If I say "I'm thinking of visiting China sometime" and the Meta agent proactively decides to extracts my credit card number from my Meta subscription information, and proceeds to buy a ticket without my knowledge... I feel like at some point I get to blame Meta? Clearly I did not give any sort of consent there.

Conversely, if there's a chat log of me saying "Buy a ticket to China" and then clicking "yes" on an approval prompt showing the full price, ticket dates, etc. then yeah, obviously that one is on me.