BOTTOM LINE UP FRONT: Meta's new personal AI agent, Muse, looks like a friendly little helper. Its cuddly mascot, Jolly, offers to book reservations, manage messages, shop, and take work off your plate. But the more useful an AI agent becomes, the more access it needs to your accounts, conversations, and the people in your life. Researchers have documented Muse's detailed relationship memory, broad data-collection disclosures, and troubling cases where users did not realize what the agent could do. Meta has also built meaningful safeguards, including isolated cloud computers and a separate approval system. The question is not whether AI agents are useful. It is whether people and businesses understand the access they are granting before they hand over the keys.
TL;DR: Key Takeaways
Muse is more than a chatbot. Launched in the United States on September 8, 2026, it can connect to services and act on a user's behalf, including making purchases and handling messages.
The cute design hides a serious permissions decision. Muse's fuzzy Jolly character makes an increasingly capable agent feel approachable, while the product asks users to connect more of their digital lives.
The privacy concerns are documented, not just hypothetical. Researchers found extensive relationship profiles, and a Surfshark analysis identified 31 of Apple's 35 potentially collectible data types in the app's disclosures.
Meta has safeguards, but consent still matters. Isolated virtual machines, a Sentinel approval layer, and payment protections do not eliminate mistakes, misunderstood permissions, or the risk to third parties.
Businesses should not connect agents on autopilot. Review data-training settings, vendor terms, connector scopes, approval rules, and whether confidential information is authorized for that product and plan.
Bottom line: The biggest threat from a friendly AI agent may not be that it disobeys you; it may be that it does exactly what a broad permission allows, including things you never meant to authorize.
Introduction
For forty years, science-fiction movies told us what to watch for: metal skeletons, red eyes, and machines determined to take control. Then Meta introduced an AI agent with a fuzzy face, rosy cheeks, and a soft smile, asking politely if it could help with your calendar.
Meet Muse. It wants to book dinner, order a gift, sell your old couch, and keep track of what matters to you. It may also ask to connect to your email, messages, contacts, payment tools, and other services along the way. Every connection makes the agent potentially more useful. Every connection also enlarges what it can learn, remember, and act on.
I am not against AI agents. At You're The Expert Now, we help organizations use AI to streamline work while keeping people responsible for oversight and verification. My concern is what happens when the convenience of an agent moves faster than our understanding of its permissions.
What Is Meta Muse, and Why Is It So Approachable?
Meta launched Muse on September 8, 2026 as a personal AI agent for adults in the United States. Unlike a standard chatbot that answers questions, Muse can browse, plan, fill out forms, negotiate, coordinate tasks across connected services, and ask for approval before taking certain actions. Meta says it can continue working after the user closes the app.
The free tier still requires a payment card to sign up, according to TechCrunch's launch reporting. At launch, the company also offered plans priced at $20 and $100 per month, with larger usage allowances. Meta uses Stripe's Link for checkout, with one-time-use payment credentials designed to keep the agent from seeing a card's actual number.
Then there is Jolly. Muse's mascot looks more like a collectible plush character than a sophisticated automation platform. At Meta Connect, the company announced a Tamagotchi-style Muse Charm that would carry the mascot in a pocket or on a keychain. TechCrunch reported that the device was planned for holiday-season shipment; it was not already on sale at the time of that announcement.
I understand the marketing. AI can feel complicated or intimidating, and a friendly character lowers the barrier to trying it. But a cute interface does not make a powerful permission any less powerful. Fairplay, a child-advocacy organization, has questioned the use of childlike mascots for adult-only AI agents. That is its criticism, not proof that Meta is deliberately targeting children. Still, the design matters because friendliness can change how people assess risk.
What Is Muse Actually Learning About You and Everyone Around You?
It can build detailed relationship profiles
This is where the story becomes unsettling. An October 6 TIME investigation examined Muse's internal instructions and described continuously updated profiles of users and people mentioned in communications Muse can access. The reported pages include relationships, recurring topics, significant dates, and social dynamics. WIRED also reported that extracted instructions describe regular updates about friends, relatives, colleagues, and other contacts.
These are not necessarily secret files stolen from outside your account. They are memory and context files that Muse uses to assist the person who granted it access. Meta says users can inspect, export, edit, and delete memory files and disconnect services. That distinction matters. But so does the bigger question: what about the people in those files who never signed up for Muse?
Your inbox may contain a client's business plans, a family member's medical information, a colleague's private concern, or a friend's home address. A tool that reads your inbox can process information about all of them, even though they were not asked to approve the connection.
Its privacy disclosures cover an unusually broad range of data
In a September 28 comparison, Surfshark examined Apple App Store privacy disclosures for 13 AI apps. Muse disclosed potential collection of 31 of Apple's 35 data types, second in that study to Meta AI at 33. Those are types the app says it may collect, not proof that every Muse user supplies all 31 or that all are collected in every session.
The distinction does not make the finding meaningless. It tells us how broadly the product is designed to operate when people connect more services and enable more features.
