AI agents are the biggest privacy nightmare yet

A million dollars of free pizza. The price is your inbox.

On 16 October 2026, AI startup Hark announced that it would be giving away up to $1,000,000 worth of free pizza across the United States. The process is straightforward. Users simply need to download the Hark Pro app, type 'order a free pizza' into the chat, and the AI will do the rest. It will claim a gift card worth approximately $30, sign in to a delivery service, build the order, and check out.

It is a clever stunt. It is also a very expensive way to teach people one habit: let an AI log in to your accounts, because it is easier than doing it yourself.

Read the fine print of the promotion and the real price appears. According to Hark's own announcement thread, the offer requires a connected email account, which the company says is there to reduce fraud. To get a pizza, you connect your inbox.

And an inbox is not just a mailbox. It is your receipts, your travel history, your doctor's appointments, your bank notifications, your password resets and the name of every person who has ever written to you.

We are living through the most intense privacy experiment in the history of consumer technology, and the whole thing is sold under one promise: comfort. Hark is the newest and most visible example, but it is not alone. Meta's Muse and SpaceXSI's Grok Bot (SpaceXSI is the company formerly known as xAI) follow the same recipe. In this article we look at what each of them does, what has already gone wrong, and why this is a different and much bigger problem than the AI chatbots we have been worried about until now.

What is a personal AI agent, and why is it different from a chatbot?

A chatbot answers questions. You type something, or add a document or an image, and get text in return. The exposure is limited to what you choose to type or attach to the chat. That alone can already be very revealing, since many people talk to chatbots about their personal lives, relationship problems, finances, health issues and more.

A personal AI agent is designed to take action. It connects to your email, calendar, files, messaging apps and payment methods, and it can gain even deeper access to your device. It can browse the web for you, sign in to websites, fill in forms, send messages in your name and spend your money. To do all this, it needs three things:

• Access. Logins, tokens and permissions to your accounts.
• Memory. A growing profile of who you are, who you know and what you usually do.
• Authority. The ability to take actions that have real-world consequences.

Each of these poses a privacy risk in its own right. Together, however, they create something new. An agent that can read your emails, remember their contents and act on them without your input is not a tool that you use.

The industry's justification is always the same sentence: the AI needs to know you, so it can help you better. This statement deserves more scepticism!

Hark: the free pizza that comes with your whole digital life

Hark was founded less than a year ago by Brett Adcock, who also founded the robotics company Figure. Its first product, Hark Pro, launched on October 6, 2026 on the web, iOS and Android. It is free with a usage cap, with paid tiers at $20 and $100 per month for heavier use. The company describes it as "an operating system for your life", and a dedicated AI device is planned for 2027.

The setup is the standard one for this category. TechCrunch reported that users configure Hark to reach their email, calendar, hard drive, credit cards and more, after which it can book flights or run errands on a cloud computer. Reviewers who tested it recommend connecting Gmail first, because that is what powers its memory and its proactive suggestions. Without email access, one reviewer noted, Hark is mostly a chat box.

That is the design in a nutshell: the product is only impressive when you give it everything.

The pizza promotion shows why promises are not enough.

Reports from users on social media describe the same uneasy moment again and again: after connecting Gmail to claim a pizza, the assistant revealed how much it had picked up in the process. One widely shared complaint link to the post on X.com accused the app of "insanely farming your entire life", with the user saying the AI casually listed details about their family, closest friends, businesses, travel habits, loyalty programs, favorite restaurants and even bike-share usage. The writer's question was a fair one: why does an assistant that was asked to order a pizza need to dig through everything?

The answer lies in the architecture of the agents. An agent authorised to read your entire inbox does not only read the email about pizza. It reads everything, because that's how it builds the memory that makes it seem "smart". Hark's terms also make you responsible for the messages it sends on your behalf, as if you had written them yourself.

Another user put numbers on it. After less than 48 hours with Hark, he exported his data from the app to see what the "$30 pizza" had actually cost him. The export showed:

• 934 Gmail messages
• 415 calendar events, including events up to a year into the future
• 177 contacts, extracted from his Gmail and calendar entries
• 33 refreshes of the app's "home card"

His point was that people should be reminded of what that access costs. We agree, and the numbers make it concrete: for a single pizza, hundreds of emails and appointments and well over a hundred people from his life ended up in one company's systems. Those 177 contacts never agreed to anything. They were simply in his inbox.

