Meta's Bot Defense Took OpenAI's Agent for a Robot — and Locked the User Out of Instagram, Facebook and WhatsApp
In September, Meta launched its agent Muse, and weeks later OpenAI responded with Dots for its highest-paying subscribers. But what actually happens when an ordinary user gives these agents real passwords? Mary Randolph's week-long self-experiment in Scientific American provides a detailed first-person picture — including an account lockout in which Meta's own systems flagged OpenAI's agent as a bot and temporarily locked her Instagram, Facebook and WhatsApp accounts, all at once.
The Incident That Defined the Week
Randolph gave OpenAI's agent, called Sam, her Facebook log-in. According to her own account, Meta then sounded the alarm: the company flagged Sam as a bot — something Randolph herself called "fair enough" — and temporarily locked all three of her accounts: Instagram, Facebook and WhatsApp. In other words, Meta's security systems reacted exactly as they are built to do when a log-in behaves unusually.
The incident is worth pausing on. Two of the industry's biggest companies have, within weeks of each other, launched consumer-facing agents meant to act on the user's behalf — and in this case, it was one company's agent that triggered the other company's bot defense.
The Background: Two Launches Weeks Apart
Meta introduced Muse in September 2026. According to Meta's own product description, as relayed by Scientific American, the agent can do far more than chat: it has its own "computer" and can make purchases, send e-mails and fill out forms — provided the user grants it access.
A few weeks later, OpenAI responded with Dots, which the company itself describes as "always-on" agents "built to handle everything," aimed at its highest-paying subscribers. The source establishes the chronology — Muse first in September, Dots a few weeks after — but does not give an exact date for the Dots launch.
The Week in Practice: The Marketplace Success and the Asymmetry
The most concrete success of Randolph's week came from Meta's side. She tasked Muse with shopping on Facebook Marketplace. According to her account, the agent could scan the listings while she did other things, and then handle the responses from sellers on her behalf — with her approval of the message drafts. The result was a dining table purchased via Muse.
But the week also exposed a marked divide in how much access the two agents actually received or accepted. When it came to her bank accounts, Sam said, according to Randolph, that it did not have the capability for things like accessing them. Mark, Meta's agent, by contrast had — in Randolph's formulation — free rein over her e-mail, her bank accounts, her social media and her Spotify.
It is important to stress that this difference is Randolph's observed experience, not a documented product specification. Why the two agents behaved so differently — whether it comes down to product design, the companies' security policies, or third-party platforms' defense mechanisms — the source does not explain. That must remain an open question, and perhaps the most interesting one: An agent that declines bank access as a matter of capability, and an agent given free rein over both bank and e-mail, represent fundamentally different choices about how much trust consumers should be encouraged to give.
What the Researchers Say
Two named researchers frame the findings in the Scientific American article. Nikhil Singh of Dartmouth College points out that the agent technology itself is not new or more advanced than other chatbots. The big societal divide may instead come from the pace and reach of adoption — that is, how quickly and how broadly large numbers of users begin giving agents this kind of access.
Pat Pataranutaporn of the MIT Media Lab zeroes in on Meta's position. According to Scientific American, he describes the launch as an attempt by Meta to break through in AI, with a product that plays to the company's strengths in social media and connection. "And now other companies need to respond," he says, as quoted by the magazine.
Both statements point in the same direction: The technical novelty may be smaller than the package around it. What is actually new is that major platform companies are now deploying agents that expect full access to the user's digital life — in Meta's case, via platforms many people already use daily.
What One Week With One User Cannot Answer
Randolph's experiment is a rarely detailed first-person picture of giving both agents real log-ins, and it is valuable precisely for that reason. But it is one user's experience over one week — not systematic testing. Individual events like the Marketplace purchase and the account lockout document that something is possible or does happen, but say little about how reliably it holds across users, accounts and platforms.
Several big questions remain open. The capability claims rest on the companies' own characterizations, relayed through Scientific American, without independent verification. No one explains why Sam and Mark were given such different access. And the follow-up — what happens when Meta's bot defense meets OpenAI's agent again, or when more users run into the same thing — is undocumented.
What Randolph's week does show, though, is concrete: Consumer agents are here, they can actually complete purchases, and the trust they demand is large enough that one company's security system treats the other company's agent as a threat. The question of who should have free rein over your bank account is therefore no longer hypothetical.
sourceUrls: