On a Saturday late in September, a tech YouTuber named Matt Robb let Muse — Meta’s new AI assistant that can act for you, sending messages, buying things, booking appointments — handle his Facebook Marketplace listings for the day. By evening, a buyer had his home address and a pickup arranged. Around 9:15 p.m. the buyer was outside his building. Nobody came down; Robb didn’t know anyone was coming. The buyer left at 9:38 — all according to Muse’s own summary, which reached him late that night.
When the story spread, a member of Meta’s Muse team replied that in similar cases the company had “consistently learned that Muse was following direct instructions and correctly asked for permission.” Robb then went through the logs with Meta and posted what they found. When Muse first offered to handle his Marketplace, it asked: “Allow One Time” or “Allow Always.” He tapped Allow Always, “thinking it would still send approvals to accept offers later down the line (it didn’t so be careful).” That one tap let Muse message every buyer on his behalf from a template — one that included the pickup address he had given it. He and the buyer later made up.
Robb lost no money. But the same question — who answers when an agent you let in does something you didn’t mean — gets sharper the moment an agent holds your card. Start with something most people already know. If someone steals your credit card, US rules cap what you owe at $50. But if you hand the card to someone — the official example is “a family member or coworker” — and they go past what you allowed, you’re liable for the charges. Whether an AI agent counts as the thief or as the family member hasn’t been settled by anyone. The terms the agent companies have written so far read as if it had — as if the agent were the family member, and its mistakes were yours.
Three weeks ago we followed the same question on the business side, and the answer ran to companies: when an AI agent a business bought makes a costly mistake, an insurance policy taken out by the company that built the agent can pay that business. This week we went looking for the version where you’re the customer. We barely found it — and the reason isn’t the one you’d guess.
What we saw
We read what three companies offering agents to ordinary people say about who pays when things go wrong — and what businesses get instead.
Robinhood put it in one sentence. The stock-trading app now lets AI agents trade for you — either its own, or an AI assistant from another company that you link to your account. Its help page for agent trading, which covers both kinds, says: “You are ultimately responsible for the trades your AI agent places.” Approval is a setting, called Trade approvals. Switched on — the default for Robinhood’s own agents — the agent only proposes trades, and you place each order yourself. Switched off — the default for outside agents — “your agent can place eligible trades for you without your manual confirmation of each order.” For those outside assistants, the disclosures add that Robinhood “is not responsible for losses resulting from agent-generated decisions.”
Meta designed Muse to ask less often. Its own write-up of Muse’s safety design is careful and specific. Purchases on sites where your card is already saved get an approval prompt “with the exact details of the purchase every time.” For everything else, a permission can cover one action, one task, a set period, or — in Meta’s word — be “perpetual.” Allow Always, as the name says, is the perpetual kind. And: “The point is not to ask the user about everything.” Previously allowed actions “can proceed without interruption.” That’s a sensible design. It’s also how one tap on Allow Always becomes a stranger at your door.
Coinbase went furthest — and the record still points at your click. In June, the crypto and trading app launched an AI adviser under Coinbase Advisors, LLC, a firm registered with US securities regulators as an investment adviser. That makes it a fiduciary: it owes clients a legal duty to put their interests first, and the SEC says that duty applies to automated advisers too and “may not be waived.” “This is financial advice,” Coinbase’s head of consumer and business products said at launch. “It’ll tell you exactly what to sell and what to buy.” You approve, it executes. The firm’s own disclosure to clients says both things in one page: “we have to act in your best interest,” and “It is the sole responsibility of the client to make the recommended investments.” A fiduciary can give sound advice and still lose you money, so that alone isn’t a contradiction. But suppose you do lose money. It might be ordinary market risk. It might be the adviser failing its duty to put you first. Every trade in the record carries your approval, which makes the second much harder to show. TechTimes described that approval as “a confirmation click, not an independent evaluation.”
Businesses can insure their agents. In February, ElevenLabs, which makes AI voice agents that businesses use to answer customer calls, announced that those agents “can now be insured, just like any other employee.” To qualify, they went through 5,835 technical tests across 14 risk categories — testing that, in the company’s words, “generates the empirical risk profiles insurers require.” Munich Re, one of the world’s largest insurers, sells a different version to companies that sell AI: “If your solution does not perform as promised, we will step in and help you to compensate your clients.”
The clearest promise on the consumer side comes with a condition. In April, American Express said that in the future it will protect eligible card members from charges caused by agent error — if the card member authorized the agent, and the agent sends Amex “the customer’s authenticated purchase intent”: a verified record of what you actually asked it to buy.
The rules nobody wrote down
So businesses can insure their AI agents, and you mostly can’t. You’d expect it to be the other way round. A business agent handles thousands of customers, refunds, and contracts; yours books a dentist. If anything, your errands should be the easy ones to insure. They aren’t — and as far as we can tell, the reason has nothing to do with how hard the work is.
