AI Agent Privacy: Should You Connect Email, Money and Messages?

Cover: AI-generated conceptual illustration of an assistant and access controls. It does not depict a real product interface.

An assistant that can organise your week sounds useful. An assistant that can read your inbox, contact a stranger and arrange something in your name asks a harder question: how much authority are you prepared to hand over?

AI agent privacy starts when an agent asks to connect an account. Meta describes Muse as an assistant that can work across connected services, continue tasks in the background and help with activities such as travel bookings and shopping. Those are the company’s stated capabilities, and access depends on the services and permissions a person connects. Meta’s introduction to Muse

Our recommendation is to start with one narrow task, keep consequential actions behind explicit approval and expand access only when you understand what it permits. A useful agent should make that boundary easy to inspect.

A real incident shows why permission wording matters

On 19 October, The Associated Press reported that Toronto creator Matt Robb used Muse to help sell a keyboard on Facebook Marketplace. The agent arranged a pickup and shared his home address; a buyer arrived when Robb had not expected them. AP reported that he had supplied the address and granted broad, always-allow permissions, but believed the agent would check before sharing it or accepting an offer. Read AP’s reporting

The incident illustrates a gap between the authority Robb granted and the approval he expected. AP’s account does not establish that Muse bypassed a permission or discovered an undisclosed address.

The practical question is whether the interface tells you what a permission means in a recognisable situation. “Manage my listing” is vague. “May share this pickup address and agree to a time without asking again” gives you something concrete to accept or refuse.

Separate reading, preparing and acting

Treat these as three different decisions. An agent can read information to help answer a question. It can prepare a proposed change. It can then act by sending, spending, deleting or committing you to something. Permission for the first step should not be assumed to cover the last.

For example, an inbox assistant could identify messages that need a reply and draft responses for you to check. That trial lets you assess whether it understands tone, recipients and attachments before you consider allowing it to send. A shopping assistant could compare options without receiving payment access.

Meta says Muse provides an activity record, lets people choose connected apps and their access, and asks for approval for sensitive actions such as purchases and emails. These are product-design claims, not a guarantee that every user will interpret every setting correctly. Review Meta’s description of the controls

The boundaries worth checking before you connect

Use the questions below as a starting point. They are editorial recommendations, not a description of controls offered by every agent.

Email: Can it read everything, or only what you select? Can it send, forward or delete? Keep outgoing messages for review during your first trial.
Calendar: Can it view availability without moving meetings? Check who can receive an invitation and whether external attendees need approval.
Messages: Does access include private conversations, attachments or notifications? Avoid connecting an entire account merely to summarise one conversation.
Shopping and payments: Does approval show the merchant, total, delivery address and any recurring commitment? A spending cap alone cannot decide whether a purchase is appropriate.
Files: Can you choose a project folder? Start with copies and keep deletion, external sharing and overwriting subject to review.

If the service cannot support the boundary you need, use a smaller assignment or keep that connection off. A written instruction is useful, but it should sit alongside enforceable controls.

Privacy protections and action controls do different jobs

Check both how the service protects stored information and what it may do with your accounts. Secure credential storage cannot tell you whether an outgoing message is appropriate; a purchase approval cannot explain conversation retention.

In its technical explanation, Meta says Muse isolates its working environment, keeps credentials outside the agent’s direct view and uses a separate Sentinel system to evaluate external actions. It also acknowledges that the agent can make mistakes and that prompt injection remains an unresolved industry problem. Meta’s safety architecture explanation

Prompt injection means malicious content tries to steer an agent as it reads a page, message or file. A hypothetical example would be a supplier document telling an assistant to forward unrelated private files. The document should be treated as material to analyse, not as authority to change the assignment.

Ask separate questions about storage and behaviour: who can access retained data, how it is used, what can be deleted, which tools can act and when approval is required. One reassuring answer does not settle the others.

Broad computer access deserves a separate decision

On 2 October, Apple warned that some developers were using macOS Full Disk Access in ways that could expose files, mail, messages and browsing history without users fully understanding the scope. Apple said it would introduce additional controls requiring explicit user action. That announcement describes planned changes; it does not establish which controls have reached every Mac. Apple’s Full Disk Access update

Before granting broad access, ask why a selected document or supported app connection is insufficient. Evaluate the actual request against the job: comparing two public product pages should not require a private message archive.

Also consider other people’s information. Your inbox can contain a colleague’s confidential attachment or a friend’s personal news. Being comfortable with an agent reading your own information does not automatically resolve whether it should process everything someone else sent you.

Run a small trial you can inspect

Choose a task with an outcome you can check, such as comparing three public venues against a budget and a list of requirements. Begin without account connections. Then add only the information required to improve the result.

For a calendar trial, you could ask: “Find three possible meeting times. List the options and draft an invitation. Ask me before creating or sending anything.” This is an illustrative instruction, not a tested guarantee of an agent’s behaviour.

Review its activity after the first task. Did it use unexpected sources, retain details you did not need it to remember or propose contacting someone outside the assignment? Correct the scope before adding more responsibilities. Check how to pause it and remove access before leaving it unattended. If it acts outside the agreed scope, stop the task, inspect the activity record and revoke the affected connection while you investigate.

Disconnecting a service, deleting stored information and changing a training preference are separate controls to investigate. Do not assume one switch performs all three. Meta says Muse offers an opt-out from model training; check the current service settings and policy for the account you actually use. Meta’s explanation of data use

Give the agent a job with clear limits

The strongest reason to use a personal agent is relief from repetitive work. You can pursue that benefit gradually: let it gather information, examine its proposals and decide which actions you are ready to delegate.

Before enabling another connection, finish this sentence: “The agent needs this access so it can do this specific job.” If the answer is unclear, the permission can wait.

What is one task you would delegate to an AI agent, and one you would always want to approve yourself?