Meta is preparing an agent designed to operate across its users' messaging, calendar and purchasing journey. Each of these perimeters is sensitive on its own. What deserves attention is their combination under a single access, because it produces something that none of the three produces alone.
We have covered agentic commerce and the legal framework being built around it. Here is the same movement at a player that already has a relationship with billions of people.
What the combination produces
Let us take the three perimeters separately.
An agent that reads your messaging knows your relationships, your projects, your conflicts, your commitments. An agent that sees your calendar knows your movements, your appointments, your habits. An agent with access to your payment can commit money.
Brought together, these three accesses enable something new: acting on the basis of what has been understood. A message mentions a birthday, the calendar confirms the date, the agent orders a gift. That is precisely the intended use, and it is genuinely practical.
It is also the configuration that worries security specialists, for a reason we have documented all year.
An agent that reads your messages processes content sent by third parties. Yet we have shown that invisible text in an email is enough to divert what an AI understands from it, with ten successes out of ten attempts. And that an injection reaching persistent memory installs itself over time. An agent that reads external content and can pay brings together exactly the two conditions of a profitable attack: an uncontrolled entry vector and a capacity for financial action.
The question of upstream consent
There is a structural problem that we have raised and that takes its most concrete form here.
A conventional transaction rests on consent given at the moment of the act. With an agent, consent is given upstream, in the form of general rules, sometimes weeks earlier. When the agent buys, there is no act of consent at that precise moment.
Hence the questions we raised: did this purchase fall within the mandate? How can it be proved? And if the agent was manipulated by content it was consulting, who bears the loss?
The work we described — signed authorisations, bounded perimeters, traceability — provides a partial answer. It does not settle the case where the authorisation was valid and the agent was misled.
What sets this deployment apart
Two elements make it different from the cases we have covered.
Scale. This is not a professional tool adopted by technical teams, but a feature liable to reach hundreds of millions of people who did not choose to become users of agents.
The business model. This is the most important point and the least discussed. An agent offered by a company whose revenue comes from advertising operates in a particular situation: it advises purchases, and its publisher is paid by those who want you to buy. This is not an accusation, it is a configuration that needs to be understood.
What to take away
The usefulness is real and it would be absurd to deny it. Many everyday organisational tasks are tedious, low-stakes, and perfectly delegable according to the criteria we proposed in our article on automation.
What deserves scrutiny is the perimeter rather than the function. An agent that organises your calendar is one thing. The same agent that reads your messages and can pay is another, and the difference is not visible in the interface.
The question to ask before granting access remains the one we keep repeating: not what the tool brings you, but what it could reach if it were diverted. On this point, the answer here is particularly broad.