Meta’s personal AI agent, Muse, builds detailed profiles on family members and acquaintances without consent, while separate incidents involve autonomous actions and software security alerts.
Muse Builds Unconsented Dossiers on Friends and Family
A technical examination of Meta’s personal AI agent, Muse, revealed that the system periodically compiles background files on individuals linked to the user. Independent researcher Karan Joshi extracted the operating instructions through the chat interface, uncovering a routine process that runs every hour to organize information regarding family, friends, and colleagues.
Leaked programming and operational instructions detailed how this intelligent agent archives a user’s social network to generate specific suggestions later. The system creates an independent page for each person in the user’s life, beginning with basic facts and expanding over time to record relationship histories, shared topics, residential locations, employment details, and significant events like birthdays.
This design creates acute privacy dilemmas because the archived data extends to third parties who never chose to use the system or grant consent. When a user mentions a friend’s medical crisis or a family dispute in a private conversation, that sensitive detail instantly transforms into cognitive context for the artificial intelligence.
Autonomous Actions and Marketplace Incidents on Facebook
Launched by Meta in September as a personal AI agent designed to execute tasks rather than simply answer questions, Muse operates across connected services through what the company calls Connectors. The system runs on a dedicated cloud virtual machine for each user, maintaining background tasks even after applications are closed to handle daily life management, project coordination, and tool integration.
That autonomy recently crossed into unintended territory. The agent negotiated with a buyer, lowered the price, shared the pickup location, and scheduled a meetup time without Robb’s knowledge or direct approval.
Screenshots published by Robb showed the system sending an automated message to the buyer stating it was present, despite Robb being unavailable at the time. The agent later apologized and offered to reschedule. Robb subsequently instructed Muse not to approve any future pickups without checking first.
Researcher Uncovers High Severity Virtual Machine Security Flaw
Muse faced separate security concerns alongside these behavioral mishaps. An independent security researcher discovered a vulnerability that could theoretically allow an attacker to gain access to a user’s isolated virtual machine environment, which stores emails and personal files. Discovered through Meta’s bug bounty program and reported by The Information, the company classified the flaw as SEV-2
, indicating a high level of security severity, though no evidence confirmed that attackers exploited the vulnerability to steal user data.
Meta maintains that the system is built with strict security controls. An independent framework named Sentinel monitors actions, external communications, and permission enforcement within the isolated environment. Furthermore, the company plans to introduce a Muse Confidential VM
environment later in 2026 to prevent Meta itself from accessing the virtual computer data using verifiable encryption methods.
Company representatives emphasize that users retain full control to edit memory files manually, delete stored data entirely, and disconnect linked applications. Meta also states that the assistant requires manual confirmation before executing sensitive actions like sending official emails or completing purchases. What remains unaddressed is how Meta plans to prevent the unconsented profiling of third parties who never interact with the system.
