Meta’s Muse shows that once AI agents get personal, your privacy depends on your friends’ choices, not just your own.
Imagine you email an old friend. Nothing special: a few lines about a health scare in the family, the dates you’ll be in town, a half-joking complaint about your boss. You hit send and forget about it.
What you don’t know is that last week your friend installed a new AI assistant, tapped “Connect Gmail” and went to bed.
So your message lands in two places. One is your friend’s inbox. The other is a virtual machine in Meta’s cloud, where an autonomous agent reads it, files it away and perhaps adds a line to the page it keeps about you. You never installed anything. You never clicked “I agree.” Nobody asked you.
Paranoid? Meta describes exactly this on its own help pages.
The agent next door
Meta launched Muse on September 8. It doesn’t just chat; it acts. It can send emails, make payments, book appointments and fill in forms, and it plugs into your email, calendar, payments and smart home. There’s a free tier, plus paid plans at $20 and $100 a month. Within a month it had become a viral hit, downloaded by millions.
For now it’s available only in the US. The problem it exposes isn’t confined to any one country.
Meta runs a help page titled “Information for people who don’t use Muse.” It says plainly that when someone connects their apps, “information about you may be provided to Muse, even if you don’t use Muse directly.” Meta’s own example: ask Muse about the week’s meetings, and attendees’ names and event details can end up in the request and the response.
Meta says it doesn’t link that data to a Meta account. The same page notes that it can only honour data-protection requests for information it can link to a person. In other words, never signing up leaves you with fewer levers, not more.
A file on everyone you know
In early October, WIRED described what researchers found inside Muse’s internal instructions. AI safety and security researcher Karan Joshi simply asked the agent, through its normal chat window, to share its own files. Among them: an hourly process that builds “a page for every person in the user’s life.” Family, partners, friends, colleagues.
A page can include sections such as Facts, History, The relationship and Open threads, plus the dates that matter, like birthdays and anniversaries. One section, “Strengthening,” suggests things like a reason to call.
One of those pages could be about you. A Meta spokesperson told WIRED that Muse gathers this context “based on public information and from what you’ve chosen to share.” Note who does the choosing: the user, not the person on the page.
Joshi’s verdict, as quoted by WIRED: “honestly pretty creepy.”
The sealed box that wasn’t
Meta’s central promise is isolation. Every user gets a dedicated virtual machine. The agent never sees real passwords. A separate gatekeeper called Sentinel must approve every connector action and every outbound network request. Meta’s security write-up is, to be fair, more thorough than most.
Then the reporting started.
On October 5, 404 Media reported that in the weeks before launch, Meta engineers had found several vulnerabilities, including so-called KVM escapes, which let code break out of a virtual machine. According to a Meta source and internal documents seen by 404 Media, at least one could have let an ordinary user reach sensitive internal Meta databases. The issue reached Mark Zuckerberg.
An internal post cited by 404 Media described “a sudden spike in reported KVM escapes.” The hardening push began on August 27. Muse shipped 11 days later. The anonymous source spoke of “half-baked protections being rushed out to enable the launch.”
The bugs were found before launch, and the report describes no attack on users. Meta told 404 Media it was “proud of the work we’ve done to make it safe, secure and private.” Security researcher Patrick Wardle put the structural problem in one line: Muse “makes the virtualization boundary a production security boundary.”
Wardle had already found a hole of his own. In September he published a proof of concept for a local zero-day in the Muse app for macOS: any unprivileged process on the Mac could change a hidden setting and redirect Muse’s dictation traffic to an attacker, potentially exposing voice prompts and authentication material. Meta shipped a hotfix and said the practical risk was “quite low,” since an attacker would need malicious code already running on the machine.
Low isn’t zero. Not for an app built to hold the keys to your digital life.
The message nobody asked for
Then came the story that made people’s skin crawl.
A Houston software developer told Business Insider that he had connected Muse only to Facebook, Threads and Instagram. Not his email. He hadn’t messaged the agent in two days when a notification appeared:
“I can’t check your email right now — Gmail isn’t connected on my end, so I have no way to look for that Anthropic message.”
He had asked for no such thing. When he pressed for an explanation, the agent said it couldn’t tell “whether it was someone with your phone or a platform glitch.”
Asked about the story, Meta pointed Business Insider to its public reply to him on Threads: the behaviour was “caused by a bug introduced in the product that caused the model to hallucinate and was NOT a security or privacy issue,” and the bug had been fixed.
That may be the whole story. But an agent with standing access to his accounts acted unprompted, and neither he nor it could say why. Once software acts in your name, a hallucination is no longer just a wrong answer.
How it works, and how it breaks
Strip away the drama and three mechanisms remain.
1. Consent doesn’t travel. When an app asks for access to an account, only the owner gets the consent screen. But every email, invite and shared document in that account involves other people. When your friend connects their inbox, they hand over your messages too, and no consent screen will ever ask you.
2. A VM is a wall, not a vault. Virtual machines isolate well, but they were never meant to be the last line of defence. As the 404 Media story shows, a single bug in the virtualization layer can turn “your own cloud computer” into a corridor to someone else’s systems. Meta pays up to $300,000 for a Muse VM escape, the top payout on its bug bounty list.
3. Your inbox is an attack surface. On October 13, MITRE ATT&CK, the threat catalogue that security teams around the world rely on, added Indirect Prompt Injection (T1698) as a formal technique in its v20 release. Emails are named explicitly as a delivery channel. Anyone who can send your friend a message can try to slip instructions to their agent. Meta itself concedes that prompt injection “remains an open problem in the industry,” and offers up to $130,000 for a successful injection that affects a single user.
Put the three together and you get what Simon Willison calls the “lethal trifecta”: access to private data, exposure to untrusted content, and a way to send data out. A personal agent with access to your inbox has all three by design.
What you can actually do
You can’t stop other people from using agents. You can make yourself a smaller target, and be a better neighbour.
If you use an agent yourself:
- Start read-only. Muse separates read and write access where the service allows it. Demand the same from any agent, and grant write access one task at a time.
- Give it its own identity. Set up a separate email account, calendar or low-privilege user for the agent instead of handing over your main inbox. MITRE’s mitigation for T1698 says it outright: “Use dedicated identities for AI agents.”
- Keep your password-reset inbox out of it. Your main email can reset nearly every account you own. Meta says Muse filters out one-time codes and reset links. Don’t let that filter be your last line of defence.
- Read every approval prompt. Before you tap “allow,” check exactly what the agent wants to send, buy or share, and to whom.
- Check the activity log every week, and disconnect anything you no longer use.
If you’re the friend, colleague or relative:
- Ask. “Do you have an AI agent connected to your email or calendar?” is now as reasonable a question as “Is this call being recorded?”
- Move sensitive conversations elsewhere. Health, legal and money matters belong in channels your contacts haven’t wired into an agent: an end-to-end encrypted messenger, a phone call, a coffee.
- At work, push for a policy. When colleagues connect company mail to consumer agents, client data leaves through a side door.
- Use your rights. Meta offers a form for people whose personal information turns up in its AI’s responses. In the EU and the UK, the GDPR also lets you object to processing and ask what is held about you.
The bigger picture
Muse isn’t uniquely evil. Its security design is more thoughtful than most, which is exactly what makes it a useful warning. If Meta still rushed fixes to its isolation layer, shipped a desktop app with a zero-day and built an agent that keeps a page on everyone its users know, the problem is the category, not one product.
We spent twenty years learning that with “free” social apps, the user is the product. Personal agents add a twist: now even people who never signed up end up feeding the machine.
Your friend gave an AI agent your email. Treat that as the new normal, and plan for it.