AI assistants in 2026: what they can do and what they cost in privacy

What an AI assistant is in 2026

The voice assistants of the 2010s mostly handled commands their makers had built in: set a timer, play a song, turn on a light. A request outside that list usually failed. Current assistants are built on a large language model (LLM), such as the GPT models behind ChatGPT or Google's Gemini family. An LLM writes its answer one word at a time from patterns learned in training. When Google opened access to Bard in March 2023, it described an LLM as a prediction engine that picks words likely to come next, and warned in the same post that such models can present false information confidently.

The model alone only produces text. What makes it an assistant is the software around it:

• Tools that search the web and read the files you upload.
• Memory that keeps details about you between conversations.
• Connected apps that let it search your email, calendar and documents.
• Agents, from late 2024 onward, that operate a web browser or your apps to finish a task.

The old voice assistants have been rebuilt on this design. In March 2025, Google said it was moving more phone users from Google Assistant to Gemini and that the classic Assistant would no longer be accessible on most mobile devices later that year. Amazon announced Alexa+ in February 2025, and Apple released Siri AI, a new Siri on its next generation of Apple Intelligence models, in September 2026. What that means for a website that wants to be the spoken answer is covered in voice search optimization.

The AI assistants people use in 2026

Each maker's own announcements give these dates.

Three things separate them in practice.

Where they live. Siri comes with Apple devices, Alexa+ with Echo devices and the Alexa app, Gemini with Android and Google accounts, and Copilot with Windows and Microsoft 365. ChatGPT and Claude are standalone apps on the web, desktop and phone. The assistant tied to accounts you already use sees the most context, which is both its advantage and its privacy cost.

Where they work. As of September 2026, Siri AI is in beta in English, with French, Japanese, Korean, Portuguese and Spanish announced for the following month. It is not available at first in the EU on iPhone, iPad and Apple Watch, and its server-based features have daily usage limits. Alexa+ is fully available in the US and Canada, and in early access in Brazil, the UK, Mexico, Italy, Spain, Germany, Austria and France.

How they are paid for. Alexa+ is included with Prime or costs US$19.99 a month, and people in the US without Prime get a limited free chat at Alexa.com. Apple says expanded access to its server-based features will cost a fee in the future. Copilot without a Microsoft 365 subscription may show ads.

What AI assistants do well

Assistants are strongest where the output is text you can check quickly.

The reliable cases share one pattern: the assistant works from text you can verify. A summary of a document you uploaded, or an answer with links, can be checked in a minute. An unsourced answer from the model's memory cannot, which is why the most useful habit with any assistant is to ask where an answer came from. Tools built to answer only from sources you add, such as NotebookLM, make that the default, and search engines now put the same kind of generated answer on top of results, as in Google's AI Overviews.

From answers to actions: AI agents that browse and book

An AI agent is an assistant that takes steps instead of only answering: it opens websites, clicks, types into forms and calls apps until a task is done. OpenAI, Google, Anthropic, Microsoft and Amazon each announced one between late 2024 and 2026, and most state its limits in the announcement itself.

Two limits recur in almost every maker's text. Agents make ordinary mistakes: OpenAI's example is buying the wrong product, and Google's privacy hub warns that Gemini can make purchases or share your data with third parties unexpectedly. And agents read content nobody has vetted: a web page or an email can carry instructions written for the agent, not for you. That is why the makers pause before consequential steps. In OpenAI's launch evaluation, ChatGPT agent asked before a relevant action 91% of the time (OpenAI says the figure understates the real rate) and every time before completing a financial transaction.

Anthropic's pilot post puts numbers on the second risk. Across 123 test cases, hidden instructions succeeded against its browser agent 23.6% of the time without its safety mitigations, and 11.2% of the time with them. Its advice to pilot users was to start with trusted sites and to avoid financial, legal and medical sites. Google's Spark page says the same in its own words: avoid tasks that use information or perform actions you find sensitive.

The practical rule follows from both: let an agent research, compare and fill in, and make the final click yourself.

What AI assistants still get wrong

The makers' own pages list the failure modes plainly.

