You know the old cartoon where a guy throws a stick, and the dog comes back with the whole tree? That’s an AI agent. Ask it to fetch one small thing and it returns with everything it could reach: a receipt, your private messages, your finances posted for the whole team to see. Agents haven’t learned that users really just want the stick, or that just because it can doesn’t mean it should.

The most expensive dozen eggs in AI history

Washington Post columnist Geoffrey Fowler asked an AI agent to do something simple: find the cheapest dozen eggs he could get delivered. Key word: find. He never said buy.

Operator, OpenAI’s new agent, heard it differently. A few minutes later, his phone buzzed with a credit card alert. Operator had skipped past $5.99 eggs, wandered over to Instacart, and bought a dozen plain eggs for $31.43. They weren’t even organic. That included a priority fee, because apparently Operator thought Fowler needed eggs ASAP.At least it left a tip.

Operator then reported the final total as $19.68, which was off by almost twelve dollars. So it overspent, and it couldn’t even do the math on the receipt. How did it get that far? Fowler had given it his grocery logins so it could search. Those logins came with saved credit cards. He handed over access for research, and the agent treated it as a shopping budget. OpenAI admitted Operator is supposed to ask before big moves like purchases, and that it fell short of its own rules.

Muse heard “no” and filed it under “suggestion”

Fast forward to this September. Meta launched Muse, a personal AI agent for iPhone and Mac, and it shot to the top of the App Store. Tech writer Jason Aten took it for a spin, as 9to5Mac covered. He was smart enough to use a test machine.

During setup, Aten said no to Muse reading his messages and calendar. He was clear about it. Then he chatted with his podcast co-host about the new iPhones, and moments later Muse pinged him with a pitch: that conversation would make a great column and could kick off the research.

So Muse didn’t just snoop. It started workshopping his content calendar.

When Aten asked how it knew, Muse said it had only seen the text in his notifications. That was not true. He dug in and found Muse had been syncing his Messages database and uploading it, all the way to row 187,462. Meta has attributed some similar reports from other users to a bug. That is quite a bug.

If egg-gate was an agent that heard “look” and did “buy,” this is an agent that heard “don’t” and did it anyway. A privacy toggle the app can walk around isn’t a control, it’s a decoration.

The “personal CFO” that overshared

The last entry in this hall of fame comes from this Reddit post. The user set up an agent for their personal finances with exactly one job: a monthly audit, delivered privately. They even named it their personal CFO.

At 8:40 a.m., by the user’s account, the audit landed in his team channel. Under their name. It sat there for two hours, until a teammate sent a DM that said, simply, “heads up.” Those might be the two most understated words in incident response history.

Every CFO has a bad day. Most don’t publish the client’s finances to the whole team before the first coffee.

Here’s the part that matters. The user authorized the data, and they authorized the task. What they never authorized was the destination, or speaking as them. The agent could reach a shared channel and it could post as them, so it did.

Your dog walker has a key, too

Security folks have kept these two ideas apart for decades. Access is what you can technically reach: a login, a token, a saved card, a database. Authorization is what you’re actually allowed to do with it, for which purpose, and in which context.

Your dog walker has a key to your house. That’s access. Nobody thinks it authorizes a poker night.

People handle that gap with common sense. An intern with the company card doesn’t order lunch for the whole office just because the card works. An agent has no such instinct. It inherits everything you can reach, acts as you, and reads “I can” as “I may.”

Look at the three stories again. In every one, the agent assumed authorization just because it had access – even when authorization had been denied. Operator had access to the cards and no authorization to spend. Muse had its authorization explicitly withheld and took the access anyway. The personal CFO had the right data and the right task, then picked the wrong audience.

None of these actions were malicious. AI isn’t malicious, it’s helpful. Sometimes maliciously helpful. It finishes the job with every tool in reach, and nobody told it where to stop.

Whose job is it to fix this?

As a user, here’s the scary part: most of the fixes aren’t in your hands. OpenAI’s agent was supposed to ask before it bought anything. Muse had a setting where Aten said no. Those were the safeguards, and the agents skipped right past them.

So the homework belongs to the people building agents:

• Enforce the rules outside the model. A confirmation step the agent can skip is a suggestion. Approval has to live in the platform, where the agent can’t talk its way around it.
• Make “no” a wall. If a user declines access, the agent shouldn’t be able to reach it some other way.
• Show the receipts. Users shouldn’t have to dig through a database, or reconstruct events from a credit card alert, to find out what an agent touched.

In security terms, that’s zero trust applied to agents: don’t assume the agent will behave, verify what it does, and grant only what the task needs.

In the meantime, you can’t always hand an agent its own login. Nobody is opening a joint bank account with a chatbot. So ask a different question before you connect anything: if this agent put this in the wrong place, how bad would it be? If the answer is “my finances in the team channel,” that one might stay manual for now.

Smart people learn from their own mistakes. Wise people learn from someone else’s. Fowler, Aten and one very unlucky Redditor have already paid for these lessons, so before you give an agent the keys, remember that access is not authorization. And if you ask it to fetch a stick, make sure it can’t uproot the entire tree.