Rank Math has decided to temporarily their Support Agent because it did not clearly communicate that the agent would generate credentials that gave it access to their user’s WordPress website.
Rank Math acknowledged that their permission and consent process was not explicit. The help and support agent will be reactivated after the feature flow is redesigned to clearly ask for permission from the user before credentials are created.
Stumbling First Steps #
Rank Math said that the Support Agent was the first part of a larger plan to deploy AI agents within Rank Math that can interact directly with a user’s WordPress site.
The initial purpose of the Support Agent was to answer support questions, but it was also the meant to be the first part of an Agentic AI deployment that would see AI agents capable of taking actions on a site on behalf of users, subject to the permissions granted to them.
Read-Only Access #
The support agent operated in a read-only capacity for the purpose of answering questions within the context of the website itself. The way it was supposed to work was within the workflow of a user opening the Help and Support section, Rank Math creates WordPress Application Password credentials (with express user permission), the AI agent gains access to identify relevant website information which can then offer contextually relevant answers to support questions.
The intention of the help and support agent was to help users but the feature ended up enraging users because none of that was clearly explained beforehand nor was permission for the credentials asked beforehand. Rank Math owned up to that error.
Their blog post on the matter owns up to their error:
“When an AI agent is being given permission to create an application password, you should be told clearly and directly what is happening and what you’re allowing.
That feedback is fair, and we take responsibility for making this clearer. That’s why we’ve temporarily d the Support Agent while we rebuild the access-request flow.”
Rank Math explained that the passwords were secure and named four security features:
- Credentials were encrypted.
- Rank Math says the credentials were not stored or persisted on its side.
- The agent inherited the permissions of the current WordPress user rather than gaining greater privileges.
- The Support Agent was read-only and could not modify the WordPress site.
Support Agent Is Returning #
Rank Math confirmed that the Help and Support agent is returning but this time it will explain ahead of time in “plain language” what they are asking for before any credentials are requested.
Featured Image by Shutterstock/Nicoleta Ionescu