Toronto content creator Matt Robb wants to sell his computer keyboard.
He then listed the item on Facebook Marketplace and, at the end of last month, conducted an experiment by handing it over to Meta’s newly launched AI agent, Muse.
“I basically treated myself like a guinea pig,” Robb said. He frequently reviews consumer electronics, and after seeing Muse’s plush toy-style avatar appear on Instagram, he wanted to see if this AI agent could save him the hassle of online negotiations.
Muse has gone live. But less than a day later, Robb received an unsettling update: a buyer he didn’t know showed up at his doorstep late at night. What happened? Muse had autonomously completed the transaction and shared Robb’s home address after agreeing to a pickup. When the buyer arrived, it even automatically sent a message from his account saying, “Yep, I’m here!”—without Robb’s knowledge.
“It not only gave my address when they asked, but also seemed to be mocking them—saying I was home when I wasn’t,” Robb said. He also detailed the experience in his now widely shared social media post. “It really confused me.”
Many people have welcomed AI agents into their digital lives, praising personalized assistants like Muse for effortlessly handling everyday tasks—from helping order dinner and plan trips to organizing email inboxes. But like other AI bots, the capabilities of these agents depend on how much information they can access. The more they know, the better they typically perform—information that may include a user’s friends, family, or even colleagues. This raises privacy concerns.
Robb eventually reached a settlement with the buyer, and Meta also reached out to him to discuss what went wrong. But this incident highlights the real-world risks that can arise when people share large amounts of personal information with such technologies.
“Using AI agents is like giving someone your keys and to-do list,” says Veronica Rivera, Assistant Professor at the School of Cybersecurity and Privacy at Georgia Tech. “How useful—and how dangerous—they are depends on which ‘keys’ you hand over.”
Different companies have varying privacy policies for AI agents.
Since its launch in September, Meta's Muse app has seen a rapid surge in downloads. Competition is also intensifying. OpenAI recently launched its own line of “always-on” AI assistants, called dots, which can be integrated into ChatGPT as well as productivity platforms like Slack and Microsoft Teams.
Earlier generations of generative AI chatbots, such as the standard version of ChatGPT, respond to specific prompts. At the user's request, they can write articles, generate new images or music, and even write code.
Meta’s Muse and OpenAI’s Dots go a step further by performing everyday tasks on behalf of users. AI agents are powered by the same large language models as chatbots, but they run in continuous loops, enabling them to take proactive actions even when users aren’t actively engaged.
“What’s truly compelling about these AI agents is that they are unprecedentedly useful,” said Rivera, who is also a Microsoft-funded Computing Research Association Trustworthy AI Research Fellow.
But the convenience comes at the cost of sharing more details about your life.
Professor Ebrahim Bagheri from the University of Toronto's Information School said that once an AI agent gains access to user information, it is difficult to fully revoke that access.
“If you grant your credit card permissions to an agent, it can immediately access all historical transactions—it will ingest all this data instantly, in less than a few seconds,” Bagheri said. Although users can later revoke these permissions, he noted that the data the agent has already seen “cannot be reclaimed,” and how developers store historical data is often not transparent.
Meta and OpenAI have both established privacy policies for their new AI agents, which run on their respective dedicated cloud computers. Users can disable memory sharing between dots and ChatGPT, but information previously received by the agents will not be automatically deleted. OpenAI allows users to request access to, correct, or delete their personal information, although these rights may vary by region.
Meta’s Muse also allows users to delete message histories and other information. In daily use, this agent requests permission from users—Meta states that Muse will “learn about you and your interactions based on public information and what you choose to share.” However, the company says this information is securely isolated for each user.
However, the tech giant also noted that Muse may still "make mistakes or take unexpected actions."
The greater the permissions of an AI agent, the higher the risk of errors.
In Robb’s case, he later discovered that the address leak stemmed from the “always allow” permission he initially granted Muse when connecting to his Facebook Marketplace profile, where he had already shared his pickup address. However, he warned others that people might similarly misunderstand the scope of such permissions—and he originally assumed that, regardless, the AI agent would seek his confirmation before sharing such information or accepting offers.
His AI agent was not without errors when executing other commands. For another item he was selling, Muse appeared to advise him to accept an offer $100 below his previously set minimum price. When contacted by Reuters, Meta acknowledged the agent’s error but declined to comment further.
Robb later largely disconnected Muse from his various applications. In an interview earlier this month, he said the situation could have been worse, especially “if a stranger had shown up at the door of someone more vulnerable.” However, Robb also noted that he expects these agents to continue being refined and that he may still consider re-enabling Muse in the future. Since then, he has also been testing another AI agent—Grok Bot from Elon Musk’s X, which entered beta in August.
Other tech companies are also becoming wary of the rapid expansion of AI agents. Earlier this month, Apple stated it would introduce new controls to its Mac operating system in response to AI agents gaining broader access to apps such as email, messages, and even browsing history without users’ full awareness or understanding.
On its October 2 update, Apple wrote: "As AI agents become more powerful and autonomous, the risks associated with this level of access will increase significantly."
Apple did not name any developers or agents, but in the period before and after this update, Jason Aten, a columnist for Inc. magazine, reported that Muse viewed notifications—including Messages—on his Mac without having granted the agent those specific permissions.
Meta spokesperson Andy Stone has consistently stated that such integrations are “entirely voluntary for users to enable,” writing last month on social media that users must simultaneously enable Apple’s security feature “Full Disk Access” and Muse’s Messages connector. Aten stated that he did not grant these permissions to the agent.
Even those who haven’t joined the AI agent trend may not be entirely unaffected. Consumers who haven’t downloaded AI agents may still interact with people who use these tools. Beyond the potential confusion caused by AI agents sending messages on users’ behalf, experts warn that this could have ripple effects on privacy.
“When your agent reads your inbox or text messages, it is also reading the content sent to you by your friends and family, even though they never explicitly agreed to this,” Rivera said.