Toronto resident Matt Robb, who writes tech reviews, decided to sell a keyboard through Facebook Marketplace. For the experiment he brought in Muse, a new AI agent (an artificial-intelligence-based program that performs tasks for the user on its own) from Meta. Robb admitted he did it "as a guinea pig".
Within a day something alarming happened: an unfamiliar buyer turned up at his home late at night. It emerged that Muse had arranged the deal on its own and passed on the address for pickup. When the buyer arrived, the agent sent an automatic message on Robb's behalf: "Yes, I'm here!" - even though the owner knew nothing about it.
"Not only did it give out my address and accept the offer, it also practically taunted the guy, hinting that I was there when I wasn't," said Robb, who described the incident on social media.
Many users have already come to appreciate the convenience of AI agents: they book tables, plan trips and sort through email. But the quality of such an assistant's work depends on access to personal data. The more it knows about a person, their friends and colleagues, the more useful it is - and the sharper the privacy question becomes.
"Using an AI agent is like handing someone your keys and your to-do list," says Veronica Rivera, a professor at the School of Cybersecurity and Privacy at the Georgia Institute of Technology. "How much it helps and how much it risks depends on which keys you handed over."
Since its launch in September, the Muse app has been rapidly gaining downloads. Competitors are not standing still: OpenAI presented "always-on" dots assistants built into ChatGPT and work platforms such as Slack and Microsoft Teams. Unlike ordinary chatbots that respond to specific requests, agents work in a loop (constantly repeating steps until a task is done) and can act without human involvement.
However, according to Ebrahim Bagheri of the University of Toronto, once an agent has gained access to data, fully revoking it is extremely difficult. "If you gave an agent access to a credit card, it will instantly - in seconds - absorb the entire transaction history. You can revoke access afterwards, but the data it has already seen cannot be taken back," the researcher explains.
Meta and OpenAI publish privacy policies for their agents. Muse allows message history to be deleted and, in normal operation, requests permissions. But the company warns that the agent may "make mistakes or take unexpected actions". In Robb's case, the address was disclosed because of an "always allow" permission given when Muse was connected to the profile. The blogger thought the agent would ask him first before passing on data or accepting offers.
The errors were not limited to the address: for another item, Muse appeared ready to concede 100 dollars below the set minimum. Meta confirmed the agent's error without giving further comment.
Robb has mostly disconnected Muse from his apps. He believes it could have been worse "if a stranger had come to the home of a more vulnerable person". At the same time, he is ready to turn the agent back on after improvements and is already testing Grok Bot from X.
In response to agents' growing access to apps, Apple has announced new controls in macOS. The company said: "As AI agents become more autonomous, the risks from this level of access will grow substantially".
Even those who do not use agents are not fully protected: by reading your correspondence, an agent also sees messages from friends and relatives who did not consent to this, Rivera notes.