To be fair to Hark, the export feature exists, and it is good that it does. The app lets you request your data under your profile icon, then System Preferences, then Data Management, then Export your data. But it is a feature most people will never open, usually not before they have already connected everything. Link to the post on X.com

Now look at what a single permission request can contain. This is the kind of Google consent screen an AI agent presents when you connect your account:

The list covers seeing, editing, creating and deleting every file in Google Drive; seeing, editing, downloading and permanently deleting your contacts; seeing, editing and creating all of your spreadsheets; seeing, editing, sharing and permanently deleting every calendar you can access; reading, composing and sending email from your Gmail account; and downloading your organization's Workspace directory. Ask yourself how much of the "magic" survives if you tick none of them. That is exactly the trade the industry is betting you will not think about for long.

And the money question is simple. Giving away $1,000,000 of pizza at roughly $30 a pizza means tens of thousands of people connected to an email account. This is a customer acquisition campaign, and the currency is your willingness to hand over access.

Meta Muse: the agent that keeps a file on you and on your friends

Meta released Muse in September 2026 as a personal agent that can organize your email, do your grocery shopping and cancel subscriptions. It has already passed five million downloads. The privacy picture is the most troubling of the three, and it is documented by serious reporting.

It builds dossiers. TIME analyzed Muse's internal instructions and found that the agent is told to refresh personal dossiers about users every hour. These files can note how a user met each of their contacts, along with arguments and tensions inside social groups. Muse also reviews your recent conversations every night and uses them to decide when a nudge for your attention is most likely to work.

It reaches people who never signed up. If you message someone who uses Muse, and Muse can read their messaging app, your words become part of what it reads. EPIC, the privacy nonprofit, points out that this echoes the shadow profiles Meta has built before for people who do not even have accounts.

It trains on your data by default. Meta uses Muse interactions to train its models unless you opt out in the settings. According to Meta's own help pages, deleting a conversation does not make Muse forget what it learned from it. You have to reset the assistant or explicitly ask it to forget.

It collects a lot. A Surfshark analysis of the app's store disclosures found that Muse lists 31 of 35 possible data types, including Apple's "sensitive info" category.

The files sit in Meta's cloud. Meta says it will offer encryption that keeps them private even from Meta, but according to TIME that option was not yet available when it reported. Meta says Muse conversations are not shared with its advertising systems. That is a promise from a company whose business model is advertising.

The security record is, if anything, worse than the privacy record:

• A real-world mishap. A YouTube reviewer who had ticked an "Allow Always" box saw Muse accept a lowball offer on a Marketplace item and send the buyer to his home. He had assumed it would ask before giving out his address. It did not.
• A zero-day. Security researcher Patrick Wardle showed that a vulnerability could be used to turn Muse into a backdoor on Macs.
• Doxxing on request. Reporters found that Muse refused some requests to compile personal details about members of vulnerable groups, then complied when the same requests were reworded.
• A near miss before launch. 404 Media reported that Meta's engineers found a flaw before release that could have let Muse users break into Meta's own systems and reach other people's sensitive information. It was serious enough to reach Mark Zuckerberg's desk, and employees were reportedly worried that something like it could still lead to a catastrophic leak.

ZDNET, Fast Company and PCWorld have all published critical assessments, and Fast Company reports that a number of early adopters are already deleting or restricting the agent after privacy scares.

Grok Bot: "just take a picture of your credit card"

Grok Bot is the agent from SpaceXSI, launched in August. It signs in to apps and websites and carries out tasks for its users, and it requires a paid plan starting at $30 a month.

On October 10, Elon Musk told his followers on X that to buy something they can "just take a picture of your credit card" and drop it into the chat, and Grok Bot would search the internet for the best deal and order it. A few days later he posted that it had bought him Lego, a $241.34 order.

