The AI Agent On the Phone Was a Person (09/22/2026)

Two stories today sit on the same seam, which is the gap between what a system says it is and what is actually happening inside it. Meta is testing calls that present as an AI agent and are placed by people in a call center, and workers hired to train OpenAI’s models were fired for quietly using models to do it. Underneath that, Spain fined a security company for the more ordinary offense of making it tiresome to exercise the rights you already have.

Top 5 Critical Privacy Alerts

1. The Muse Agent Calling You May Be a Human in a Call Center

404 Media reports that Meta is testing calls made by its Muse AI agent which are in fact being placed by people working in a call center, per 404 Media. Somebody on the other end of that call believes they are talking to software, and they are making disclosure decisions on that basis.

Operator Note: People say different things to a machine than to a person, and they are entitled to know which they are addressing. If you deploy anything that presents as automated, the honest test is whether a caller would feel misled on learning the truth.

2. Workers Training OpenAI’s Models Fired for Using AI to Do It

People employed to provide the human judgment that trains OpenAI’s models were dismissed for using AI tools to generate that judgment, according to 404 Media. The value of the work was that a person did it, and the economics of the work made a person doing it hard to sustain.

3. Spain Fines Securitas Direct for Obstructing Data Subject Rights

The Spanish data protection authority fined Securitas Direct 100,000 euros for making the exercise of data subject rights more difficult than the regulation permits, per the EDPB. Friction is a policy choice, and regulators have started treating it as one.

Operator Note: Go and try to exercise a deletion request against your own company as an ordinary customer would, with no internal shortcuts. The number of steps you hit is the number a regulator would count.

4. A California Judge Finds Meta’s Voiceprint Use Authorized

Meta defeated a California voiceprint suit after the court found the data use was authorized, per Biometric Update. Biometric cases keep turning on the text of a disclosure rather than on what a reasonable person took from it, which is a gap worth watching as state biometric law expands.

5. India Moves Biometrics Onto the Device Across Payments

India is pushing device-based biometrics across its unified payments interface and card payments, per Biometric Update. Keeping the template on the handset is genuinely better than a central store, and it also makes biometric authentication the default path for a very large population.

Additional Privacy Alerts

Privacy-Enhancing Technologies

• The question of who verifies an AI agent’s identity: As agents start acting on behalf of people, the industry is working out how an agent proves who it represents and who vouched for it. Biometric Update

Data Brokers and Industry

• RealSense spins out its face biometrics business: The face biometrics unit is being separated amid a 500 million dollar acquisition, which changes who holds the data and under what commitments. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.