Meta’s new Muse AI agents raise questions about privacy and user control

Meta’s new artificial intelligence (AI) models – Muse Wonder and Muse Wonder Full – launched on October 12 have reignited the conversations around privacy risks as these models allow AI agents access to email, calendars, documents and other connected services.

In September, YouTuber Matt J. Robb posted on Threads claiming his Muse agent shared his address with a buyer on Facebook Marketplace without his knowledge. By the time Robb found out, the buyer had already visited Robb’s building and returned when nobody opened the door.

This shows that the privacy risks go beyond the information users explicitly share in a conversation. An agent may need access to sensitive data to complete a task, but that access could also expose information to misuse or unintended actions.


Designed for more complex personal and professional tasks, Meta said the models feature “Active Memory”, to carry relevant information across conversations, and “Active Focus”, to work towards goals, recover from errors and seek clarification before taking important actions.

Also Read: Meta launches frontier AI models under Muse series; here’s the lowdown

Risks with persistent memory, permissions

In a September 8 post explaining Muse’s security architecture, Meta said users could inspect, edit and download files stored in their dedicated virtual machine, including the agent’s memory. It also said connected-service credentials were stored separately from the agent’s working environment.

Meta said its security system, Sentinel, acts as an authority for approving actions involving connected services and external network requests. However, these safeguards do not eliminate every risk associated with granting AI agents access to personal accounts.

Two weeks after the launch of Muse, macOS security expert Patrick Wardle posted on X that he had identified a vulnerability that could have allowed someone to take control of Muse, which Meta subsequently patched.

In its September security post, Meta also said it had introduced safeguards to identify prompt injection attempts, isolate the agent’s working environment and control external actions. The company acknowledged that agents could still make mistakes, saying its safeguards were designed to reduce their frequency and potential impact.

Who can access the data?

Meta said Muse’s virtual-machine data was not shared with its advertising systems. It also said conversations and tool-use data could be sanitised before being used to train future models, with users able to opt out through the service’s settings.

However, Meta acknowledged that its architecture did not prevent the company from accessing virtual-machine data when necessary to support, secure or operate the service.