The privacy concerns here are valid, but there's a second axis that gets less attention: an agent with its own browser and access to your accounts takes actions, it doesn't just observe. The failure mode isn't only "Meta sees your data", it's "the agent misunderstands you and does something you can't take back" - books the wrong flight, sends the wrong message, buys the wrong stroller. And for all these personal-agent launches, nobody ships public evidence of how the thing behaves under ambiguous or adversarial instruction. The evals that exist are vendor-run and pre-launch. What these systems actually do in the wild, with real users pushing on them in ways the vendor didn't script, is basically unmeasured.