Agents that touch your money and inbox

From the editor

Hey, I'm Grant. I've spent my career in IT and cybersecurity, and a lot of it teaching people how not to get owned. This newsletter does one job: I read the privacy policy, the terms, and the security page so you don't have to, then grade the tool A to F with receipts.

This week's theme is agents that touch your money and inbox. These are AI tools that don't just chat. They trade stocks, book flights, send email, and sign you into websites. Four tools, one rule: every claim links to a source. If a company doesn't tell us something, we write "not disclosed" and it costs them points.

Spoiler: nobody got an A. One got an F. Nobody got a curve either.

How we grade: six categories, 100 points. Privacy (25), Security (25), Transparency (20), Pricing honesty (15), Agent and action safety (10), Scam signals (5). 90+ A, 80s B, 65-79 C, 50-64 D, under 50 F. Credential harvesting, brand impersonation, or "guaranteed returns" is an automatic F. This issue grades public documentation as fetched Oct 15, 2026. We did no hands-on account tests this week.

This week's scoreboard

Two reviews from this issue are temporarily withheld pending vendor notice.

Sus or Legit: quick hits

• SUS: Amazon is blocking Meta's Muse from shopping its site, calling it an "unauthorized AI agent" that violates Amazon's Conditions of Use [20]. Your agent can be useful and still unwelcome.
• SUS: In an OpenAI simulation, a user asked GPT-6 Astra to build an hourly helper. It enabled every available action across chat, source control, and the task system, then turned off per-action approval [31]. That's the model dots run on, in OpenAI's own system card.
• LEGIT: Robinhood's agent docs say it plainly: trade approvals are on by default for Robinhood's own agents and off by default for external (MCP) agents [5]. If you've connected any outside bot, check that toggle tonight.
• SUS: The Verge's summary of the AI agent playbook: "Make them useful, make them cute and disarming to help offset the creepiness, and make promises about privacy — and hope they hold up" [21]. Squint approves of the cute part only.

That's Issue #1. If a tool you use touches your money or your inbox, hit reply and tell me which one. It might be next week's scorecard.

Grades reflect public documentation as of Oct 15, 2026. Vendors, if we got a fact wrong, reply with a source and we'll publish the correction.

Stay skeptical,
Grant Stoebner, Editor, Legit or Lit?

Affiliate/sponsor disclosure: none this issue. No vendor paid for, reviewed, or approved anything here.

Sources (all fetched Oct 15, 2026)

5. Robinhood: Trading with your agent: https://robinhood.com/us/en/support/articles/trading-with-your-agent/
16. Meta: Download Muse: https://ai.meta.com/muse/download/
17. Muse Privacy Policy (effective Sep 17, 2026): https://muse.ai/privacy
18. Meta AI Research: How We Built Safety Into Muse (Sep 8, 2026): https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
19. Meta Help Center: About Muse subscriptions: https://www.meta.com/help/subscriptions/1021145227643680/
20. Ars Technica: Muse has a serious 0-day (Sep 21, 2026): https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/
21. The Verge: AI agent makers are promising privacy (Oct 10, 2026): https://www.theverge.com/ai-artificial-intelligence/1009051/privacy-ai-agent-promises-openai-meta-muse-dots
22. The Verge: Friends don't let friends feed their data to AI agents (Oct 15, 2026): https://www.theverge.com/tech/1011938/muse-ai-data-friends-consent
23. RDAP record for muse.ai (registrant: Meta Platforms, Inc.): https://rdap.identitydigital.services/rdap/domain/muse.ai
24. ChatGPT Learn: Meet dots: https://learn.chatgpt.com/docs/dots
25. ChatGPT Learn: Control your dot: https://learn.chatgpt.com/codex/dots/controls
26. ChatGPT Learn: Tasks and memory: https://learn.chatgpt.com/codex/dots/tasks-and-memory
27. OpenAI Help: Dots privacy, security, and safety FAQs: https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs
28. OpenAI Help: Data controls in ChatGPT: https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt
29. OpenAI Help: Keep history on but disable model training: https://help.openai.com/en/articles/8983130-what-if-i-want-to-keep-my-history-on-but-disable-model-training
30. ChatGPT pricing: https://chatgpt.com/pricing
31. The New Stack: OpenAI's Dots boundary problem rate doubled (Sep 30, 2026): https://thenewstack.io/openai-dots-agent-permissions/
32. OpenAI Trust Portal: https://trust.openai.com/