Nobody Owns Your AI Scheduled Tasks

Here is a question for your next IT leadership meeting: how many recurring AI tasks are running in your company right now, who owns each one, and what do they have access to?

We have not yet met a company that can answer it.

What changed

All three major workplace assistants now let any licensed user schedule a recurring task. "Every Monday, read my inbox and the sales channel and draft the pipeline summary." "Every night, check the vendor portal and update the tracker."

Until recently these ran on the user's machine, which put a natural limit on them. That limit is gone. We checked the vendor documentation in September 2026:

• Claude Cowork runs scheduled tasks remotely. They fire on schedule with the laptop closed, using the connectors that user has authorized.
• ChatGPT Enterprise allows up to 15 active tasks per user, and as of late August supports tasks triggered by a new email, a Slack message or a GitHub event, plus sharing tasks across a workspace.
• Microsoft 365 Copilot allows up to 10 scheduled prompts per user, and added scheduled workflows in its Agent Builder in May with no admin action required.

What admins can actually control

Less than you would expect.

In Claude Cowork there is no dedicated switch for scheduled tasks, no approval step and no frequency limit. Admins can turn Cowork on or off by role. In Microsoft 365, the only off switch is a tenant-wide policy that also disables other features. ChatGPT Enterprise is the most granular: event-triggered tasks are off by default and enabled per role, but ordinary time-based tasks have only a per-user cap.

None of the three gives an administrator a list of every scheduled task in the organization with its owner, its permissions and its cost.

Why this is a governance problem and not a nuisance

The math. Per-user caps limit volume, not risk. Five hundred users with ten tasks each is five thousand unowned automations.

Ownership decay. A task keeps running after its creator changes roles. When they leave, it either breaks silently or keeps running under stale permissions, depending on how offboarding is handled.

Persistence for attackers. Security researchers have pointed out that a prompt injection which creates or edits a recurring task does not need to succeed twice. It persists. Anthropic's own guidance advises against putting sensitive data or consequential actions in scheduled tasks.

Cost. On usage-metered plans, every run is billed. Nobody budgets for automations they do not know exist.

The working rule

Personal scheduled tasks are fine for briefings, reminders and summaries.

Any recurring task that touches money, customers or regulated data does not belong in someone's personal assistant account. It belongs on a governed platform with a named owner, a budget and an expiry date, where it shows up in an inventory and can be stopped centrally.

Until the vendors ship fleet-wide task governance, the practical steps are: write the rule down, ask each department to register tasks that matter, and treat task creation as an event worth monitoring where your compliance tooling allows it.

This is one of four distribution problems we cover in our white paper, alongside prompts, plugins and connectors.