• Confident, wrong answers. OpenAI's 2022 launch post already said ChatGPT sometimes writes answers that sound plausible but are wrong. Google's Gemini Apps Privacy Hub warns that Gemini can produce inaccurate or offensive information, including about people. Microsoft's Copilot privacy FAQ says Copilot may misrepresent what it finds and asks you to check its citations before acting.
• Professional questions. Google tells users not to rely on Gemini for diagnosis, treatment, or legal, financial or other professional help.
• Accidental activation. Gemini can wake on a noise that sounds like "Hey Google" and treats what follows as a normal request.
• Following the wrong instructions. Prompt injection, covered below, turns a helpful assistant into one that works for whoever wrote the page it is reading.

These are not bugs that the next release removes. They come from how language models work, which is explained in AI limitations in understanding along with the checks that make them safe to use where mistakes matter.

How assistant memory works, and how to control it

Memory is the feature that makes an assistant feel personal, and the one that most changes what it holds about you. It works in two ways: saved memories, which are short facts the assistant writes down about you, and reference to past chats, where it searches your history when it answers. Either way, a detail you mentioned once can shape answers weeks later.

What each assistant does, as of September 2026:

• ChatGPT can draw on saved memories, past chats, custom instructions and, depending on plan and region, connected apps such as Gmail. The controls sit under Settings, Personalization, Memory. OpenAI's memory help page warns that deleting a chat does not delete a saved memory made from it, so delete both, plus any file or connected app that holds the detail. Temporary chats do not create or update memories.
• Gemini has referenced past chats since August 2025, a setting Google turned on by default. It now sits under Settings, Personal Intelligence, Memory, and it needs Keep Activity on. Removing something Gemini learned from a connected app takes two steps: delete every chat that contains it, and disconnect the app. Doing only one leaves the detail reachable.
• Claude gained memory for Team and Enterprise plans on September 11, 2025 and for Pro and Max on October 23, 2025. Anthropic's help page says memory is on by default for Free, Pro and Max plans and off by default for Team and Enterprise, that it skips sensitive topics such as health, religion and politics by default, and that you can view, edit or pause it. Incognito chats are not saved to memory or history.
• Microsoft Copilot keeps saved memories that you manage under Settings, Personalization. Turning the switch off does not delete what is already saved; use Delete all memories for that. If you allow ad personalization, Microsoft says personalized ads may draw on your chat history and saved memories.
• Alexa+ already knows what you have bought, listened to and watched, where you ship things and how you pay, according to Amazon, and remembers what you ask it to, such as recipes or dates.
• Siri AI has a dedicated Siri app that syncs your conversation history across your Apple devices through iCloud.

Are your conversations used to train AI models?

Training means your conversations may be used to improve the vendor's future models. The default depends on the assistant and on the kind of account.

Apple says the models behind Siri AI were custom-built in collaboration with Google and its Gemini models, but they run on Apple devices and on Private Cloud Compute, where Apple says personal data is not stored or made accessible to Apple or anyone else. Four details matter more than any switch.

1. Opting out changes the future, not the past. Anthropic says chats stay in training runs already under way and in models already trained. Google keeps chats that human reviewers have seen for up to three years, disconnected from your account, even after you delete your activity.
2. Feedback can opt you back in. OpenAI says a thumbs up or down can send the whole conversation into training even after you opt out. With Keep Activity off, Google still collects feedback you submit and keeps reviewed feedback with its conversation for up to three years.
3. Off does not mean not stored. With Keep Activity off, Google still keeps chats for 72 hours to respond to you and protect its services, and Microsoft's older Copilot app offered no opt-out from human review of conversations suspected of breaking its code of conduct.
4. Some features need the switch on. Gemini's memory and its Google Workspace connections are unavailable while Keep Activity is off, so connecting Gmail to Gemini means your chats are kept and may be used for training.

How long AI assistants keep your conversations

Retention is how long a conversation stays on the vendor's servers. It is set separately from training.

Anthropic's figures come from its retention page, updated July 1, 2026, Amazon's from its Alexa privacy guide, and Apple's from its Private Cloud Compute design, which also publishes the server software for outside researchers to inspect. Anthropic, Google and OpenAI each add a caveat: data may be kept longer for legal reasons or to deal with abuse.

