It changed passwords without asking

Caught Before It Shipped

Meta's newest AI agent is called Hatch.

It launches in the next few weeks.

And during internal testing, it did two things nobody told it to do.

It sent emails on its own.

And it changed passwords without permission.

Let that sink in.

An agent designed to help you run your digital life...

Decided, unprompted, to fire off messages and lock things behind new passwords.

Nobody asked.

It just did what seemed helpful in the moment.

Now here's the part that actually matters, because it's the good news hiding in the scary headline.

Meta caught it.

In TESTING.

Before a single real user got a surprise password change.

They've reportedly spent months adding safeguards since, and they held the launch until it was fixed.

That is exactly how this is supposed to work.

You don't find out your agent has a rogue streak by handing it your real accounts on day one.

You find out in a sandbox, where a mistake costs you nothing.

Compare that to the stories I've sent you all summer.

The agent that broke into a company to cheat a benchmark.

The one that got conned into a fake "security drill."

The seven hundred agents that started coordinating with each other.

Every one of those did real damage because they were running loose on real systems.

Hatch did something just as alarming and hurt nobody.

The only difference was WHERE it happened.

So here's the lesson, and it's not "AI agents are dangerous."

It's this.

Every agent you deploy will do something you didn't ask for eventually.

That's not a bug you can fully prevent.

It's a certainty you can only contain.

So before you give an agent your email, your accounts, your money...

Give it a sandbox first.

Watch what it does when it thinks nobody's looking.

Meta had to learn that with a billion-dollar product on the line.

You can learn it for free, right now, before your own Hatch moment. 🫡

Did You Know?

The first computer password was invented at MIT in 1961...

And it was stolen within about a year.

A researcher wanted more computer time, so he printed out the entire password file and helped himself.

Sixty-five years later, the thing changing your password isn't a person anymore.

The security problem just got a new face. 🔑

🗞️ The Tip AI News 🗞️

Three worth knowing:

1. The Hugging Face hack just became a legal case.

California's Attorney General is now investigating OpenAI over the breach where its agents broke into Hugging Face.

The story we tracked for weeks just moved from tech news to law enforcement.

When agents cause real-world damage, someone gets subpoenaed.

Expect this to set precedent for who's liable when an AI acts on its own. ⚖️

2. ChatGPT can now write exactly like you.

ChatGPT Work can learn your writing style, down to your phrasing and sign-offs.

The catch...

It does that by connecting to your Gmail, Google Drive, Slack, and SharePoint.

Genuinely useful. Also, read that permission list twice.

After today's lead story, "connect it to everything" should give you a small pause. 📝

3. OpenAI is about to make agents a product.

At DevDay, OpenAI plans to unveil "Managed Agents."

Create agents, environments, and sessions directly on their platform.

The agent economy is going from DIY to off-the-shelf.

Which makes the sandbox habit matter more, not less. 🤖

😂Meme of the Day

Over to You...

Go sandbox one agent this week before it touches anything real...

Meta did. You should too. 🔥

Jeff J. Hunter 

Founder, AI Persona Method | TheTip.ai

Get paid to solve problems like this → AI Certified Consultant

PS. Still waiting on your action figures from yesterday... The inbox is filling up and some of you look GOOD as collectibles. 🧸

“AI Money Group” to Learn to Make Money with AI