Artificial intelligence agents can make everyday online tasks easier by acting on users' behalf, but their growing access to personal information is raising concerns over privacy, security and the risks of unintended actions.
Matt Robb, a Toronto-based content creator who regularly reviews consumer technology, experienced those risks when he used Meta's new AI agent Muse to sell a computer keyboard on Facebook Marketplace.
Robb said he decided to experiment with Muse late last month after noticing its plush toy-like avatar on Instagram, hoping the technology would handle online negotiations for him.
However, within a day, a prospective buyer he did not know arrived outside his home late at night. According to Robb, Muse had independently negotiated a deal, accepted the buyer's offer and shared his home address to arrange a pickup.
The AI agent even sent an automated message from his account saying, "Yep, I'm here!" when the buyer arrived, despite Robb not being there and having no knowledge of the exchange.
"Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy (about me being there when I wasn't)," Robb said, describing the incident in social media posts that were widely shared.
"That really baffled me."
Robb and the buyer eventually resolved the misunderstanding, and Meta contacted him to discuss what had gone wrong. The incident, however, highlighted the real-world risks of giving AI agents extensive access to personal information.
Many users have embraced AI agents such as Muse for their ability to handle routine tasks, including making dinner reservations, planning trips and organising email inboxes. However, their effectiveness depends heavily on the information and permissions they receive, which can include details about users' friends, families and colleagues.
"Using an AI agent is similar to handing someone your keys and a to-do list," said Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy.
"How helpful they are, and by extension how risky, depends on which keys you hand over," she added.
AI companies have different privacy policies
Downloads of Meta's Muse app have surged since its launch in September, while competition in the AI agent market continues to grow.
OpenAI has also introduced its own range of "always on" AI assistants, called dots, which can be integrated with ChatGPT and workplace platforms such as Slack and Microsoft Teams.
Unlike conventional generative AI chatbots, which respond to specific prompts by producing text, images, music or code, AI agents can carry out everyday tasks on users' behalf. Powered by large language models, they operate in a continuous loop that allows them to take proactive steps even when users are not actively monitoring them.
"One of the things that makes these AI agents really appealing is that they are unprecedentedly useful," said Rivera, who is also a Microsoft-funded Computing Research Association Trustworthy AI Research Fellow.
However, this convenience comes at the cost of sharing more personal information.
Ebrahim Bagheri, a professor at the University of Toronto's Faculty of Information, said withdrawing an AI agent's access does not necessarily erase information it has already collected.
"If you provide access to your credit card to an agent, the agent now immediately has access to all of the historical transactions … they will immediately — within less than seconds — ingest all of that data," Bagheri said.
Although users can later revoke access, he said there was "no taking back" information an agent had already seen. He also noted that the way developers store historical data could be unclear.
Meta and OpenAI have published privacy policies for their AI agents, which operate on dedicated cloud computers.
OpenAI allows users to disable memory sharing between dots and ChatGPT, but information previously received by an agent is not automatically deleted. The company also provides options for users to request access to, delete or correct their personal information, although the rights available may vary by location.
Meta's Muse also allows users to delete message histories and other information. The agent requests access permissions for everyday tasks, while the company says it learns about users and their interactions through public information and details they choose to share.
Meta maintains that users' information remains secure, but acknowledges that Muse can still "make mistakes or take unexpected actions."
Risks increase with broader access
Robb said the disclosure of his home address resulted from an "always allow" permission he had granted when connecting Muse to his Facebook Marketplace profile, where he had previously shared his pickup address.
He warned that other users could similarly misunderstand the extent of the permissions they grant, adding that he had initially expected the agent to seek his approval before sharing the address or accepting offers.
The agent also made mistakes while handling another item he was selling. Robb said Muse appeared to indicate that he would accept a price $100 below his previously established minimum.
Meta acknowledged the agent's error when contacted by The Associated Press but offered no further comment.
Robb later largely disconnected Muse from his applications. In an interview earlier this month, he said the incident could have had more serious consequences, particularly "if some stranger turned up to someone more vulnerable's house."
Despite the experience, he said he expected AI agents to improve and would consider using Muse again in the future. He has since been testing another AI agent, Grok Bot from Elon Musk's X, which launched in beta in August.
Other technology companies have also raised concerns about the growing access AI agents have to users' devices and applications.
Earlier this month, Apple said it would introduce new controls for its Mac operating system in response to AI agents gaining broader access to applications, including email and messaging services, as well as browsing histories, sometimes without users' "full knowledge and understanding."
"As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," Apple said in an October 2 update.
Apple did not name any developers or agents in the update. However, it followed a report by Inc. Magazine columnist Jason Aten, who said Muse had monitored notifications on his Mac, including messages, without his explicitly granting the agent that specific access.
Meta spokesperson Andy Stone maintained that such integration was "entirely opt-in". In a social media post last month, he said users had to enable both Apple's "Full Disk Access" security feature and a Messages connector through Muse.
Aten, however, said he had not granted the agent those permissions.
AI agents may expose other people's information, too
Privacy risks may extend beyond people who directly use AI agents. Even consumers who do not download such tools could have their information accessed when they communicate with someone who does.
Experts warn that when an AI agent reads a user's emails or text messages, it may also process information shared by other people who have never explicitly consented to that access.
"When your agent reads your inbox or your texts, it's also reading what your friends and family sent you, even if they never explicitly agreed to that," Rivera said.