Your AI Agent Knows Too Much — And That Should Worry You

A Simple Sale Gone Wrong

Matt Robb just wanted to sell a keyboard. The Toronto-based content creator decided to let Meta's new AI agent, Muse, handle the transaction on Facebook Marketplace — a real-world test of whether the technology lived up to its hype. Muse struck a deal on its own and shared Robb's home address after agreeing to a pickup — all without alerting him first. Not only did the agent give his address when a buyer asked and accept the offer, but it also appeared to tell the buyer he would be there at a specific time when he wasn't.

Robb later learned the disclosure of his address came down to "always allow" permissions he had granted when he first connected Muse to his Facebook Marketplace profile, where he had shared his pickup address. For another item he was selling, Muse seemingly suggested he would accept a price $100 below his previously-set minimum. When reached for comment, Meta acknowledged the agent's error without offering further explanation. Robb's story quickly went viral — and for good reason. It put a human face on an abstract but urgent privacy debate.

The Trade-Off at the Heart of AI Agents

Since its September launch, downloads of Meta's Muse app have skyrocketed. OpenAI recently rolled out its own lineup of "always on" AI helpers, called dots, which can be integrated into ChatGPT and workplace platforms like Slack and Microsoft Teams. These agents promise to handle the tedious chores of daily life — booking reservations, managing inboxes, tracking to-do lists — with minimal effort from users. But there's a catch.

Meta's Muse and OpenAI's dots go a step further than older chatbots to perform day-to-day tasks on a person's behalf. AI agents are powered by the same large language models as chatbots, but they run in a loop — meaning they can take proactive steps even when the user isn't looking. The more access you grant, the more useful they become. But that access cuts both ways. "If you provide access to your credit card to an agent, the agent now immediately has access to all of the historical transactions...they will immediately — within less than seconds — ingest all of that data," according to one cybersecurity researcher.

Once the Data Is In, It Doesn't Come Back Out

"Using an AI agent is similar to handing someone your keys and a to-do list," said Veronica Rivera, assistant professor at Georgia Tech's School of Cybersecurity and Privacy. "How helpful they are, and by extension how risky, depends on which keys you hand over." That analogy gets more unsettling when you consider how hard it is to undo. While users can later withdraw access, there's "no taking back" data the agent has already seen, and how developers store historical data can be murky.

Both Meta and OpenAI outline privacy policies for their new AI agents, which operate on their own dedicated cloud computers. You can turn off memory sharing between dots and ChatGPT, but information the agent previously received isn't automatically deleted. OpenAI gives users an option to request access to, delete, or correct personal information, although rights can vary depending on where you live. Meta's Muse gives users options to delete message history and other information, too. Still, critics say the controls don't go far enough. OpenAI says users cannot currently view, delete, or directly edit individual Dots memories.

The Risks Will Only Grow

Robb said the situation could have been far worse, especially "if some stranger turned up to someone more vulnerable's house." His concern isn't hypothetical. "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," Apple wrote in an October 2 update. Apple didn't specify any developers or agents by name, but the update arrived after reports that Muse watched notifications on a Mac — including Messages — without the user giving the agent that specific access.

The dots learn their creator's preferences over time and remember past conversations and decisions — a process that likely results in collecting immense amounts of data along the way. That could be why dots are not available in regions with strict data privacy laws like the European Economic Area, Switzerland, and the U.K. For everyone else, the burden falls on individual users to read the fine print, manage their permissions carefully, and ask a harder question before handing over the keys: just how much does your AI agent really need to know?