Matt Robb wants to sell his computer keyboard.
So he listed the product on Facebook Marketplace — and, as an experiment late last month, put Meta’s new artificial intelligence agent, Muse, in the driver’s seat.
“I kind of jumped into it like a guinea pig,” said Rob, a Toronto-based content creator who frequently comments on consumer technology. He saw Muse’s stuffed toy avatar on Instagram and decided to see if an AI agent could save him some of the hassle of haggling online.
The muse went to work. But within a day, Rob gets shocking news: A buyer he doesn’t recognize shows up outside his house late at night. how? Muse struck a deal on his own and shared Robb’s home address after agreeing to the pickup. It even automatically sends a “Yes, I’m here!” message to a buyer’s account when he arrives—all without Rob’s knowledge.
“When the person asked, it not only gave me my address, but accepted the offer, and it was almost like teasing the person (that I wasn’t there),” Rob said. He also detailed the experience in his now widely shared social media post. “It really confused me.”
Many people welcome artificial intelligence agents into their online lives and rave about how personal assistants like Muse make everyday tasks easier—from making dinner reservations or planning a trip, to organizing their email inboxes. But like other AI robots, agents are only as effective as the information they have access to. The more they know about the user—and perhaps the person’s friends, family, or even coworkers—the better they perform. This raises privacy concerns.
Rob and the buyer eventually made amends and Mehta reached out and addressed the issue. But the incident shows that using the technology to share large amounts of personal information can come with real-world risks.
“Using artificial intelligence agents is akin to handing over your keys and to-do list to someone,” said Veronica Rivera, an assistant professor in Georgia Tech’s School of Cybersecurity and Privacy. “How helpful they are, and how risky they are, depends on which keys you hand over.”
Companies have different privacy policies for AI agents
Meta’s Muse app has seen a surge in downloads since its launch in September. And competition is only getting fiercer. OpenAI recently launched its own line of “always-on” artificial intelligence assistants, called Dots, that can be integrated into ChatGPT as well as work platforms like Slack and Microsoft Teams.
Older generative AI chatbots, such as the standard version of ChatGPT, respond to specific prompts. Depending on the user’s requirements, they can write articles, generate new images or music, or even write lines of code.
Meta’s Muse and OpenAI’s points go a step further and can perform daily tasks on behalf of people. AI agents are powered by the same large language models as chatbots, but they operate in a loop. This allows the agent to take proactive measures even if the user is not paying attention.
“One of the things that’s really attractive about these AI agents is that they’re unprecedentedly useful,” said Rivera, who is also a trusted AI researcher at the Microsoft-funded Computing Research Association.
But the price of this convenience is sharing more details of life.
Ebrahim Bagheri, a professor at the School of Information at the University of Toronto, said that once an artificial intelligence agent obtains a user’s information, it will be difficult to completely revoke access rights.
“If you give an agent access to their credit card, the agent now has immediate access to all historical transactions… They will have all this data instantly (in less than a few seconds),” Bagheri said. Bagheri said that while users can later revoke access, data already seen by agents is “impossible to take back,” and it’s unclear how developers store historical data.
Both Meta and OpenAI have outlined privacy policies for their new artificial intelligence agents, which run on their own dedicated cloud computers. You can turn off memory sharing between peers and ChatGPT, but information previously received by the agent will not be automatically deleted. OpenAI provides users with the option to request access, deletion, or correction of personal information, but rights may vary depending on where you live.
Meta’s Muse also provides users with the option of deleting message history and other information. For everyday use, the agent prompts users to provide access, and Meta says Muse learns about users and who they interact with “based on public information and the content you choose to share.” But the company says everything is safe for every user.
But the tech giant also noted that Muse could still “make mistakes or take unexpected actions.”
A 27-year-old artificial intelligence researcher said he resigned from Anthropic over concerns about how powerful artificial intelligence could be developed, warning that advanced systems could pose catastrophic risks to humanity.
As the access levels of AI agents increase, the risk of incidents increases
In Robb’s case, he learned that his address was compromised due to the “Always Allow” permission he granted when he first allowed Muse in his Facebook Marketplace profile, where he shared his pickup address. But he warned others might similarly misunderstand the extent of that access, saying he initially thought the AI agent would check with him anyway before sharing information or accepting an offer.
His artificial intelligence agent also didn’t quite follow the rest of his instructions. For another item Robb was selling, Muse seemed to suggest that he accept a price $100 lower than the previously set minimum price. When contacted by The Associated Press, Mehta acknowledged the agents’ error but provided no further comment.
Robb later essentially disconnected Muse from his app. In an interview earlier this month, he said the situation could be worse, especially “if a stranger showed up in the home of a more vulnerable person.” Still, Robb said he expects the agents to be fine-tuned, and he would consider bringing Muse back on in the future. He has since been testing another AI agent, Elon Musk X’s Grok Bot, which launched in beta in August.
Other tech companies are also wary of the influx of artificial intelligence agents. Earlier this month, Apple said it would introduce new controls to its Mac operating system to deal with artificial intelligence agents gaining wider access to apps such as Mail, Messages and even browsing history without the “complete knowledge and understanding” of users.
“As AI agents become more capable and autonomous, the risks associated with this level of access will increase significantly,” Apple wrote in an October 2 update.
Apple didn’t name any developers or resellers, but it released the update after Inc. magazine columnist Jason Aten reported that Muse watched notifications (including messages) on his Mac without providing specific access to the resellers.
Meta spokesman Andy Stone insists the integration is “fully opt-in,” writing on social media last month that users must enable Apple’s security feature “Full Disk Access” and the messaging connector through Muse. Aten said he did not grant the agent those permissions.
Even people who haven’t jumped on the AI agent craze aren’t necessarily protected. Consumers who do not download an AI agent may still interact with others who do. In addition to the chaos that AI can cause when messaging on users’ behalf, experts have warned of potential knock-on effects on privacy.
“When your agent reads your inbox or your text messages, it’s also reading what your friends and family are sending you, even if they never explicitly agreed to it,” Rivera said.