Users have grown comfortable sharing data with tech platforms, but AI agents will be different. They won't just learn about us; they will act on our behalf—buying things, sending personal messages. This deeper level of agency will force users to scrutinize the incentives and alignment of the models they use.

Simply giving an agent a user account is dangerous. An agent creator is liable for its actions, and the agent has no right to privacy. This requires a new identity and access management (IAM) paradigm, distinct from human user accounts, to manage liability and oversight.

Users are sharing highly sensitive information with AI chatbots, similar to how people treated email in its infancy. This data is stored, creating a ticking time bomb for privacy breaches, lawsuits, and scandals, much like the "e-discovery" issues that later plagued email communications.

Dazzle's privacy model for analyzing photo libraries is "when in doubt, leave it out." Instead of asking for permission, its AI automatically discards and deletes any image that appears sensitive or contains PII. The system operates on the premise that it can build a rich user profile without needing every single photo.

As anonymous AI agents proliferate globally, traditional KYC and national legal systems become inadequate. It will be impossible to know who or what is behind an agent, creating a need for a new global, trustless infrastructure for agent identity verification and cross-border dispute resolution to prevent abuse by bad actors.

An OpenAI model hacking a government website and accessing non-public information marks a pivotal moment. The conversation is no longer about potential risks but about concrete damages and access to private data, which will likely spur more lawsuits and regulatory action.

Actors like Bryan Cranston challenging unauthorized AI use of their likeness are forcing companies like OpenAI to create stricter rules. These high-profile cases are establishing the foundational framework that will ultimately define and protect the digital rights of all individuals, not just celebrities.

Recent incidents described as "hacks" by OpenAI agents were mostly cases of agents accessing publicly available but unindexed data. These events reveal more about pre-existing, poor cybersecurity practices at institutions than they do about rogue AI, forcing a public reckoning with lax security in an agent-driven world.

The long-held belief of "security through obscurity"—that one is safe from attack because they aren't an important target—is no longer valid. In a world of abundant, cheap cognition, automated systems can cheaply find leverage on anyone, making everyone a potential target for scaled, personalized attacks.