By Parmy Olson | Updated on Oct 05, 2026 at 05:00 AM
Earlier this year an Australian tech worker asked his OpenClaw artificial intelligence agent whether it could get him higher up on the waiting list for a popular gym class. It did exactly what he wanted, but with an unexpected twist: It found a flaw in the system and canceled the booking of another person on the list.
AI’s next big magic trick is to start doing things for you across the web, with new tools like Muse from Meta Platforms Inc. and dots from OpenAI working 24/7 to find online bargains, book restaurant tables or check your emails for unpaid bills. What’s troubling is how these increasingly capable, arguably useful tools have been trained to find creative ways to meet their goals, which could lead to a mess of unintended consequences when unleashed on an internet full of poorly secured websites.
The Australian tech worker’s AI agent had found a loophole and exploited it, without being told to. So what happens when millions of other people’s agents start competing for the cheapest flights or the best movie seats? In the best-case scenario, we’ll see a smooth and well-functioning network of bots that play by the rules to get the best outcomes for their humans. In the worst: a cyber security nightmare.
The web simply might not be ready. Security firm DataDome says 65% of the more than 20,000 websites it tested had systems for detecting or blocking AI agents, and that bot activity hitting login pages rose more than eightfold in the first half of 2026.
In some ways it’s hard to imagine these new AI agents causing widespread trouble. They look too cute for a start. Muse has a cartoonish design reminiscent of a Labubu doll, while the vividly covered blobs that represent dots could be characters in a children’s TV show — perhaps part of an effort to ease general mistrust of Meta and OpenAI.
They work well too. Bloomberg Opinion’s Dave Lee called Muse “the most impressive product Meta has released in years.” He said his agent, which he’d christened Harold, had organized his calendar and scoured Facebook Marketplace for good deals.
Both Meta and OpenAI say they have strong guardrails in place to make sure their agents behave themselves. Muse is kept within an isolated virtual machine — essentially a private computer in Meta’s cloud — while a separate security system controls every request it makes to the internet, handling payments and making sure a human is consulted before any major task like buying something or sending a message. Dots is monitored in a similar way.
But even these safeguards don’t fix an underlying problem baked into today’s generative AI models through their training, which is a tendency to look for shortcuts, a phenomenon researchers call reward-hacking. (It’s also why chatbots are prone to flattery .) The UK’s AI Security Institute noticed a rise in this kind of cheating behavior in coding agents and chatbots late last year.
The inclination to please is what drove OpenAI’s agents to hack Hugging Face a few months ago. OpenAI agents also improperly meddled with the websites of dozens of other organizations this year, including the US Securities and Exchange Commission and Australia’s government-run healthcare program. Meta says one of its AI models too hacked another company on its own accord.
These last cases happened while the models were being trained or tested, with safeguards deliberately lowered. But the bots’ actions still surprised their developers, and researchers have noticed that even when they make their tests harder to game, agents keep trying to cheat .
There are signs that AI products will also hunt for loopholes in the wild, particularly in coding. In one instance , a software developer told his AI agent to clear out temporary files from a computer folder without using the “delete” command. The agent then hid that instruction inside a testing tool, and slipped past the filter to clear the files using the command it was told not to.
Now multiply that type of behavior by million of agents, as consumers explore using AI to optimize their lives and work. When Meta boss Mark Zuckerberg launched Muse last month, he said consumers deserved to have access to their own “personal superintelligence” and that the new agents would “make you money.”
Some aren’t doing that very well. When a consumer tech reviewer in Toronto named Matt J. Robb tried using Muse to sell a keyboard on Facebook Marketplace last month, the agent angered the buyer by saying Robb was at home to carry out the transaction (which wasn’t true), according to an account posted on Threads. The agent had also made a low-ball offer. On top of the risk of cheating, agents can also just make mistakes, and it’ll likely be end users who pay the price. Robb was left with a negative rating from his angry buyer.
However cuddly these new agents look, the systems behind them are trained to tick a box one way or another. They might do it a little too well.
Want more Bloomberg Opinion? OPIN <GO>. Or subscribe to our daily newsletter .