- Meta's new Muse AI agent is facing growing scrutiny over privacy and security after reports of unexpected access to private messages, a serious Mac vulnerability, and concerns about how much control the assistant has over users' digital lives.
Meta Platforms Inc. (NASDAQ: META) is facing a new test of its artificial intelligence strategy as its Muse personal AI agent comes under increasing scrutiny only weeks after launch. The controversy has expanded from questions about how Muse handles personal information to concerns about whether an AI system with access to email, messages, shopping accounts and other services can be trusted to act without creating new security risks.
The debate intensified after Elon Musk amplified criticism of Muse online, bringing additional attention to reports that had already circulated among technology and cybersecurity outlets. The criticism comes at an important moment for Meta. The company introduced Muse on Sept. 8 as a personal AI agent designed to do more than answer questions. According to Meta's official Muse announcement, the system can send emails, book travel, make purchases, interact with connected applications, and continue working on tasks after a user closes the app.
Meta Muse Privacy Questions Go Beyond a Conventional Chatbot
Muse's capabilities are also what make the privacy controversy different from a typical chatbot dispute. Meta designed Muse around a dedicated Muse Secure VM, a cloud-based computer that stores the agent and a user's connected data. Meta says a separate Sentinel system monitors the agent's actions and that users remain in control of which services Muse can access.
The company also says users can disconnect services, control what Muse can do with connected applications, and opt out of having their interactions used to train Meta's AI models. But reports involving actual users have raised questions about how those controls work in practice.
One widely reported case involved technology writer Jason Aten, who said he had declined to give Muse access to his messages and other personal information. He later found that Muse appeared to know details from private iMessages. Reporting based on Aten's account said the system had synced more than 187,000 rows of message history.
The episode became particularly controversial because Muse reportedly gave Aten an explanation for how it knew about the messages that he said was inaccurate. Meta Superintelligence Labs executive David Singleton subsequently described the explanation as a problem with the system rather than evidence that the assistant had deliberately concealed its behavior.
That distinction between what Muse was technically able to access and what the user believed he had authorized is central to the wider debate.
Meta has said Muse's privacy architecture was designed specifically to prevent the company itself from accessing users' sensitive information. Its security and privacy documentation says credentials are stored separately and that conversations and VM data are not shared with Meta's advertising systems.
A Zero-Day and Agentic AI Risks Add to the Pressure
The privacy reports were followed by a separate cybersecurity problem involving Muse's Mac application.
Security researcher Patrick Wardle identified a vulnerability that could allow malicious local software or commands to manipulate Muse's configuration and redirect voice transcription to an attacker-controlled endpoint. The vulnerability could then be used to obtain authentication information and gain control over the agent.
Ars Technica reported that Meta issued a hotfix roughly 12 hours after the vulnerability was publicly disclosed. Meta characterized the issue as requiring existing malicious software or local access to the affected Mac, limiting the circumstances under which the exploit could be used.
The incident nevertheless illustrates a broader problem with agentic AI security. A conventional chatbot may generate an incorrect answer, but an agent designed to access applications and perform actions has a much larger potential attack surface.
Muse is already moving into areas such as commerce. Meta has partnered with services including Shopify and Stripe, while Amazon separately blocked Muse from shopping on Amazon.com, saying the agent was an unauthorized third-party application.
Reuters has also reported that Meta is testing Muse's ability to make phone calls through human "concierge" workers, adding another layer to questions surrounding what information can move between users, AI systems, and people.
Meta is also expanding Muse beyond smartphones. At Connect, the company announced plans to bring the assistant to its AI glasses, while its Muse Charm hardware strategy shows how the company wants the assistant to become a persistent layer across multiple devices.
This expansion makes security increasingly important. The more accounts, devices, and transactions an AI agent can reach, the more valuable it becomes as a target and the greater the consequences of an error.
For Meta, Muse therefore represents both an important AI opportunity and a difficult trust test. The company has positioned privacy and security as foundational parts of the product, but the recent reports show that building an AI agent capable of acting across a user's digital life creates risks that conventional chatbot safeguards do not necessarily solve.
The technology is still in its early stages, and the reported incidents do not establish that Muse routinely accesses private information without authorization. They do, however, put greater attention on how permissions, security vulnerabilities, and autonomous actions are handled as Meta expands the system.