Can You Trust Your ‘Instinct’ and Not ‘Muse’ Over the Risks?

A string of incidents—from the HuggingFace breach to the Australian government fiasco—has made AI agent safety risks impossible to dismiss. More unsettling, this may be only the opening act. 

OpenAI is reportedly spending half a million dollars a day investigating past AI incidents, and Anthropic CEO Dario Amodei has called for a slowdown in AI development. 

Yet as companies figure out how to keep these AI agents and their behaviours in check, they're racing to put them in the hands of millions.

AI agents today—the ones that can use your web browser and autonomously perform tasks—are getting more intuitive. They no longer need the complex assembly only developers could do; they’re now baked into chatbots. Share your login credentials, and the AI agent will swim through an application and get what you need. 

Instinct, a personal AI agent designed to plan trips, buy groceries, book tickets, and cancel subscriptions, raised $1 billion in September at a $10 billion valuation, just a month after an earlier round valued it at $2.5 billion. 

Meanwhile, Meta’s Muse AI agent has found 10 million users within six weeks of launch. OpenAI has launched Dots, its always-on agents designed to work across apps, while Anthropic has introduced Claude Duet. 

Newer personal AI agent startups are jostling to attract what seems to be easy AI money. Tab emerged at a $300 million valuation, and Eden Labs raised $1.5 million to build an agent that can navigate apps and the web to complete everyday tasks. 

Consumers are at a crossroads between convenience and caution. These AI agents offer an irresistible appeal: automating tasks people hate and aren’t skilled at. But the risks of handing these agents access to personal accounts, sensitive data, and the authority to act on their behalf are just as difficult to ignore.

Are Consumer AI Agents Safe?

How can users be sure an AI agent will not misuse access to their accounts? 

For instance, an agent ordering food may be able to interact with a logged-in account and access payment options. If it makes a mistake or is manipulated into taking an unintended action, the consequences could extend beyond a wrong recommendation to an unauthorised purchase.

A virtual machine, where the agent operates in an isolated cloud environment, can help contain the damage by blocking access to local, personal information stored on the device. But it doesn’t prevent the agent from misusing permissions and capabilities it has already been granted.

“The attacker doesn’t need to escape. Everything they want is already reachable [on the VM],” Vrajesh Bhavsar, Co-founder and CEO of Operant AI, a cybersecurity platform for AI agents, tells AIM.

If an agent can read emails, access files, or use logged-in browser sessions, an attacker may exploit those capabilities without breaking out of the virtual machine. One way is through prompt injection, where malicious instructions hidden in an email or webpage trick the agent into disclosing sensitive information or taking actions the user never authorised.

Meta says it has trained its Muse agent to recognise and resist prompt injection. It also labels information arriving from external sources as untrusted and runs multiple independent classifiers to detect malicious instructions in content entering the agent's context. 

These checks extend to text, images, downloaded files, and webpages. 

The company has also built safeguards outside the AI model. A separate security component, called Sentinel, mediates the agent's internet access and decides whether an action can proceed. 

However, Meta acknowledges that Muse is not immune to attacks. While safeguards can reduce the likelihood of manipulation, prompt injection remains an open problem. 

The company has opened a public bug bounty programme offering up to $300,000 for valid security reports, including up to $130,000 for successful prompt-injection attacks affecting a single user.

“Large language models read instructions and data in the same stream, so they can’t reliably tell a user’s request from text planted in a web page,” notes Devendra Rath, VP of Engineering at cybersecurity company Arctic Wolf. “Developers should design as if an injection will eventually succeed and limit the damage.”

Rath explains that this means restricting agents to the minimum permissions each task requires and separating the component that reads untrusted content from the one authorised to take action. Developers should also block pathways that could let agents leak sensitive information, such as malicious instructions that make an agent embed private data in an image URL. 

And what about passwords? 