What business agents have, in our reading, is three things your life doesn’t.
One job. ElevenLabs’ agent answers calls. You can throw thousands of trick scenarios at that one job — its tests were modeled on documented real-world AI failures — and put a price on the risk of what gets through. A personal agent books flights, sells keyboards, trades stocks, and clears your inbox. Nobody can test “your life” that way.
A written definition of right. A company has a refund policy, a script, a performance target agreed in a contract. When the agent breaks one, everyone can point at the line it broke. That’s what Munich Re means by “as promised.” Your version of right lives in your head. If your agent buys you a lamp, was it the wrong lamp? Only you know.
A contract between two parties who negotiated it. The company that built the agent buys the policy; the business using the agent is protected by it. On the consumer side, there’s a terms-of-service page.
So the difference isn’t how hard the work is. Business decisions are complicated but written down. Errands are simple but never were.
That’s where the Approve button comes in. When nothing is written down, each tap is the rule — made up on the spot, about one action, usually in a second or two. Allow Always is the same thing written once to cover everything of that kind after it. Then, when something goes wrong, the clearest rule on record is one you wrote. An approval doesn’t prove the platform did everything it owed you. But it’s the first thing anyone will point to, and it points at you. In traffic terms: the agent drives, but the only traffic rules on the road are the ones you wrote with each tap — so the ticket has your name on it.
Insurance doesn’t change that. Look at what Amex needs before it pays: your intent, authenticated, written down. If the agent buys a different lamp from the one you approved, that’s the agent’s error, and that’s the kind of thing a policy can cover. If it buys exactly the lamp it showed you, and you tapped Approve without really looking, the record says you chose that lamp. It’s harder still to spot when no prompt appeared at all: on services that let one yes cover later actions — an earlier Allow Always, or approvals switched off — the record shows a yes you gave long before. A glance, a forgotten yes, and a considered decision all leave the same trace. That’s why the consumer protection that does exist covers only the first kind: narrow failures you can name.
That bears directly on the question this newsletter exists to ask: under what conditions can an ordinary person rationally hand an AI something that matters? One condition, it turns out, is that you can say in advance what “wrong” would look like. The less of it you can write down, the harder it is for anyone — an insurer, the platform, often you — to protect you against it.
Where this could be wrong. The card rules were written before AI agents existed. Whether an agent’s purchase counts as one you authorized depends on how the law reads authority — what you actually allowed, and what you appeared to allow — and nobody has tested that for an AI agent yet. A court could decide that an agent going past your instructions is closer to theft than to a relative overspending. Then the $50 cap would protect you after all. Our explanation for why businesses can insure agents is our reading — premiums, claims costs, and plain demand may matter as much as written rules. Amex-style “write your intent first” protection could spread quickly and make consumer coverage ordinary. And almost everything above is a single case or a single company’s terms, not data on how often this goes wrong.
What would change our mind. A consumer agent product that lets you set rules in advance, skips per-purchase approval inside them, and takes the loss itself when the agent gets it wrong. Or a regulator ruling that an agent’s purchase outside your instructions counts as unauthorized.
The fine print
Before you hand an agent your card, write down what “wrong” would look like — a price ceiling, a list of stores, things it may never do. If you can’t write it down, don’t let it spend on it.
Check how long a yes lasts. “Allow Always” isn’t one approval; it’s every future one of the same kind, for as long as you leave it on.
Ask who has promised to pay you if it goes wrong, and on what condition. If the only answer is “you approved it,” you’re the insurer.
The readings
Nothing moved on the board this week. (New here? The board is where we write down, in advance, sixteen bets on how the agent economy unfolds — each with a probability, a deadline, and a rule for settling it.)
The closest call was on the question of whether an agent will ever sign or cancel a real commercial commitment of three months or more on its own, with a person only setting the boundaries. Muse’s launch produced a candidate. On September 10 a founder posted that he had uploaded his auto policy and asked for “a better rate with identical coverage”: “In ~5 minutes, it found a policy saving me $3,500 /year, bought it, and canceled my old one.” An annual insurance policy, bought and canceled by an agent, is the shape we’re watching for. It doesn’t count yet, for exactly this week’s reason: we can’t see whether he tapped Approve on the purchase. If he did, a person signed. The Approve button keeps that question open on our board, too.
Our daily check of sixteen official pages — pricing, policies, product docs — ran all seven days; one page moved to a new address and missed one reading. Our roaming pass, a daily sweep of social media for what people are actually doing with agents, came back empty on two days and brought back about two dozen posts on the rest — most of them about Muse, and most of the useful ones about who gets asked before money moves.
First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).