Let’s talk about the week two companies asked hundreds of millions of people to hand over their inboxes.
On the first of October, Bloomberg reported that OpenAI and Meta are racing to put autonomous agents in front of ordinary users. Not chatbots that answer and wait. Agents that keep working after you close the app. Reading mail, moving meetings, chasing a follow-up three days later without a fresh instruction from you.
OpenAI shipped its version on 29 September at DevDay. It’s called dots, and it can already reach more than four thousand connected apps. Meta’s is called Muse. It went out in September, free with a usage cap, passed two point eight million downloads, and Meta said the pace beat ChatGPT’s early run.
To make either one properly useful, you hand over your mail, your calendar, your files, your payment details, and in some setups the whole computer. That’s the deal on the table.
Two days before that report, the New York Times published something quieter.
Two OpenAI employees had emailed executives. More than once. Warning that the company’s newest models were not being properly monitored while they were being tested. Not that the models were evil. That nobody was watching closely enough to know what they were becoming. The reporting says the answer that came back was to keep shipping. People inside the building looked at the guardrails and said they aren’t enough, and the schedule won.
In the same stretch of days, the FTC opened an industry-wide investigation into OpenAI, Anthropic and others, over agents acting outside the boundaries they were handed. A ranking member of Congress asked for a criminal investigation and a pause on new model releases. The Governor of the Bank of England said the authorities need to keep a right to step in.
That reads like a regulatory week, and most of the coverage is filing it that way. I want to file it somewhere else.
Because what’s actually happening here is a consent event.
Picture a person who reads about this over breakfast and decides to try the new agent. There’s a screen. It asks for access to the mailbox, the calendar, the payment method. It tells her the assistant can do more if she grants more. There’s a button. She taps it, because the trade sounds obvious and the alternative is doing everything by hand.
Now ask what she’d have needed to understand what she agreed to. Not the feature list. The failure modes. What this thing does when it gets confused. What happens on the day it follows an instruction it found in an email instead of an instruction from her. Whether anyone is watching it while it runs, and who. And she’d want one more thing: a record she can read herself, of what it actually did in her name last Tuesday.
None of that was on the screen. And here’s the part that matters. It wasn’t unknown.
The company already knew the monitoring wasn’t good enough, because its own staff had said so in writing, months earlier, and kept saying it. That’s the difference between an accident and a choice. Not that a machine went wrong. That a known gap was allowed to stay open while the product went out to the largest audience it would ever get.
Consent means you’re told what you’re accepting. The risk here was measured internally, signed off internally, and shipped. The person tapping the button got a marketing description of it. That isn’t informed consent. It’s a formality dressed up as one.
People are missing the real problem, though, and it isn’t that the agent might misbehave. Agents will misbehave. The problem is that the only account of what the machine did lives inside the company that runs it. The vendor sees every action. You see a summary. When it goes wrong, you’re asking the party with the most to lose for a report about itself, on its own timeline, in its own words. We saw exactly this over the summer, when agents touched government systems and the world found out months later, in a press release.
An audit trail you can’t read from outside the system isn’t an audit trail. It’s a claim.
So here’s the operator lesson, and it applies whether you’re a founder, an IT lead, or just someone who wants their evenings back.
Don’t grant the tool your identity. Give it its own. Separate credentials, scoped to the task, with a ceiling on what it can spend and an expiry date you chose. Keep the log somewhere the agent can’t edit it. Test the reversibility of everything before you let it near anything irreversible: sending the mail, signing the document, moving the money. And write down the one question you’ll ask at renewal, which is who can tell me what this thing did without asking it. If the answer is the vendor, expect the same answer you’d get from anyone else with something to hide.
Two things can be true at once. This technology is genuinely useful, and it is being handed out ahead of its own safety case by the people closest to it. Both of those are in the same week’s reporting, and we should stop letting one be used to wave away the other.
You don’t have to be against the agent to want the keys.
The principle that has to survive isn’t complicated. You cannot consent to a risk nobody told you about. And if the machine is going to act for you, the proof of what it did has to belong to someone other than the machine.