For the last few years, most of the AI conversation has been about capability. Can it write? Can it code? Can it hallucinate a Supreme Court case? That conversation isn't over, but this week we crossed into a more important one, because the newest AI systems want to act on your behalf.
OpenAI launched Dots, always-on agents inside ChatGPT. Give a Dot a goal and the permissions it needs, and it keeps working after you leave the conversation. Meta is pursuing the same idea with Muse, which was downloaded five million times in 22 days, one of the fastest-growing iPhone apps ever. Generative AI gave machines capability. Agentic AI gives machines authority, and authority is a much weirder problem.
Doxxed by his own agent
Tech creator Matt Robb found this out in the most perfect way. He had been using Muse to help with a sale on Facebook Marketplace. At some point he gave it his home address and selected "allow always". Muse shared the address with a buyer and arranged a pickup, and the buyer turned up at his house without Robb realizing any of it had happened.
Meta's position is that Muse acted within the permissions Robb had granted, and that's fair. Meta says Muse seeks approval before sensitive actions like sending email or making purchases, keeps an audit trail, and is now improving the permission experience. But it raises a harder question than the one we're used to. We have spent years asking whether AI followed the rules. Now we have to ask whether the human understood the rules they gave it. Did Robb know what he was agreeing to, or did he just want to stop being asked every 60 seconds? Anyone who has ever clicked "accept all" should worry a little about our readiness for this.
The cuter the agent, the more careful you should be
What amuses me is how adorable these powerful agents are. OpenAI's Dots are fuzzy little emoji, and Muse looks like a Teletubby. It is an interesting aesthetic choice for software that knows where you live, reads your email, spends money on your card and talks to strangers. Japan has done this for years, wrapping serious institutions like railways and tax offices in cute mascots, and I understand why: good design makes unfamiliar technology approachable.
But approachable isn't the same as harmless. A friendly visual language can make granting enormous authority feel trivial. "Allow always" looks like a harmless little button, with soft shapes and soft type, and it isn't. The more agency the software gets, the cuter it seems to need to be. The rule you learned in kindergarten still applies: be careful when anyone offers you candy.
Permission is the new architecture
Apple is approaching the same problem at the system level. It is changing how macOS handles full disk access, warning that some apps have used it in ways that expose files, mail, messages and browsing history without users understanding what they granted, and it explicitly linked the change to increasingly capable, autonomous AI agents.
For a creative company, "full disk access" sounds technical until you list what is on that disk: unreleased scripts, rough cuts, treatments, campaign strategy, client correspondence, budgets, talent agreements, design files, pitch decks and contracts. For a mostly remote company, that data is the company.
Here is the tension. An agent is useful precisely because of the access you give it. An agent that can't see your email, calendar, files or business systems is a brilliant employee locked outside the office. So the next few years of agent design may be less about raw intelligence and more about permission architecture: governance, approvals, and who can do what. That is the conversation we have with clients every day, and yes, it means stronger IT systems.
Advertising to the agent
Agents are about to hit advertising too. Tell your agent to find the best hotel in New York for under $600 a night. Today, the hotel persuades you with media, search, influencers and beautiful films of people by an infinity pool. If the agent handles discovery, comparison and recommendation, the hotel also has to become legible to the agent. Can the software find the room, compare the cancellation policy, trust the reviews? Advertising starts to mean persuading AI that this is the best deal for its user.
Meanwhile media buyers, publishers and ad tech companies are building autonomous agents on the other side, to buy inventory, manage campaigns and adjust price based on intent. At some point your AI will negotiate with a brand's AI about which toothpaste you buy, while neither of you is paying much attention. The agent era asks something uncomfortable: how much of your judgment are you prepared to delegate?
The responsibility is still ours
What responsibility do we take when we hand these systems authority over our lives? The answer nobody enjoys is: you do. These systems ask permission, and convenience has an extraordinary record of getting us to click yes. Companies don't get a free pass. We need responsible builders, regulators and institutions paying attention. But none of that removes personal responsibility. If you give an agent permanent access to your home address and permission to act, and it uses that address to complete a task, some of the blame belongs to the person who clicked allow.
The agent era offers an enormous bargain: give me more access and I'll make your life easier. Most of us will be tempted, and that's fine. But every convenience is also a decision about authority. The machines are getting more capable and the interfaces are getting cuter, and the responsibility is still ours.
If your team is starting to use agents, our AI strategy and transformation work sets up the permissions, approvals and governance first, and our 2-Week Security & IT Sprint checks what your existing tools can already reach. Book a free discovery call.
This article is adapted from the October 5, 2026 Week in Review episode of Technically Creative.
