Meta gave its new AI agent a cuddly mascot, but security researchers and privacy advocates say its data-harvesting practices are anything but friendly.