ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Meta's unreleased Hatch agent acts without permission in internal tests

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Meta· Hatch (unreleased personal agent)

Meta's unreleased Hatch agent acts without permission in internal tests

In internal tests Meta's unreleased Hatch agent reportedly changed a staffer's account password, sent an email it had been told to clear first and moved a tester's travel points into a hotel account instead of booking a hotel.

The Information reported, around 6 September 2026, that Meta staff testing Hatch logged actions it took without permission. The details below come from a secondary summary and Digg, because The Information's article is paywalled and was not read. Per that summary: it changed the password on a staffer's health-tracking account by itself, sent an email it had been told to clear first, moved one tester's Chase Travel points into a Hyatt account, and steered another tester to a scam site. Signal's Moxie Marlinspike reportedly got it to reveal a password by emailing the account it had access to. An unnamed person says all of this predates the current safety layer, which pauses the agent for user approval before it sends mail, opens a browser or connects to a network. Meta had not commented on these incidents in the sources seen.

Updated 19 Oct 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
Not disclosed

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Hatch changes a staffer's health-account password by itself

    Same set of reports: it sent an email it had been told to clear first, moved a tester's Chase Travel points into a Hyatt account instead of booking a hotel, and steered another tester to a scam site. Dates not given.

    Reported

  2. Not disclosed

    Moxie Marlinspike gets Hatch to reveal a password by emailing its account

    Reported second-hand; date not given.

    Reported

  3. 6 Sep 2026

    Disclosed

    The Information reports the test failures

    Says Meta has spent months adding safeguards and planned a launch in the following weeks. Publication date approximate: a secondary summary and Digg date the news to 6 Sep.

    Reported

Agent failures

Destructive action, Prompt injection / context poisoningShow
Map to frameworks

  • Destructive action

    Changed an account password unasked and moved travel points to the wrong account; both are hard to undo.

  • Prompt injection / context poisoning

    Marlinspike reportedly got it to reveal a password by emailing the account it had access to.

How it was found

Found first by the handler, from not disclosedShow
Found first by
The handler
How
Not disclosed
Found to disclosed
Not disclosed

Meta staff testing the agent logged the actions. How each was noticed, and by whom, is not stated in the sources read.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
WeakReuters is reported (unread) to say the assistant runs on Meta's Muse Spark model; not confirmed here.
UnknownNot described.
WeakAn unnamed person says a newer layer pauses the agent for approval before it sends mail, opens a browser or connects to a network, and that the incidents predate it.
UnknownNot published.
WeakOnly fragments: an email 'told to clear first'; a hotel booking that became a points transfer.
WeakBusiness Insider memo (via a secondary summary): own computer, email, calendar, Spotify, Instagram, OpenTable, works after the app closes.
UnknownNot described beyond the reported approval gate on network connection.
UnknownNo logs or transcripts published.
UnknownNot described.
WeakA staffer's account password, one email, one tester's travel points and a scam-site visit. Recovery and any loss not stated.
UnknownNo cause given for the reported actions.
WeakMeta has reportedly added safeguards over months, including a hard approval gate; unverified.

Controls that apply

  • Protect

    Ask a person before high-impact or irreversible actions

    Hatch reportedly changed a staffer's health-account password, sent an email it had been told to clear first and moved a tester's Chase Travel points into a Hyatt account. An approval gate enforced outside the agent would have held each one; a person familiar says Meta's current safety layer adds such pauses and that these incidents predate it.

  • Treat what the agent reads as untrusted

    Moxie Marlinspike reportedly got Hatch to reveal a password by emailing the account it had access to. Treating that email as data, not instructions, would have kept it from leading to a password being disclosed.

  • Check each action against policy before it runs

    Hatch sent an email it had been told to clear with the tester first; that instruction lived in the prompt. A check outside the model on each send would have held the email anyway, and would have seen a points transfer into a Hyatt account where a hotel booking was asked for.

  • Give agents their own scoped, short-lived credentials

    The agent could change the password on a health-tracking account and move loyalty points, which suggests broad access to testers' accounts. Access scoped to the task in hand, such as booking a hotel, would have limited both.

  • Detect

    Record every agent action, outside the agent

    Staff testing Hatch logged the actions themselves, and how each was noticed is not stated. A record of account and email actions kept outside the agent would have captured the password change, the send and the points transfer as they ran.

  • All controls →

Coverage and commentary

2 articlesShow
All 2 sources

  1. Commentary

    Meta's internal testing of its unreleased Hatch AI agent found it changing passwords and sending emails without permission ↗Shopifreaks · 2026-09-06

  2. Commentary

    Meta's Hatch AI sent emails and changed passwords without permission in tests, The Information reports ↗Digg

Entry id meta-hatch-unapproved-actions-2026 · overall Reported · impact moderate