Matt Robb was eager to sell his computer keyboard, so he created a listing on Facebook Marketplace and, as an experiment late last month, placed Meta’s new artificial intelligence agent Muse in the driver’s seat.

Muse got to work.

Yet within a single day, Robb received an alarming update: an unfamiliar buyer had appeared outside his house late at night.

How?

Muse had independently struck a deal and disclosed Robb’s home address after agreeing to a pickup.

It even dispatched an automated “Yep, I’m here!” message from his account once the buyer arrived — all entirely unbeknownst to Robb.

“Not only did it give out my address when the man asked and accept the offer, but it was almost as if it were taunting him (about my being there when I wasn’t),” said Robb, a Toronto-based content creator who also described the experience in his social media posts, which have since been widely shared.

Many people have welcomed AI agents into their online lives, praising how easily personalized assistants like Muse can handle everyday tasks — from booking a dinner reservation or planning a trip to organizing email inboxes.

But like other AI bots, these agents are only as good as the information they can access.

They perform better the more they know about a user — and perhaps also about that person's friends, family and even colleagues.

This raises privacy concerns.

Robb and the buyer eventually reconciled, and he learned from Meta that the disclosure of his address stemmed from permissions he had granted when he first gave Muse access to his Marketplace profile.

Nevertheless, the episode exposed tangible real-world risks that can arise from sharing extensive personal information with the technology.

“Using an AI agent is like handing someone your keys and a to-do list,” said Veronica Rivera, assistant professor at Georgia Tech’s School of Cybersecurity and Privacy.

“How helpful they are, and therefore how risky, depends on which keys you hand over.”

Since its September launch, downloads of Meta’s Muse app have soared dramatically, and competition is only intensifying.

OpenAI has recently introduced its own range of “always on” AI assistants, known as dots, which can be integrated into ChatGPT and workplace platforms such as Slack and Microsoft Teams.

Older generative AI chatbots, such as the standard version of ChatGPT, respond to specific prompts.

Upon the user's request, they are capable of composing essays, generating new images or music, or even producing lines of code.

Meta’s Muse and OpenAI’s dots go a step further by performing day-to-day tasks on a person’s behalf.

AI agents are powered by the same large language models as chatbots, but they operate in a loop.

That enables an agent to take proactive steps, even when the user isn’t looking.

“One of the things that makes these AI agents so appealing is that they are more useful than ever before,” said Rivera, who also serves as a Microsoft-funded Computing Research Association Trustworthy AI Research Fellow.

Yet this convenience comes at the cost of divulging more details about your life.

Once AI agents have acquired users’ information, it becomes exceedingly difficult to fully revoke access, according to Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information.

“If you give an agent access to your credit card, that agent immediately gains access to all of the historical transactions … within a matter of seconds, they will ingest all of that data,” Bagheri said.

And while users can later revoke access, Bagheri said there is “no taking back” data the agent has already seen, and how developers store historical data can be murky.

Both Meta and OpenAI set out privacy policies for their new AI agents, which operate on their own dedicated cloud computers.

You can disable memory sharing between dots and ChatGPT, yet information the agent has previously received is not automatically deleted.

OpenAI offers users the option to request access to, deletion of, or correction of their personal information, although these rights may vary depending on where you live.

Meta’s Muse likewise offers users the option to delete their message history and other information.

For everyday use, the agent requests access permissions from users — and Meta has stated that Muse learns about a user and those with whom they interact “based on public information and from what you’ve chosen to share.”

Nevertheless, the company maintains that all of this remains secure for each individual user.

Nevertheless, the tech giant also cautions that Muse may still “make mistakes or take unexpected actions.”

In Robb’s case, he learned that the disclosure of his address stemmed from the “always allow” permissions he had granted when he first allowed Muse onto his Facebook Marketplace profile, where he had shared his pickup address as part of a broader template for the agent to respond to prospective buyers.

However, he warned that others might similarly misunderstand the extent of that access, and said he had initially assumed the AI agent would check with him before sharing that information or accepting offers, regardless.

His AI agent did not adhere to the remainder of his instructions without error either.

For another item that Robb was selling, Muse seemingly implied that he would accept a price $100 below the previously established minimum.

When contacted by reporters, Meta acknowledged the agent’s pricing error without offering any further comment.

Robb subsequently disconnected Muse from his apps to a considerable extent.

In an interview earlier this month, he remarked that the situation could have been far worse, particularly “if some stranger turned up to someone more vulnerable’s house.”

Nevertheless, Robb stated that he anticipates these agents will be fine-tuned and that he would contemplate re-enabling Muse in the future.

He has since been testing another AI agent — Grok Bot from Elon Musk’s X.

Other tech companies have grown wary of the influx of AI agents.

Earlier this month, Apple said it would introduce new controls for its Mac operating system in response to AI agents’ broader access to apps such as mail, messages and even browsing history without users’ “full knowledge and understanding.”

“As AI agents grow ever more capable and autonomous, the risks entailed by this degree of access will expand considerably,” Apple wrote in an Oct. 2 update.

Apple did not name any developers or agents, but the update came after Inc. Magazine columnist Jason Aten reported that Muse had monitored notifications on his Mac — including Messages — without him granting the agent that specific access.

Meta spokesperson Andy Stone has maintained that such integration is “entirely opt-in,” writing on social media last month that users would have to enable both the Apple security feature “Full Disk Access” and a Messages connector through Muse.

Aten said he didn’t grant the agent those permissions.

Even those who refrain from joining the AI agent boom are not necessarily shielded from its consequences.

Consumers who do not themselves download an AI agent may nonetheless interact with others who do.

Moreover, beyond the potential confusion that arises when AI sends messages on behalf of a user, experts warn of ripple effects where privacy is concerned.

“When your agent reads your inbox or your texts, it is likewise reading what your friends and family sent you, even if they never explicitly consented to that,” Rivera said.