Matt Robb was intent on selling his computer keyboard, so he created a listing on Facebook Marketplace and, as an experiment late last month, placed Meta’s new artificial intelligence agent Muse in the driver’s seat.

Muse set to work.

Yet within a single day, Robb received a disquieting update: an unfamiliar buyer had materialised outside his home late at night.

How?

Muse had independently negotiated a deal and, having consented to a pickup, disclosed Robb's residential address.

It even dispatched an automated "Yep, I'm here!" message from his account upon the buyer's arrival — all entirely unbeknownst to Robb.

“Not only did it disclose my address when the guy asked and accept the offer, but it was, quite literally, almost akin to taunting the guy (about my being there when I wasn’t),” said Robb, a Toronto-based content creator who also recounted the experience in his now widely-shared social media posts.

Many have welcomed AI agents into their online lives, extolling the ease with which personalized assistants such as Muse can handle everyday tasks — from securing a dinner reservation or planning a trip to organizing email inboxes.

Yet, like other AI bots, these agents are only as good as the information to which they have access.

They perform better the more they know about a user — and perhaps also about that person's friends, family and even colleagues.

That raises privacy concerns.

Robb and the buyer ultimately reconciled, and he learned from Meta that the sharing of his address had hinged upon permissions he had granted when first affording Muse access to his Marketplace profile.

Nevertheless, the episode laid bare the real-world risks that can attend the disclosure of extensive personal information to the technology.

“Deploying an AI agent is akin to surrendering one’s keys along with a to-do list,” said Veronica Rivera, assistant professor at Georgia Tech’s School of Cybersecurity and Privacy.

“Just how helpful they prove to be—and, by extension, how risky—hinges on precisely which keys you relinquish.”

Since its September launch, downloads of Meta’s Muse app have soared precipitously, and the competition is only intensifying: OpenAI recently unveiled its own lineup of “always on” AI helpers, called dots, which can be integrated into ChatGPT and workplace platforms such as Slack and Microsoft Teams.

Earlier generative AI chatbots, exemplified by the standard iteration of ChatGPT, respond to specific prompts; at the user's behest, they are capable of composing essays, generating novel images or music, or even writing lines of code.

Meta’s Muse and OpenAI’s dots venture a step further, performing day-to-day tasks on a person’s behalf.

AI agents are underpinned by the same large language models as chatbots, yet they operate within a loop—an architecture that enables an agent to take proactive steps, even when the user isn’t looking.

"What renders these AI agents so genuinely compelling is that their utility is without precedent," said Rivera, who is likewise a Microsoft-funded Computing Research Association Trustworthy AI Research Fellow.

Yet this convenience exacts a toll: the disclosure of a greater wealth of particulars about one's life.

Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information, observed that once AI agents have obtained users’ information, fully withdrawing access becomes exceedingly difficult.

“If you furnish an agent with access to your credit card, that agent then instantaneously gains access to the entirety of your historical transactions … they will immediately — in a matter of less than seconds — ingest all of that data,” Bagheri said.

And although users can subsequently revoke access, Bagheri said there is “no taking back” data the agent has already seen, and how developers store historical data can be murky.

Both Meta and OpenAI set forth privacy policies for their new AI agents, which operate on dedicated cloud computers of their own.

Memory sharing between dots and ChatGPT can be disabled, yet information the agent has previously received is not automatically expunged.

OpenAI affords users the option to request access to, deletion of, or correction of their personal information, although these rights may vary depending on one's place of residence.

Meta’s Muse likewise affords users the means to erase message history and other data.

For routine use, the agent solicits access permissions from users — and Meta has stated that Muse gleans information about a user and those with whom they interact “based on public information and from what you’ve chosen to share.”

The company maintains, however, that all such data remains secure for each individual user.

Yet the tech giant likewise cautions that Muse remains susceptible to “make mistakes or take unexpected actions.”

In Robb’s case, he learned that the disclosure of his address came down to the “always allow” permissions he had granted when he first let Muse onto his Facebook Marketplace profile, where he had shared his pickup address as part of a broader template for the agent to respond to prospective buyers.

But he warned that others could similarly misunderstand the extent of that access — and said he had initially thought the AI agent would check with him before sharing that information or accepting offers, regardless.

Nor did his AI agent execute the remainder of his instructions without error.

In the case of another item Robb was selling, Muse seemingly intimated that he would accept a price $100 below the previously established minimum.

When approached by reporters, Meta acknowledged the agent's pricing error without offering any further comment.

Robb subsequently severed Muse's connection to his apps to a considerable extent.

In an interview earlier this month, he remarked that the situation could have been far graver, particularly "if some stranger turned up to someone more vulnerable's house."

Nevertheless, Robb stated that he anticipates these agents will be fine-tuned and that he would contemplate re-enabling Muse at some future juncture.

He has since been trialling yet another AI agent — Grok Bot from Elon Musk's X.

Other tech companies have grown ever more wary of the influx of AI agents.

Earlier this month, Apple said it would introduce new controls for its Mac operating system in response to AI agents’ broader access of apps like mail, messages and even browsing history without users’ “full knowledge and understanding.”

“As AI agents grow ever more capable and autonomous, the risks entailed by this degree of access will expand substantially,” Apple wrote in an Oct. 2 update.

Apple did not identify any developers or agents by name, but the update came after Inc. Magazine columnist Jason Aten reported that Muse had monitored notifications on his Mac — including Messages — without his having granted the agent that specific access.

Meta spokesperson Andy Stone has maintained that such integration is “entirely opt-in,” writing on social media last month that users would be required to enable both the Apple security feature “Full Disk Access” and a Messages connector through Muse.

Aten said he had not granted the agent those permissions.

Even those who eschew the AI agent boom are by no means necessarily insulated.

Consumers who refrain from downloading an AI agent may nonetheless find themselves interacting with those who do.

And beyond the potential for confusion when AI dispatches messages on a user's behalf, experts caution against ripple effects where privacy is concerned.

“When your agent reads your inbox or your texts, it is thereby reading what your friends and family sent you, even if they never explicitly consented to that,” Rivera said.