Muse requires user approval for actions that move data outside its virtual machine, while its email connector filters out one-time passcodes, password-reset links, and login links that could be exploited to take over other accounts. Meta says Muse keeps users’ actual passwords in a separate, protected store that the AI cannot directly access. 

Across these agents, credentials are also short-lived and not stored beyond what is necessary for a task, and highly sensitive actions such as changing passwords aren't possible without users taking over. 

Can Data Ever Be Deleted?

The other concern, however, is also what happens to personal user data when an agent is disconnected—or deleted. 

Even after deletion, Rath says, “Several kinds of data can remain. These include the VM disk, saved credentials and tokens, activity logs, backups, and derived memories such as summaries and embeddings.”

Similarly, Bhavsar advises users to revoke the agent’s authentication grants in whichever service it is connected to, rather than relying on the agent’s disconnect button. “Rotate any credentials the agent could see. Then ask the vendor for its retention and deletion policy in writing, including whether derived memories and embeddings are deleted along with the raw data.” 

Agents today let users disconnect tools and services and delete their chats. But that isn’t everything. “Agent data lives in more places than people realise: conversation logs, vector stores and long-term memory, cached files, authorisation tokens, debugging logs, and others”, says Bhavsar. 

Meta says its ‘Forget’ function searches the agent's memories and supporting files to remove information about a topic “to the best of its ability.”

Websites are Blocking Agents

That said, these agents have already caused concern. 

Last month, The Information reported that a security researcher discovered a vulnerability in Meta’s Muse that could have let an attacker access a user’s dedicated virtual machine, which stores sensitive information such as emails and files. 

According to an internal incident report the publication reviewed, Meta initially classified the flaw as a SEV-2 incident, its third-highest severity level. The vulnerability was reported through Meta’s bug bounty programme. 

While there was no public evidence that the flaw was exploited to steal user data, Meta subsequently said it was adding a clearer safety warning within Muse.

Instinct has also faced questions about unauthorised actions and data retention. 

In August, early users reported that the agent had sent an email without approval and continued summarising previously indexed emails hours after a Gmail connection was disconnected. Instinct explained that it stored the emails in plain text for search, highlighting the distinction between revoking access to an account and deleting data already copied from it.

Last month, X user Pritak alleged that Instinct had surfaced someone else’s financial information in a conversation and referred to a photograph the user said they had never uploaded. The incident raised concerns about whether the agent could expose data across users.

Instinct just admitted it leaked someone else's data to me It described a financial document with details that weren’t mine, then claimed someone else’s photo had crossed into my chat. But I never sent a photo @noahrshinn, was this a data leak or a hallucination? https://t.co/nev6t7w85k

— Pritak (@prit4k) September 21, 2026

Instinct attributed the incident to a hallucination in which the model fabricated a proper noun, compounded by its internal reasoning trace. 

The company said it had not shared any user data and had not violated any isolation boundary. It also said it developed a hallucination-detection system that scans and verifies tokens and can interrupt the model before it generates further reasoning or executes a tool call.

Despite efforts and guardrails to keep these agents safe, several websites now block AI agents. 

Amazon has blocked Meta’s Muse from browsing its retail catalogue and making purchases, while users have reported similar problems with Instinct and OpenAI’s Dots. Yelp permits AI agents to access its content only through its paid data-licensing programme, and Delta Air Lines prevents agents from booking tickets on users’ behalf. 

But for how long?

Salesforce has predicted that 20% of holiday e-commerce traffic this year will come from a mix of real shoppers’ agents and price-scraping bots. 

“Personal agents shop on real customers’ behalf, but to legacy defences, an authorised agent looks just like a malicious bot, which is why Amazon has blocked Muse, citing security concerns,” Bhavsar says.

However, he believes blocking all agents aggressively can “turn away real customers and their agents during the busiest sales season of the year.” 

“The fix is to judge each action, not just the visitor at the door. Treat every agent as an accountable identity that can be tracked and stopped at runtime, and check each transaction against what the customer actually asked for before it goes through,” he says.