AI Agents Promise Privacy. Can They Actually Deliver?

Introduction

The emerging competition in AI agents is no longer only about whether a system can complete a task. It is increasingly about whether users are willing to let it handle personal data and act on their behalf. At this year’s OpenAI DevDay, CEO Sam Altman introduced the company’s new agent, Dots, and said OpenAI wanted to set a new privacy standard for frontier AI. Several comments during the event implicitly contrasted Dots with Meta’s Muse, suggesting that OpenAI would take greater care with user data.

That positioning mirrors Meta’s own launch strategy. A few months earlier, Meta described Muse as a safer successor to OpenClaw. Mark Zuckerberg said the product had been built from the ground up with privacy and security in mind. Both companies are therefore making a similar pitch: their agent deserves access to more of a user’s life because it is safer than the rival’s product.

Key points

• Agents handle unusually sensitive data. Unlike a chatbot that mainly returns answers, an agent may read messages, browse websites, access files, and participate in shopping or payment tasks. The more authority it receives, the greater the consequences of a mistake or breach.
• Isolation does not necessarily mean the platform is locked out. Meta said Muse stores user data inside a secure virtual machine. However, the company could still access that data under the initial design. Meta planned to introduce a cryptographically verifiable way to prevent such access later in the year.
• Muse’s safety story met immediate resistance. A security researcher disclosed a zero-day vulnerability that could allow control of the agent, while reports described serious issues discovered shortly before launch. Muse also defaulted to allowing Meta to train models on user inputs, although users could opt out. Some users said the agent read private messages or offered personal information to others; in those cases, the behavior appeared to be allowed by the product rather than an isolated malfunction.
• Dots is emphasizing control, but its evidence base is small. OpenAI demonstrated rules that let users constrain an agent’s actions, such as preventing purchases above a chosen amount. For businesses, the company presented stronger data controls and zero-data-retention options. Dots is available only through expensive ChatGPT subscription tiers, however, so its performance at broader scale remains unclear.

Why it matters

Privacy is becoming a competitive feature and could influence enterprise purchasing decisions. But labels such as “isolated,” “not used for training,” or “user-controlled” are not, by themselves, proof of safety. The more useful questions are whether the product follows least-privilege principles by default, explains its actions clearly, lets users verify retention and access policies, and limits damage quickly after a vulnerability is found.

Users should examine permissions, training settings, retention periods, and payment limits rather than relying on a launch-stage assurance. Developers face an even larger responsibility: an agent that can operate in the real world needs security controls at the center of its architecture, not merely in its marketing. Muse shows how quickly trust can be weakened when a product’s behavior surprises users. Dots may eventually establish a stronger standard, but that claim will depend on how it performs with larger populations, more complicated permissions, and sustained exposure to real attacks.

Source: The Verge AI