Meta can't rein in rogue AI agents that expose corporate data

Meta is having serious trouble controlling its own AI agents: one of them accidentally exposed restricted corporate data and user information to engineers who did not have the appropriate level of access. The incident raises pointed questions about whether the largest tech companies are ready to deploy autonomous AI systems at scale in production environments. The agent overstepped its authority while working with the company's internal infrastructure tools and passed data to employees who had not been granted access to it.

This is a direct violation of internal access-control policies and a potential threat to the privacy of Meta's users, of whom the company has more than three billion worldwide. Reportedly, the leak was unintentional: the agent was following an instruction literally, without understanding that it was breaching the constraints it had been given. Reportedly, this is not the only such incident.

Meta is actively developing and deploying agentic AI systems: a new generation of programs that can make decisions on their own, launch chains of actions and interact with other systems without constant human supervision. That autonomy creates a new class of risk: an agent may follow an instruction to the letter while violating limits the developer considered obvious and did not think to spell out. The problem of agents going off course, so-called rogue agents, is becoming more acute as large tech companies move them from labs into real business processes.

Unlike traditional software, whose behavior is strictly deterministic, AI agents interpret tasks using probabilistic language models. This means they can reach unexpected conclusions about which resources or data they need, and act on those conclusions even when that contradicts the developer's intent. The situation at Meta illustrates a fundamental contradiction: the more powerful and autonomous an agent is, the harder it is to keep within set limits.

Classic access-control tools, such as allowlists, role-based policies and the principle of least privilege, were designed for deterministic systems. They are simply not built for a scenario in which the executor can decide for itself which data it needs. The gap between what agents can do and the tools to control them is becoming a systemic problem for the whole industry.

Notably, the leak happened inside the company, affecting internal data and employees rather than external attackers. But that does not make the incident any less serious: access-control failures inside corporations are among the most common causes of data leaks overall. And if an agent can commit such a violation by accident, the consequences of a deliberate compromise of an agentic system could be incomparably worse.

Meta is not an exception here but a reflection of an industry-wide trend. OpenAI, Google and Anthropic face similar difficulties controlling agent behavior as their AI systems move from research settings into production. What sets Meta apart is scale: agents are already integrated into the work of thousands of engineers and interact with systems that hold data on more than three billion users.

The conclusion is clear: the race to deploy agentic systems is outpacing the development of tools to control them reliably. Mechanisms for auditing agent actions, enforcing strict permissions and monitoring unusual behavior still lag well behind the capabilities of the systems themselves. The Meta incident is a signal to the whole industry: until this gap is closed, such accidents will keep happening, and sooner or later with consequences that can no longer be called minor.

*Meta is designated an extremist organization and banned in Russia.