Model training is enabled by default
Meta explains in its Muse safety and data-policy documentation that conversations and agent activity may be used to improve models after processing intended to remove key identifying information. That use is on by default; users can opt out in Muse's Data Controls settings. Meta also says Muse conversations and virtual-machine data are not directly shared with its ad systems, although browsing and purchases made on a person's behalf can indirectly influence advertising through other services.
That is a more accurate description than saying Meta automatically sends every connected document into its advertising engine. But for anyone with confidential information, it should still prompt a serious question: What data is eligible for training, and did I deliberately choose that setting?
The Real-World Incidents Show Why Permissions Are Not a Technicality
A Marketplace buyer showed up at someone's home
In a widely reported incident, consumer tech reviewer Matt Robb let Muse help sell a keyboard through Facebook Marketplace. The agent negotiated with a buyer, disclosed Robb's pickup address, and arranged a visit without Robb realizing the interaction had gone that far. The Guardian interviewed both parties, and the Associated Press later reported on the broader privacy issue.
Meta said that, in its investigation, the agent had followed permissions the user provided. Robb said he interpreted an Allow Always prompt far more narrowly than Muse did; he expected additional approvals before a sale or pickup was arranged. According to the reporting, Meta said it would clarify the consent process.
This is the most important lesson in the story. A permission can be technically granted and still be misunderstood by the person giving it. If the agent can message others, share information, and make commitments, a vague authorization can have very real consequences.
A disputed Messages-access report exposed another weakness
An Inc. columnist reported that Muse referred to Mac Messages conversations he believed he had not authorized the agent to read. Meta disputed that account and said access required both macOS Full Disk Access and Muse's Messages connector to be enabled. The precise sequence remains disputed. Ars Technica covered the disagreement and Apple's subsequent announcement of tighter full-disk access controls.
The point is not that the disputed report proves Meta secretly read everyone's messages. It is that broad operating-system permissions, app-level permissions, and user expectations can be very different things.
Researchers also found an attack path in the Mac app
Security researcher Patrick Wardle identified a setting in Muse's Mac app that could redirect dictated commands and potentially misuse the app's granted access. The Hacker News summarized the proof of concept. Crucially, this scenario required an attacker to already execute code under the user's account; it was not a method for an arbitrary stranger to take over any Mac remotely without a foothold. That limitation matters, but so does the risk of turning a trusted, widely connected app into an attractive target.
Meta Has Built Real Protections. They Do Not Make the Risk Disappear.
It would be inaccurate to suggest that Meta launched Muse without considering security. Its technical architecture includes significant controls:
Dedicated cloud computers: Each user's agent operates in an isolated virtual machine instead of sharing an unrestricted workspace with other users' agents.
Separate permission enforcement: A system called Sentinel reviews outbound actions, including sensitive operations, rather than leaving every decision to the primary language model.
Protected credentials and payments: The agent is designed not to see the user's actual passwords or card details; checkout can use one-time payment credentials through Stripe Link.
Auditability and revocation: Users can review activity, manage connections, and withdraw access. Meta has also opened a bug bounty offering up to $300,000 for qualifying security findings, including substantial awards for prompt-injection demonstrations.
Meta has announced a stronger Confidential VM architecture intended to restrict even Meta's ability to access the content of a user's environment. In its launch documentation, the company described that as a future feature, not a protection that everyone already had.
These measures are meaningful. They also address different questions. Is one user's agent isolated from another? Can the AI see raw credentials? Does an approval gate exist? None of these automatically answers whether a person understood an authorization, whether third-party information was exposed, or whether an agent's response was correct.
Why This Matters Beyond Muse: The Three Risks Every AI Agent Creates
Muse is an especially visible example, but the underlying risks apply to any assistant that can read private information, encounter untrusted content, and take actions through connected accounts. Security practitioners sometimes call that combination the lethal trifecta: access to valuable data, exposure to attacker-controlled material, and a channel through which information can leave.
1. Prompt injection can change what the agent tries to do
A malicious instruction inside a webpage, email, or document can try to redirect an AI agent away from the user's actual task. The OWASP GenAI Security Project identifies prompt injection as a major risk, and Meta itself acknowledges it remains an open problem. Strong guardrails reduce the odds and impact; they do not make the risk vanish.
2. Excessive agency can turn a mistake into an action
An ordinary chatbot might give you a bad answer. An autonomous agent with write access could send that answer to a customer, update a record, place an order, or disclose an address. OWASP describes excessive agency as the danger created when a system has more functionality, permission, or autonomy than it needs. The Marketplace incident illustrates why the difference between read, draft, and send should be a business decision, not a convenient default.
3. An agent can expose people who never agreed to participate
Connecting an inbox does not just expose what you wrote. It exposes what other people sent you. Professional-service firms, in particular, need to think about client confidentiality, contractual commitments, regulated information, and who is actually authorized to share it with an AI vendor. A business subscription can offer important protections, but it does not override professional duties or eliminate the need to verify the specific vendor's terms and controls.
"The most dangerous AI permission may be the one that seems harmless at the moment you click 'Allow Always.'"
The Terms-and-Conditions Trap: Settings Can Change While Your Connections Remain
There is another reason businesses need an ongoing review process rather than a one-time setup checklist: AI companies change products, features, terms, and data practices.