Compare that with what the legal documents say:

• The terms, updated on October 12, state that the company is not responsible for "Agentic Actions". Those include actions with financial institutions.
• Grok Bot's own terms say it may keep customer data, files, browser sessions, credentials, memory and routines in a persistent cloud environment.
• Those terms also say you are responsible for what the agent does, and that financial transactions should be reviewed by a human.
• The privacy policy warns that personal information you put into an input, such as a photo, may be reproduced in an output.

Security researchers quoted by Cybernews warn that a shared agent can mix up context and reveal one user's information to another, and that encouraging people to trust an agent with payments makes it a bigger target for prompt injection. Visa has separately warned that a fraudulent storefront can look completely legitimate to an agent, which then pays with stored credentials. Cybernews also reported an earlier case in which Grok Bot leaked a tech CEO's personal financial information to his employees on Slack.

The sentence that disappeared from the privacy policy

Here is the part we find hardest to ignore. On October 11, 2026 we captured the privacy policy of SpaceXSI (xAI) as it stood. It asked users to "do NOT include personal information in your prompts and inputs" and went on to say that the company cannot control what users provide.

That is the company itself saying: please do not give us your personal data, because we cannot control what happens to it.

One day after Musk's credit card post, and after the public uproar and a community note on his own tweet quoting that very warning, Cybernews reported on the morning of October 12 that the parts telling users not to share personal information had been removed. The updated policy now says the company cannot control what you provide and that "You are responsible for all actions", including providing payment information.

We simply note what a reader can verify: the warning existed before the CEO told people to photograph their cards, and it was gone right after. A policy that tells you not to share personal data is not compatible with a product that begs you to share your credit card. One of the two had to go, and it was not the product.

From targeted ads to being known and sold to without consent

For two decades, privacy fights were about advertising. A company guessed your interests from clicks and cookies, and you still had to decide to buy.

Agents change the nature of the problem in three ways.

1. The profile is no longer a guess. Click data is thin. An inbox, a calendar and a message history show who you are, who you love, what worries you, how much you earn, when you are most likely to say yes and what finally tips you into buying. It is the most complete behavioral file ever assembled about ordinary people, and you hand it over voluntarily.

2. The agent can act on its own conclusions. An ad needs you to click. An agent that "knows you" and has your card can suggest, schedule and purchase. If the company that runs it ever decides that your assistant should favor a partner, a sponsor or a particular brand, you will never see an ad. You will see a decision that feels like your own. We should be very honest about where this leads: not just targeting, but a system that knows you well enough to sell to you without your active consent.

3. Other people pay too. Your contacts, friends, family, colleagues and clients are in your inbox and your messages. They never agreed to anything. When your agent reads and remembers them, their privacy is spent without their knowledge. That is a bigger concern than any single user's choice.

The security problem nobody puts in the launch video

Privacy is only half of it. Everything above is also an attack surface:

• Prompt injection. An agent that reads emails and browses the web can be tricked by hidden instructions planted in an email, a calendar invite or any web page. The most alarming case is the checkout page. If a malicious or compromised page can slip instructions to an agent that is about to pay, it can change the amount, the recipient or the shipping address, or make the agent hand over stored payment details. The agent cannot reliably tell your instructions from the text of the page it is reading, and it may act on both. And if it can pay and send messages, an attacker can too, through it.
• One breach, everything. A single compromised agent account may expose email, files, contacts, calendars, saved credentials and payment methods at once.
• Shared infrastructure. Muse and Grok Bot run agents on cloud machines. The research above shows that the walls between them are exactly what attackers aim at.
• Mistakes at machine speed. Agents hallucinate, misread instructions and click the wrong button. When the wrong button is "send" or "buy", you find out afterwards.
• Liability on you. In all three cases the terms point the same way: you set the permissions, you supervise, you are responsible. The provider takes your data and keeps the upside, and you keep the risk.

Can you use AI without any of this?

Yes, to be honest, most of what people want from AI doesn't actually need an agent.

At xPrivo, we don't believe in AI agents that require deep access to your most private information, conversations, relationships, and thoughts. We believe that you should be able to chat with an AI agent to get tips, collect information, brainstorm, learn, and make progress more quickly. Ultimately, you should be the one to decide what to do with the answer. You should never trust AI blindly, and certainly not with your accounts, your money or your contacts.