What connecting email, calendars and files gives away

Connecting an account turns the assistant from a writer into a researcher. "What did the school send about Friday" becomes answerable. Claude's Google Workspace integration, launched in April 2025, searches Gmail, reads Docs and sees your Calendar. Gemini's Connected Apps do the same for Gmail, Drive, Calendar and Photos. ChatGPT's connected apps reach Google Drive, Outlook email and calendar, Slack, SharePoint and others. Siri AI searches your messages, emails and photos.

Look at what you hand over, not just what you get:

• Google lists what Gemini and a connected app exchange: your chats, your device and location details, and the content of the app itself, meaning emails, files, events and photos. It also says it does not monitor or secure data from custom third-party connected apps.
• OpenAI says an app you enable in ChatGPT may see context from your conversations and, with memory on, from your memories. On Free, Go, Plus and Pro plans, OpenAI may train on what it reads through apps while Improve the model for everyone is on.
• ChatGPT's app permissions run from Always ask to Allow all actions, which OpenAI says carries elevated risk because supported actions may run without another confirmation.
• Microsoft's new Copilot app can import your Edge browsing data, including cookies, history, payment information, passwords and autofill, for Microsoft accounts based in the US.
• On Team and Enterprise plans, Anthropic requires an administrator to enable Google Workspace access for the whole domain before anyone connects.

The bigger risk sits in the content itself. Every email in your inbox was written by whoever sent it, and for eligible users ChatGPT can even start a task when a new Gmail message arrives. The OWASP Gen AI Security Project ranks prompt injection first in its 2025 Top 10 for LLM applications and describes the indirect form: instructions hidden in websites or files that the model reads, which people may never see. Anthropic's example is hidden text telling the AI to disregard its previous instructions. An assistant that can read your mail and also send mail or fill in forms is the combination such an attack needs.

OWASP's first defences apply at home as much as in a company: give the assistant the least access the task needs, and require a person's approval for high-risk actions. In practice, connect an account for a task and disconnect it afterwards, keep financial and medical accounts out of reach, and set app permissions to ask before any action.

Using AI assistants at work

Work accounts come with different terms, and the difference is often the whole point:

• OpenAI does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces to train its models by default.
• Microsoft does not train Copilot on data from people signed in with a work or school (Microsoft Entra) account, and says conversations in Microsoft 365 Copilot are not used to train its models.
• Anthropic's consumer training choice does not apply to Claude for Work (Team and Enterprise plans), Claude for Government, Claude for Education or API use.
• Google says Gemini used with a work or school Google account may be subject to different data handling terms, set out in its Workspace privacy hub.

The risk to plan for is simpler than a breach: a person pasting a client's file into a personal account because it was the fastest tool at hand, where that file may be kept for 18 months or used for training. A short written rule fixes most of it: which assistants are approved, with which account, which data may go in, and who approves connecting mailboxes or turning on agents.

General assistants cover general tasks. When staff need answers from your own policies, product data or tickets, an assistant can be built to answer from your own pages, documents and live data, cite its sources and say when it does not know. That is the kind of system our AI and automation service builds, with a person approving anything that changes data.

A checklist for using an AI assistant safely

At home

1. Open each assistant's privacy settings once and set training on purpose: Improve the model for everyone in ChatGPT, Keep Activity in Gemini, the model training switch in Claude, Help Improve Alexa in the Alexa app.
2. Look at what memory holds every few weeks, and delete what you would not tell a stranger.
3. Use a temporary or incognito chat for health, money, legal and relationship questions.
4. Never paste passwords, card numbers, government ID numbers or other people's private details.
5. Connect email or calendars for a task, then disconnect. Delete the chats that used the data as well, or the assistant can still recall it.
6. Let an agent research and fill in; make the final click on purchases, bookings and messages yourself.
7. Keep agents away from banking, health and legal sites, as Anthropic advises for its own browser agent.
8. Open the source before you act on any fact that matters.

At work

1. Use the assistant and account your organization approved, never a personal account, for work data.
2. Ask IT which connectors and agents are allowed, and what data classes may go in.
3. Treat every output as a draft: a person reads anything sent to a client, filed or published.
4. Report an assistant that did something you did not ask for, with the chat, as you would report a phishing email.