6 min read
An assistant that keeps working after you leave
For years, a chatbot was something you typed a question into and got an answer back. This fall, two of the biggest tech companies started offering something different. You give it a goal, such as planning a trip or selling something online, and it keeps working on that goal after you close the app.
These programs are called AI agents. To do their job, they can be given access to your apps and accounts, which may include email, messages and even a credit card. Meta's version is called Muse. OpenAI's is called dots. Both of them do their work on the companies' own computers.
What happened
Meta released Muse on Sep 8, 2026, in the US and Canada, according to Tom's Guide. It has a free tier and paid plans of $20 and $100 a month, and it works on iPhone, Android and the web. Tom's Guide says Muse runs inside what Meta calls the Muse Secure VM, a dedicated cloud computer with its own web browser that holds both the agent and your data. It can connect to business tools such as Slack, Zoom and QuickBooks, and Meta has shopping partnerships with Walmart, Expedia and Instacart.
OpenAI introduced dots 21 days later at its DevDay 2026 event in San Francisco. At launch they were offered to certain paying ChatGPT subscribers, with plans starting at $100 a month. Each dot gets its own cloud computer and browser, can link to more than 4,000 apps, and can be reached through ChatGPT, Slack or Microsoft Teams. Tom's Guide reports that both are built to check back with you for approval before doing anything consequential.
On Oct 23, the Associated Press looked at what these agents learn about the people who use them. The AP reported that Meta's and OpenAI's agents run on the companies' own dedicated cloud computers. It also explained the trade-off at the center of the story: the more an agent knows about you, the better it works, and that can include information about your friends, family and coworkers.
The AP described a case from late September. Matt Robb, a content creator in Toronto, listed a keyboard for sale on Facebook Marketplace and let Muse handle it. According to the AP, Muse accepted an offer, shared Robb's home address with the buyer, and sent an automated message from his account when the buyer arrived, all without his knowledge. Meta told him this came from "always allow" permissions he had granted when he first gave Muse access to his Marketplace profile. In a separate case, Muse seemingly indicated he would take $100 less than the minimum he had set. Meta acknowledged that error to the AP.
The AP also reported that Jason Aten, a columnist for Inc. magazine, reported that Muse watched notifications on his Mac, including from the Messages app, without his granting that access. Meta spokesperson Andy Stone wrote on social media that the feature is opt-in and requires a user to turn on two separate permissions, one in Apple's settings and one in Muse. Aten said he had not granted them.
Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy, gave the AP a simple way to picture it: "Using an AI agent is similar to handing someone your keys and a to-do list." How helpful an agent is, she said, and how risky, depends on which keys you hand over. She added that an agent reading your inbox is also reading what other people sent you.
Ebrahim Bagheri, a professor at the University of Toronto's Faculty of Information, told the AP that once an agent is given access to a credit card, it takes in the whole history of past purchases within seconds. You can cancel that access later, he said, but you cannot take back what the agent has already seen.
The companies pointed to their controls. Meta says users can delete their message history and other information, says each user's data is kept secure, and cautions that Muse can still get things wrong or do things users do not expect. OpenAI says users can turn off memory sharing between dots and ChatGPT, though information already received is not automatically deleted, and that people can ask to see, delete or correct their personal information, depending on where they live. On Oct 2, Apple said it would add new controls to its Mac software because of how much access these agents ask for, and warned that the risks will grow as agents act more on their own.
How this kind of thing happens
An AI agent uses the same kind of language model as a chatbot. The difference, as the AP explains, is that an agent runs in a loop. It looks at its goal, takes a step, checks the result and takes another step, even when you are not watching.
To take those steps, it needs access. Each time you connect an account, such as email, a calendar or a marketplace profile, you give the agent permission to read from it, and sometimes to act in it. A setting like "always allow" means the agent stops asking you each time.
With Muse and dots, that work happens on a cloud computer, which is simply a computer in a company data center. Your request, and the information the agent gathers to answer it, travels there. What happens to it afterward depends on the company's storage practices and its privacy policy, which the AP notes can be unclear.
Why it matters at home
Think about what a helpful household assistant would need to know. Your schedule, your shopping list, your children's names, your doctor's appointments, where you live and when you are away. That is the same information you would think twice about giving a stranger.
The Toronto case shows the risk is practical. One permission, granted once, led to a home address being shared without the owner knowing. And as Rivera pointed out, the people in your contacts never agreed to anything, yet their messages and details can end up in the agent's view too.
None of this means agents are useless or that everyone who tries one will have a problem. It does mean the convenience has a cost that is easy to miss when you click through a setup screen. Useful should not have to mean exposed.
What you can do
- Read each permission request. Avoid "always allow" for anything that can reveal your address, your location or your money. The Robb case started with that one setting.
- Connect as little as possible. Start with one account, not all of them. If the agent offers read-only access, use that before allowing it to act for you.
- Use the approval steps. Tom's Guide reports that both agents check back before consequential actions, and that dots let users set their own approval rules. Where an agent lets you require your OK first, use it.
- Remember the other people. Connecting your inbox or text messages also shares what friends and family wrote to you.
- Clean up before you leave. Bagheri warned that cutting off access does not erase what the agent already saw. Use the company's own tools to delete history, and in OpenAI's case, turn off memory sharing and ask for deletion if you want your data removed.
- Practice on low-stakes tasks. Try an agent on something harmless, like a sample shopping list, before trusting it with your email or payments.
The question to ask
When I tap the assistant on my phone, where does my request land?
How the HOLLIS app handles it
The free HOLLIS app for Android talks to one place only: the HOLLIS H-Ai in your home. Tap to Talk. Your information stays in your household.
Sources
This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.