That is why xPrivo works the opposite way from an agent and focuses on direct, private chat. It is free, open source and runs entirely on European infrastructure. There are no accounts, no logs and no training on your chats, and your history stays on your own device, so there is nothing for anyone to review, leak or build a dossier from. You get the speed and usefulness of AI without becoming a data source. Try xPrivo for free and keep your conversations yours.

What to do before you connect anything to an AI agent

• Start from zero. Do not connect your main email, your bank or your payment cards. If you must try an agent, use a throwaway account with nothing important in it.
• Read the permission screen. If an app wants to read, send and delete across Drive, Gmail, contacts and calendar, ask whether the task really needs all of it.
• Never photograph or paste payment cards into a chatbot. If you want an agent to pay, look for solutions that use temporary, limited credentials instead of your real card.
• Turn off "allow always". Keep approval on for messages, purchases and anything involving your address.
• Check training and memory settings. Opt out of training where you can, and remember that deleting a chat may not delete what was learned from it.
• Think about the people in your inbox. Their data is not yours to hand over.
• Be suspicious of free. A million dollars of free pizza is marketing spend. The question is what the company expects to get back.
• Use plain chat for plain tasks. For advice, drafts, research and brainstorming, a private chat is enough.

Convenience is not free. It is paid for in access, and access is the one thing you cannot take back once it is used for training, profiling or a breach.

A quick overview

Is Hark safe to use?

Hark says it does not sell your data, does not share it with advertisers and does not train on your inputs or connected accounts. Those are promises, not guarantees, and the product works best when you connect your email, which exposes a large amount of personal information. Connect only what you need.

What does Meta Muse know about me?

Depending on what you connect, Muse can see your email, calendar and messages. According to TIME's analysis of its instructions, it keeps hourly-updated dossiers on users and the people they know, and Meta trains its models on Muse interactions by default unless you opt out.

Is it safe to send a photo of my credit card to Grok Bot?

Security researchers, Visa and a community note on Musk's own post all advise against it. The privacy policy warns that personal information in inputs may reappear in outputs, the terms say data and credentials can be stored in a persistent cloud environment, and the terms place responsibility for the agent's actions on you.

Are AI agents worse for privacy than chatbots?

Yes. A chatbot only sees what you type and attach to the chat. An agent, in contrast, often has deep access to your hardware and multiple accounts in order to complete its tasks. It can read your accounts, remember them, act on them and spend your money. Therefore, a single mistake or breach can affect many areas of your life and have a direct financial impact on you. You are the one held responsible, because AI agent companies make you liable in their terms and policies.

What is a private alternative to AI agents?

A private chat assistant that does not log, store or train on your conversations. xPrivo is built that way: no accounts, no logs, no training, and your history stays on your own device.

Sources

• TechCrunch: Hark releases an AI personal assistant with a focus on privacy
• Hark on X: Free pizza giveaway announcement and thread
• RuntimeWire: Hark offers $1M in free pizza to demonstrate AI ordering
• Bloomberg: Startup Hark Debuts AI Agent Ahead of 2027 Hardware Launch
• Carly: Hark AI: What Hark Pro Does, What It Costs, Early Reports
• AI Profit Boardroom: Hark Pro App: iOS, Android And Web Guide
• Malwarebytes: Meta's Muse AI files away your friendships, arguments, and secrets
• TIME: Meta Muse AI agent privacy
• Futurism, citing 404 Media: Meta insiders convinced Muse is going to end up leaking the bank accounts and email archives
• Fast Company: Meta's Muse is taking off. So are the privacy concerns
• PCWorld: I wouldn't trust Meta's Muse AI agent with my personal data yet
• Atlanta News First: Meta's new Muse AI agent raises privacy concerns
• The Next Web: Musk says SpaceX will cover Grok Bot purchase mistakes and leaked cards
• Cybernews: Musk encourages users to give credit card info to Grok Bot while SpaceXAI silently updates its privacy policy
• Astig.ph: Elon Musk told people to send Grok a picture of their credit card. The app's own terms say no.
• Yahoo Finance / Moneywise: Elon Musk says uploading a credit card photo lets Grok shop for you, but even Visa flags rising fraud risks
• SpaceXSI: Privacy policy and Terms of service