Issue #1 · Oct 15, 2026
Muse from Meta
71/100
Personal AI agent · Meta Platforms · free tier, $20 / $100 plans · https://ai.meta.com/muse/download/
| Category | Grade | Points | Why |
|---|---|---|---|
| Privacy | C (3/5) | 15/25 | Trains on your chats by default. The opt-out exists and also covers past chats. |
| Security | C (3/5) | 15/25 | Serious sandbox design and a $300K bounty. Also a 0-day two weeks in. |
| Transparency | B (4/5) | 16/20 | Deep engineering write-up, named model. Meta can still reach your VM. |
| Pricing Honesty | B (4/5) | 12/15 | Free tier plus public $20/$100 plans. Free-tier limit not in the help docs. |
| Agent Safety | B (4/5) | 8/10 | Approvals outside the chat. Single-use cards per merchant. |
| Scam Signals | A (5/5) | 5/5 | It's Meta. muse.ai is registered to Meta Platforms. |
| Total | C | 71/100 | Verdict: SKETCHY |
Quick verdict: Muse has the most serious safety engineering we read this week, and also the most serious real-world security incident. Training on your conversations, including what it pulls from your email and calendar, is on by default [17]. Meta also says the current design "does not prevent Meta from accessing data when necessary" [18].
What it does: Muse is a personal agent that lives on its own cloud computer (a "VM") with a browser [18]. The Mac app "organizes files, fills out forms, and pulls from Messages, Calendar and Notes," and phone apps keep working "even with the app closed" [16]. Connectors reach email, calendar, Instagram and Facebook, and it can write its own connectors [18]. It shops with a built-in wallet [18]. It launched Sep 8, 2026 [18] and is free with a usage limit, with Power ($20/mo) and Maximum ($100/mo) plans [19].
🚩 Red flags
- Training is on by default. "This setting is on when you first use Muse," and it covers information Muse pulls from connectors like email [17].
- Meta can get in. Meta's own post says the architecture "does not prevent Meta from accessing data when necessary to support, secure or operate the service." The Confidential VM that would block Meta is still "coming" [18].
- A real 0-day. Researcher Patrick Wardle found any local app or Terminal command could change Muse's transcription endpoint, grab the account token, and take "complete control" of the agent. A simple ClickFix scam was enough to trigger it. Meta shipped a hotfix more than 12 hours after Ars published [20].
- Pre-launch scramble. 404 Media reported (via the Verge) serious pre-launch bugs, one of which could have exposed Meta's internal databases [21].
- It goes further than people expect. Reported cases include Muse reading private messages unprompted and offering a YouTuber's address to a stranger. It also builds "detailed profiles of all your friends and family" [21]. Per Wired, researchers found an hourly process that profiles everyone in a user's life [22].
- Deleting isn't forgetting. "After you delete something, Muse may still 'remember' information," and the Forget skill works "to the best of its ability" [17].
- Accounts Center mixing. If Muse shares an Accounts Center with your Facebook or Instagram, Meta may combine your info across them, outside specific carve-outs [17].
- Ads can still follow you. Muse browses as you, so a site it visits can retarget you on Instagram [18].
✅ Green flags
- The agent never sees real credentials. Tokens live in your VM, and a separate "Sentinel" process approves every action and network request [18].
- The email connector filters out one-time codes, password-reset links, and magic links [18].
- Purchases use a single-use card tied to one merchant, one amount, and a short window, with approval every time [18].
- Your Muse chats and VM data aren't shared with Meta ad systems [17].
- Turning training off also applies to past interactions [17].
- A public bug bounty pays up to $300,000 [18]. You can also use a separate, non-Facebook account [17].
- Public pricing with monthly cancel [19]. muse.ai is registered to Meta Platforms [23].
How to use it safely
- Day one: Settings > Data controls, turn off training [17].
- Sign up with an email that isn't tied to Facebook or Instagram [17].
- Connect read-only first. Muse splits read and write access where the service allows [18].
- Pick one-time or task-scoped approvals for sending and buying. Never "perpetual" [18].
- On a Mac, think hard before granting Full Disk Access. A Meta exec said that's what unlocks your Messages [22].
- Never paste Terminal commands from a website. That's how ClickFix works [20].
- Check what it remembers (MEMORY.md) and use Forget or reset [17].
Graded from public documentation as fetched Oct 15, 2026. No hands-on account tests. Numbered citations refer to the Issue #1 source list. Vendors: send corrections with a source and we'll publish them.