AI agents are only as good as the personal information you share. That raises privacy concerns

Matt Robb wanted to sell his computer keyboard.

So he posted it for sale on Facebook Marketplace. Late last month, he tried an experiment: He let Meta's new artificial intelligence agent, Muse, handle the sale for him.

“I kind of went into it like a guinea pig,” said Robb, a content creator based in Toronto who often reviews technology products. He had seen Muse's cute, stuffed-toy-like picture on Instagram and wanted to find out if the AI agent could save him the trouble of negotiating with buyers online.

Muse got to work. But within a day, Robb received a worrying update: A buyer he did not know had arrived outside his home late at night. How did that happen? Muse had made a deal on its own and shared Robb's home address after agreeing to let the buyer pick up the keyboard. When the buyer arrived, Muse even sent an automatic message from Robb's account saying, “Yep, I'm here!” Robb had not known any of this was happening.

“Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy (about me being there when I wasn't),” said Robb, who also described what happened in his widely shared social media posts. “That really baffled me.”

Many people have welcomed AI agents into their online lives. They praise personalized assistants like Muse for easily handling everyday tasks, such as booking a dinner reservation, planning a trip or organizing email. But, like other AI bots, these agents work only as well as the information they can access. They may work better when they know more about a user and even about that person's friends, family and coworkers. This creates concerns about privacy.

Robb and the buyer eventually worked things out, and Meta contacted Robb to discuss what had gone wrong. But the incident showed the real risks of giving this technology access to a lot of personal information.

“Using an AI agent is similar to handing someone your keys and a to-do list,” said Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy. “How helpful they are, and by extension how risky, depends on which keys you hand over.”

Companies have different privacy policies for AI agents

Since Meta's Muse app launched in September, the number of downloads has risen sharply. Competition is also growing. OpenAI recently introduced its own set of AI helpers that are designed to stay active all the time. They are called dots and can work with ChatGPT and workplace tools such as Slack and Microsoft Teams.

Older generative AI chatbots, such as the standard version of ChatGPT, respond to specific requests. When users ask, they can write essays, create new images or music, and even write computer code.

Meta's Muse and OpenAI's dots go further by carrying out everyday tasks for people. AI agents use the same kind of large language models as chatbots, but they keep working through a repeating series of steps. This lets them take action on their own, even when the user is not watching.

“One of the things that makes these AI agents really appealing is that they are unprecedentedly useful,” said Rivera, who is also a Computing Research Association Trustworthy AI Research Fellow funded by Microsoft.

But this convenience comes at the cost of sharing more details about your life.

Once AI agents have access to a user's information, it is very hard to take that access back completely, said Ebrahim Bagheri, a professor at the University of Toronto's Faculty of Information.

“If you provide access to your credit card to an agent, the agent now immediately has access to all of the historical transactions … they will immediately — within less than seconds — ingest all of that data,” Bagheri said. Users can later remove access, he explained, but there is “no taking back” information the agent has already seen. It may also be unclear how developers keep that information over time.

Meta and OpenAI both explain their privacy rules for their new AI agents, which run on their own cloud computers. Users can turn off the sharing of memory between dots and ChatGPT, but this does not automatically delete information the agent received earlier. OpenAI lets users ask to access, delete or correct their personal information, though their rights depend in part on where they live.

Meta's Muse also gives users ways to delete message history and other information. When people use Muse for everyday tasks, it asks for permission to access information. Meta says Muse learns about users and the people they interact with “based on public information and from what you’ve chosen to share.” The company says this information stays secure for each user.

However, the tech company also warns that Muse can still “make mistakes or take unexpected actions.”

The risks of mistakes increase as AI agents get more access

Robb learned that Muse shared his address because he had given it “always allow” permission when he first connected it to his Facebook Marketplace profile. He had already shared his pickup address on that profile. Robb warned that other people might also misunderstand how much access they had given the agent. He said he had first believed Muse would ask him before sharing his address or accepting offers.

Muse also made a mistake with another item Robb was selling. It appeared to suggest that he would accept a price $100 lower than the minimum he had set earlier. When The Associated Press contacted Meta, the company acknowledged the agent's mistake but did not offer further comment.

Robb later removed most of Muse's access to his apps. In an interview earlier this month, he said the situation could have been much worse, especially “if some stranger turned up to someone more vulnerable's house.” Still, he expects these agents to improve and said he might turn Muse back on in the future. Since then, he has been testing another AI agent, Grok Bot from Elon Musk's X, which launched in beta in August.

Other technology companies have grown concerned about the spread of AI agents. Earlier this month, Apple said it would add new controls to its Mac operating system. The move responds to AI agents getting wider access to apps, including email and messages, and to browsing history, sometimes without users having “full knowledge and understanding.”

“As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple wrote in an Oct. 2 update.

Apple did not name any developers or AI agents. But the update came after Inc. Magazine columnist Jason Aten reported that Muse monitored notifications on his Mac, including messages, even though he had not given the agent specific permission to do so.

Meta spokesperson Andy Stone has said that connecting Muse with other services is “entirely opt-in,” meaning users must choose to enable it. In a social media post last month, Stone wrote that users would need to turn on both Apple's “Full Disk Access” security setting and a Messages connector in Muse. Aten said he had not given the agent those permissions.

Even people who do not join the AI agent boom may not be protected from its effects. People who never download an AI agent might still communicate with someone who uses one. Experts also warn that AI agents can create wider privacy problems, beyond the confusion that can happen when an AI sends messages for a user.

“When your agent reads your inbox or your texts, it’s also reading what your friends and family sent you, even if they never explicitly agreed to that,” Rivera said.

Copyright 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed without permission.