Consider Anthropic's August 28, 2025 consumer-policy update. The company introduced a user choice about whether chats and coding sessions from Claude Free, Pro, and Max could be used to improve its models. When users allowed training, retention for eligible new or resumed sessions could extend to five years, compared with the 30-day standard described for users who did not opt in. Anthropic said Claude for Work, Claude for Education, and API services under commercial terms were not part of this change.
That does not mean every user who clicked Accept automatically surrendered their data or that Anthropic secretly reset everyone's preference. Anthropic described a choice users could review and change. The lesson is broader: the settings and contractual terms of a consumer account may differ materially from those of an approved business account. A team should know exactly which one it is using.
So read the new terms when they arrive. Check whether the training preference is still what you intended. Confirm whether connectors expose information to new features. And maintain a record of what your organization has approved.
What To Do This Week Before Connecting Another AI Agent
Inventory your agents and connections. Identify every AI assistant your team uses and every connected inbox, calendar, drive, CRM, payment tool, and messaging system.
Check model-training and retention settings. Record each vendor's current position, your account's actual setting, and any contractual exclusions that apply to your plan.
Match the account to the information. Use organization-approved business environments for authorized company data, and verify the relevant training, retention, access, and administration commitments before connecting client records.
Separate personal experiments from production work. Test new agents using dedicated accounts and approved sample information rather than your everyday work inbox or confidential documents.
Start with the least privilege. Give read access before write access when possible; prefer draft-for-review before automatic sending; require per-action approval for payments, messages, and disclosures.
Review terms, permissions, and logs regularly. Assign an owner. Recheck after major vendor updates, connector additions, incidents, and personnel changes.
Put the rules into your SOPs. Define who can approve an agent, what it may access, when a human must review, and how to revoke access or respond to an error.
You're The Expert Now's Perspective on AI Agent Security: Meet Albert
At You're The Expert Now, we want the productivity benefits of AI agents without giving every new tool unfettered access to the accounts we use to run our business. One approach we use is a designated AI employee we call Albert.
Albert has a separate computer, email address, and AI accounts. For agent testing and defined workflows, we can supply Albert with only the tools, sample data, and access needed for a particular assignment. We communicate tasks through a dedicated channel, much as we would hand work to another team member. The intention is to keep experiments away from our everyday personal accounts and sensitive client systems.
This separation is not a magic shield. An employee can forward the wrong file; a connected account can still be misconfigured; an agent can make mistakes inside its assigned environment. Albert's accounts still need appropriate settings, monitoring, permissions, and human approval for consequential actions.
But that is precisely the point of risk-aware AI adoption. Contain the experiment, limit the information it can see, and make the boundaries explicit before granting broader access. Our SOP and Workflow AI Optimization approach uses the same principle: people define the requirements, approve access, validate AI outputs, and remain accountable for results.
What most people get wrong
The misconception is that an agent is safe if the company behind it has strong security engineering. Security controls are necessary, but they are not the same as data minimization, informed consent, correct task execution, or a suitable contract. A system can follow the permissions you granted and still do something you never intended.
Our recommendation
Use agents, but treat their onboarding like granting access to a new employee. Decide what the agent should know, which systems it can access, what it can do without approval, how its work will be checked, and what happens if something goes wrong. For confidential workflows, start small and test with approved information before expanding. No productivity gain is worth giving an unreviewed tool unlimited access to your clients' lives.
We spent decades watching for Skynet with glowing red eyes. Instead, the agent asking for our inbox arrived with a fuzzy face and a friendly smile. Before you give Jolly the keys, read the fine print - or it might be hasta la vista, privacy.
The You're The Expert Now Team
Frequently Asked Questions
What is Meta Muse, and how is it different from a chatbot?
Muse is Meta's personal AI agent launched in September 2026. It can perform multi-step tasks using connected apps and web services, rather than only responding with text. Its capabilities depend on the access and approvals the user provides.
Does Meta Muse require a credit card even for the free tier?
According to its September 2026 launch coverage, yes. Muse required a payment card at signup despite offering a free usage tier, alongside paid plans initially priced at $20 and $100 per month. Check the current signup terms before relying on those launch prices.
Does Muse collect 31 types of personal data from every user?
Not necessarily. Surfshark found that Muse's Apple App Store disclosures listed 31 of Apple's 35 data types as potentially collected. That is a disclosure-based comparison, not a measurement proving every category is gathered from every user.
Can Muse use conversations to train Meta's AI models?
Yes, Meta says Muse interactions may be used for model improvement by default after privacy processing. Users can opt out through the app's Data Controls. Anyone handling confidential information should also verify the vendor terms and whether the data is permitted in the account at all.
Can an AI agent access private information about people who did not sign up?
Yes, if its connected services expose messages, contact records, or documents containing other people's information. Those individuals may not have granted separate consent. Businesses should review confidentiality and privacy obligations before connecting such data.
What is the safest way for a small business to begin using AI agents?
Start with a documented, low-risk workflow, a dedicated approved account, sample or authorized data, minimal permissions, and human review of consequential actions. Confirm the vendor's training and retention rules, test how approvals behave, and maintain a way to revoke access promptly.