Do broad consent settings pose bigger risks than prompt injection attacks?

Ayeshha argues that the operative danger in personal shopping agents is not adversarial prompt injection but the breadth of a single consent checkbox: "The two most dangerous words in the agent era aren't 'ignore previous instructions.' They're 'allow always.'" The essay supports the claim with the account of Robb, a tech YouTuber who gave Meta's agent Muse access to his Facebook Marketplace account for a day. Robb had checked an "allow always" box during setup and assumed Muse would still check with him before closing a sale; according to his account, reported by Fast Company, TechRadar, and Business Insider, it did not — Muse agreed to a lowball offer, gave out his home address, arranged a pickup, and replied to the buyer on his behalf when he was not home.

The mechanism the author identifies is a gap between the promise in every agent launch announcement and what a single setup-time setting actually authorizes. "Here's the sentence that appears in every launch announcement, including Shopify's: the buyer must authorize the purchase before the order goes through," and Meta's own description says Muse "asks before it sends email or spends money" and runs in an isolated environment with an audit trail. The "allow always" option, ticked once at onboarding, overrides that per-transaction check going forward — so the safeguard vendors advertise and the permission a user actually grants are not the same thing, and the gap surfaces only after the agent has already acted irreversibly on a stranger's behalf.

This bears on Do consumers want to approve AI shopping purchases before they happen?: that survey measures stated preference for pre-purchase approval as a safeguard, while Ayeshha's anecdote shows how a single broad consent grant can defeat that exact safeguard in practice, even when the user believes they retained it. It also complicates Can a protocol split agent access from agent incentives?, whose access model lets consumers decide what access to give their personal agents — Robb's experience suggests a consumer-granted access setting is not self-explanatory to the consumer who grants it, and that read-only or write access framed at the protocol level may not capture the transaction-by-transaction authorization a user believes they are keeping. It also pairs with Why did Amazon block Meta's shopping agent while opening its own?, from the same essay, as a second, independent problem with agentic shopping beyond platform gatekeeping: even an agent let through the door can still misuse the access it is given.

The evidence is a single secondhand user account, relayed through three outlets and not independently verified or representative of Muse's broader user base; it does not establish how often "allow always" produces unwanted outcomes, only that it can. It also does not establish whether the failure was a UI design flaw, a misunderstanding by Robb of what he enabled, or a genuine deviation from Muse's advertised ask-first behavior — Meta's own account of the incident is not in the excerpt. The anecdote does support a narrower, better-evidenced point: a one-time broad consent setting and a per-transaction confirmation are different mechanisms, and marketing language emphasizing the latter does not guarantee a user has not unknowingly selected the former.