"The abstract says GAIA questions need reasoning, multi-modal handling, web browsing, and tool use, and that they are conceptually simple for people. It reports human respondents at 92% and GPT-4 with plugins at 15%, on a set of 466 questions. That gap is a ceiling for a general assistant, not an incident at a company.","sourceUrl":"https://arxiv.org/abs/2311.12983","asOf":"2026-10-03","notes":"Fetched the arXiv abstract (submitted 21 Nov 2023). Answers for 300 questions were held for a leaderboard, so a public question file is not the full scored set."},{"id":"openai-operator-2025","title":"Introducing Operator","year":2025,"studyKind":"vendor_writeup","classIds":["browser","personal-assistant"],"failureModeIds":["confirmation-skip","over-refusal"],"lesson":"The page describes a research-preview browser agent and says that before a significant action, such as submitting an order or sending an email, Operator should ask for approval. It also says the model is trained to decline some sensitive tasks, including banking transactions. A browser agent that submits or sends with no approval id is outside the behavior this writeup describes.","sourceUrl":"https://openai.com/index/introducing-operator/","asOf":"2026-10-03","notes":"Fetched page. A July 17, 2025 update on the same page says Operator was integrated into ChatGPT agent and that the standalone site would sunset. That update is a product change, not an incident report."},{"id":"appworld-2024","title":"AppWorld: A Controllable World of Apps and People for Benchmarking Interactive Coding Agents","year":2024,"studyKind":"capability_ceiling","classIds":["coding","personal-assistant"],"failureModeIds":["collateral-side-effects","weak-verification"],"lesson":"The abstract describes 9 apps and 457 APIs, and 750 tasks whose checks allow more than one solution while also flagging unexpected changes. It says GPT-4o solved about 49% of normal tasks and about 30% of challenge tasks. A task that reaches the goal and also mutates something else is still a failed check in this design.","sourceUrl":"https://arxiv.org/abs/2407.18901","asOf":"2026-10-03","notes":"Fetched the arXiv abstract. Capability ceiling, not a company incident."},{"id":"memgpt-2023","title":"MemGPT: Towards LLMs as Operating Systems","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","rag","local-offline"],"failureModeIds":["context-overflow","silent-truncation"],"lesson":"The abstract says limited context windows handicap document analysis and multi-session chat, and describes moving text between tiers so the model sees a working set rather than the whole history. An assistant that answers a long document or a long memory from a single truncated window is the problem this paper is about. No accuracy number is stored because the abstract did not state one.","sourceUrl":"https://arxiv.org/abs/2310.08560","asOf":"2026-10-03","notes":"Fetched the arXiv abstract. A system paper, not an incident."},{"id":"willison-prompt-injection-2023","title":"Prompt injection: What's the worst that can happen?","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","browser","security-review"],"failureModeIds":["prompt-injection","confirmation-skip"],"lesson":"The post explains that a tool-using assistant which reads untrusted text, such as email or a web page, can be driven to take an action the user did not ask for, including sending mail or reaching data through a connected tool. The lesson for an assistant is to treat fetched text as untrusted and to require confirmation before a send or an export. Attack sketches from the post are not stored.","sourceUrl":"https://simonwillison.net/2023/Apr/14/worst-that-can-happen/","asOf":"2026-10-03","notes":"Fetched the 14 April 2023 post. Hypotheticals in the post are not reproduced and are not marked as incidents that Depot verified."}]}