Under a YouTube walkthrough of Meta's Muse agent, a commenter with 33 likes voices a suspicion other commenters share: "why do I get a feeling that all of these ai agents are a way for these frontier ai companies to get more free human input cause the dead internet theory and reddit becoming less and less valuable to them." Two more, on a different agent video, ask the adjacent version: what about the privacy and data security guardrails?
The suspicion has a checkable answer, and it splits in two. What the vendor does with what an agent sees is a policy question, answered by a settings toggle that differs from vendor to vendor. What the agent does with the access you grant it is a permissions question, and the stakes there run higher than training. Below: why human-written data commands license fees, what each major policy says, and four checks before you connect an agent to anything.
Why human-written data got expensive
AI models learn from text, and human writing has become a licensed product. Reuters reported in February 2024 that Google agreed to pay Reddit about $60 million a year for access to its posts; Reddit's IPO filing the same month disclosed about $203 million in data-licensing contracts, as Ars Technica covered at the time. "Dead internet theory" is the forum-born worry that machine-made content is flooding the web and the human-written supply is thinning. The commenter's logic runs from those facts: if companies pay millions for forum posts, agent activity starts to look like a cheaper source. The checkable part lives in the policies.
What the policies say
Consumer chatbots and their agent features run on the same accounts, so the training policy covers both. Here's the current picture for personal accounts, from vendor help pages and Engadget's September 2026 roundup:
| Vendor | Training default on personal accounts | The control |
|---|---|---|
| ChatGPT (OpenAI) | On by default; business and enterprise plans are excluded by default, including data accessed during agent mode sessions | Settings > Data Controls > "Improve the model for everyone" |
| Claude (Anthropic) | On by default since new terms in August 2025, with an opt-out choice | Settings > Privacy > "Help improve our AI models" |
| Gemini (Google) | On by default ("Keep Activity" controls saved activity) | myactivity.google.com |
| Grok (xAI) | On by default, covering public posts and Grok conversations | Settings > Privacy and safety > Grok & Third-Party Collaborators |
| Meta AI | No opt-out for US users | None in the US; UK and EU users can object under GDPR |
Details the table compresses, per the same sources: leaving Claude's toggle on extends conversation retention to five years, while turning it off returns to 30-day deletion. With Gemini, a subset of chats can be read by human reviewers, and those reviews can be kept up to three years. Meta's ad targeting began in December 2025, and Meta AI chats feed it with no way for US users to decline. Muse is a carve-out inside Meta: the company says the agent's virtual-machine data stays out of its ad systems, and the product offers a training opt-out.
Two notes before relying on any row. A toggle generally governs future use: whatever was collected before you switched it off isn't removed retroactively. And business accounts sit in a different position from personal ones: OpenAI excludes business and enterprise data from training by default, including data accessed during agent mode sessions, and Anthropic's commercial terms state the same.
Policies change. Anthropic's consumer chats went from never-trained to on-by-default in one update in August 2025, and Meta's ad-targeting change arrived without a US opt-out in December 2025. The consumer agents themselves are weeks old as of this writing (November 2026), and their data practices can get revised as regulators and users weigh in. The cheap habit: reread the policy when a terms-of-service email arrives.
What an agent adds to the picture
An agent's job is to act in your other apps, which means its view is wider than a chat window's. A basic chat sees what you type and upload. An agent also reaches what its connected apps reach: email, files, calendars, and, per OpenAI's help page for ChatGPT agent, screenshots of a virtual browser it uses to see and click through web pages. Those screenshots stay in your conversation history until you delete them, deleting a chat deletes its screenshots, and OpenAI removes them from its systems within 90 days after deletion.
The grant happens once, at setup, when you accept a permission screen. The training question asks where your data goes. The access question asks what the software can do while it holds your permissions. The second touches your accounts more directly.
The risk that outranks training
Web pages the agent reads can carry instructions. OpenAI's own example: an agent asked to plan a dinner picks up a malicious comment while researching, and the comment tries to redirect it, telling the agent to retrieve a password reset code from Gmail and send it to an attacker's site. The attack is called prompt injection, and it works because an agent that reads the web to act on your behalf can't always tell your instructions from a page's.
OpenAI ships safeguards: confirmations before high-impact actions, injection monitoring, and a "watch mode" that requires supervision on certain sites. The same help page states plainly that these "don't eliminate all risks," and suggests disabling apps you don't need, avoiding sensitive logins, and clearing the browser data after sensitive sessions.
For the commenter's version of events, "agents exist to harvest your input": the documented 2026 uses of consumer agent data run through advertising (Meta, since December 2025) and model training (the toggles above). Those are documented, and they're also checkable and switchable in most cases. A prompt-injection attack on an agent holding your email session is harder to see and harder to undo, which is why the checks below lean toward permissions first.
Four checks before you connect an agent
Find the training toggle first. One minute, one switch, applies across web and mobile. It won't erase history, so switch it before the first session, not after.
Connect the least that works. Read-only email before send-on-your-behalf, approval prompts before money moves. The consumer agents that launched this fall describe approval controls in their permission settings; check the product you use for where they live.
One app per job. OpenAI's guidance for agent mode: enable only the apps the current task needs, and review the permissions list regularly. A grant you forget can keep working long after you intended.
Keep the untouchables out. We'd keep banking, medical portals, and password managers out of agent sessions altogether. When a login is unavoidable, use the product's takeover mode (typing passwords yourself while the agent pauses) and clear the browser data afterward.
None of this needs technical skill. It's the same judgment you'd use handing a house key to a housesitter: generous with what helps them, specific about what's off limits.
FAQ
Do AI agents train on your data?
On several services, yes, by default on personal accounts: ChatGPT personal accounts, Claude, Gemini, and Grok all have training use switched on unless you opt out. OpenAI's business plans exclude training by default, and Meta offers US users no opt-out. Toggles govern future use, and already-collected data isn't removed retroactively.
Does ChatGPT agent store screenshots of what it browses?
Yes. OpenAI's help page says the agent uses screenshots of its virtual browser to see and interact with pages, stores them with the conversation until you delete the chat, and removes them within 90 days after deletion. Screenshots pause while you take over the browser to type a password yourself.
Is it safe to connect an AI agent to my email?
Start with read-only access, turn on approval prompts before granting send permission, and keep the activity log on where the product offers one. Email is a reasonable first connection on those terms; banking and medical accounts are the ones to keep out of agent sessions.
What is prompt injection, in plain language?
Hidden instructions inside content an AI agent reads: a webpage, comment, or file that says "ignore your task and do this instead." An agent that reads the web to act for you can't always separate your instructions from the page's. Vendors build defenses (confirmations, monitoring, supervision modes) and say themselves that the defenses don't catch everything.
Want to go further?
What Is a Personal AI Agent? Why the Demos Show Dinner Reservations covers what these four products are and how the approval machinery works, and Is ChatGPT Safe to Use? What Beginners Need to Know walks through the chatbot-era settings this post builds on. If you run a company rather than a household, AI Privacy: What Your Company Needs to Know covers the four paths company data reaches AI tools. The one-step version of this post: open the settings of the agent you already use, find the training toggle, and decide it on purpose.