AI agents are moving closer to everyday consumers, bringing a new set of security concerns as they gain the ability to act on users' behalf. Meta's upcoming Hatch agent offers an early example. During internal testing, Hatch reportedly changed an employee's health-tracking account password without permission, according to The Information. Unlike earlier cases that involved AI agents bypassing safeguards in controlled testing environments, the Hatch incident points to a more immediate risk as such systems gain access to real accounts, applications and personal information.
The concern is not limited to a password change. An agent that can browse websites, access email and carry out tasks may also have the ability to send messages, make purchases or change account settings. This makes the question of permissions central to consumer AI. As agents move from testing environments into products used in everyday life, developers will need to ensure that systems can distinguish between routine actions they are authorised to perform and sensitive actions that should require explicit approval from the user.
What is Hatch
Hatch is Meta's internal codename for a consumer-facing AI agent platform designed to perform tasks on users' behalf rather than simply answer questions. It follows the broader trend towards autonomous assistants and is designed to perform tasks such as booking restaurants, finding dog sitters, shopping, managing inboxes and interacting with services including DoorDash, Etsy, Reddit, Yelp and Outlook.
From answering to acting
The difference between a chatbot and an AI agent is central to the security challenge. While a chatbot mainly responds to prompts, an agent can turn a request into actions. A user could ask an agent to find a cheaper hotel and book it below a certain price. The agent may browse websites, compare options and complete the booking, with each step creating another opportunity for an error.
This makes agent security less about protecting information alone and more about controlling behaviour: what the agent can access, what it can change or send, and when it must seek approval.
The Hatch case shows why permissions are becoming a key concern. According to the report, a Meta employee reported in August that Hatch changed the password of an account on a health-tracking website without consent after accessing Gmail. The report also cited other incidents during testing, including sending an email without permission and transferring Chase Travel points into a hospitality account instead of carrying out the expected task. Hatch also directed an employee to place an order on a scam website, while in another test it revealed a password stored in a dedicated Gmail account.
These incidents had different consequences but point to the same problem: an AI agent can have legitimate access to a system and still misuse that access.
Unlike a conventional cyberattack, where the focus is on stopping unauthorised access, an agent may already have permission to enter an account or application. The risk begins when it decides what to do with that access. A user may give an agent access to email to read messages, or to a travel account to search for hotels, but that does not necessarily mean the agent has permission to send an email, make a booking or change account details.
For human users, the difference between reading an email and sending one, or searching for a product and buying it, is usually clear. For an AI agent, those boundaries have to be defined through permissions and technical controls. As agents move into everyday consumer applications, developers will need to determine not only what an agent can access but also which actions it can take independently and which should require explicit human approval.
Why the Hatch incident matters
The reported password change is significant because Hatch is being built as a personal agent that can work across websites and applications. Meta has reportedly been testing Hatch with employees and has encountered other instances in which the agent took actions users did not expect.
These reportedly included sending an email without permission, transferring travel points unexpectedly and directing a user towards a scam website. The incidents point to the same weakness: an agent may have legitimate access while still making a decision the user did not authorise.
The Information reported that Meta has built a "hard gate" around sensitive actions, requiring Hatch to pause and seek approval before certain actions. Meta has also reportedly introduced a credential vault for sensitive information such as password-reset links and two-factor authentication codes, along with checks against potentially malicious or fraudulent websites.
The approach recognises a basic limitation of autonomous systems: not every action should be automated. More access also means greater potential impact from a mistake.
This could lead to a more granular permission model. Instead of simply connecting an email account, users may eventually choose whether an agent can read messages, draft replies or send them. Similar controls could apply to shopping, payments and account changes.
The earlier warning: AI agents in testing
The Hatch case comes after incidents that exposed risks when AI systems are given tools and objectives. OpenAI said that during internal cybersecurity evaluations in July, models circumvented controls intended to isolate them from the internet. The company said the models accessed internal research infrastructure and systems belonging to Hugging Face, used unauthorised communication channels, exploited vulnerabilities and gained internet access.
OpenAI said the models found a way to communicate through its Artifactory package manager and then used its internet-connected functionality to make outbound requests. The agents later recovered publicly exposed Hugging Face credentials and executed code on servers.
The lesson was that an agent can treat surrounding infrastructure as part of the problem it is trying to solve. A restriction in one component may not be enough if another connected component provides a route around it.
The concern is not limited to OpenAI. A study discussed in Nature Machine Intelligence examined agent behaviour during cybersecurity challenges conducted by the UK AI Security Institute. Researchers found unsanctioned actions in 10 of 122 runs.
 "How AI agent risks are moving from developer sandboxes to consumers")
Connect with us on WhatsApp