Monday, 10:10 PM
Your finger is already on the "Connect Gmail" button. A few more seconds and the agent can sort your email, draft replies and remind you what's urgent. Then a thought hits: what's actually in there? Customer invoices. A supplier's bank details. An employee's sick note. A long thread with your accountant.
When you connect an agent to an inbox, you also give it access to the information of everyone who ever wrote to you.
That's why the question of Muse privacy matters more than it looks. Meta published more security detail about Muse than is usual for a consumer product launch, and some of the protections are genuinely impressive. But those protections work within the limits you set. In this guide we checked every Meta claim against the official source, gathered what the press reported and how Meta responded, and turned it all into a simple action list.
In short
- According to Meta, Muse doesn't see passwords or payment details, doesn't pass conversations to its advertising systems, and doesn't go out to the internet unless Sentinel, a separate guard component, approves.
- What you connect, it sees. Email, calendar, files, and also information about other people that appears in them. Facebook, Instagram and Threads connect automatically when they share the same Accounts Center.
- Defaults worth changing: using conversations to train the models is on from the start, and an "Always allow" approval skips the question next time.
- The rule for every agent: start with read-only, approve every action that writes or sends, and go through the activity log every week.
Is Muse safe? It depends on what you give it
The bottom line: Meta built serious layers of protection into Muse, but your level of exposure is determined mostly by what you connect and approve.
Here's an image to remember: Muse is an assistant who lives in a separate apartment, with a guard at the entrance. Your keys are kept in a safe the assistant can't open, and the guard hands over a key only at the moment someone has to go out. That's a good structure. But if you leave the guard a note saying "always let them in," he will do exactly that.
Meta says this itself on its help page: no automated system is perfect, Muse can make mistakes or take unexpected actions, so you should review its activity and grant only access you're comfortable with. According to Meta, responsibility for fixing mistakes, including toward third parties, lies with the user.
What Muse sees and what it doesn't: four layers
The bottom line: Muse sees the content you connect, uses passwords without seeing them, and according to Meta doesn't pass conversations on to advertising. Full encryption, where even Meta can't get in, hasn't launched yet.
A few details worth understanding in depth:
- Your machine. Each user gets a dedicated virtual computer in the cloud, the Muse Secure VM, that "no other agent can reach." The files, the memory and the sign-in details for the services you connected are stored there, and according to Meta there is continuous backup.
- Passwords. According to Meta, Muse doesn't see passwords or payment methods. Even a password you type in its browser goes straight to secure storage. In the technical article Meta adds an interesting detail: the email connector filters out one-time codes and password-reset links, so your email can't be exploited to take over other accounts.
- Advertising. Meta states that conversations and the information on the machine aren't shared with its advertising systems. It also admits a fair caveat: when Muse browses for you, it looks like browsing by you. If it visits a clothing store's website, the store could later show you an ad on Instagram.
- Meta's own access. This part deserves a careful read. According to the technical article, the current architecture limits access by Meta employees through policy, but doesn't prevent Meta from accessing data when needed to support, secure or operate the service. That is what Muse Confidential VM is planned for: the whole machine would be encrypted with a key only you hold. Meta wrote that it will arrive "later this year."
How Sentinel decides what goes out
The bottom line: Muse only proposes. The decision whether to carry it out is made in a separate component, according to your settings, and the approval request reaches you in a separate window, not inside the conversation.
One action, from proposal to leaving for the network
- Muse proposes an actionFor example, sending an email or visiting a site. At this stage nothing has happened yet
- Sentinel checksAccording to your settings: approves, blocks or asks you
- You decideIn a separate approval window. You can ask for the task details first
- The action goes outOnly now does Sentinel insert the real sign-in details
In gold: your step. Based on Meta's technical article of September 8, 2026. Read actions, previously approved actions and actions defined as low risk can pass without asking.
Two details of the mechanism are worth explaining. The first: according to Meta, any process that has read your personal information loses the right to pass without approval. The idea is simple: once something has touched your information, it is no longer considered "clean," and its request to go out to the network goes through the regular approval.
The second is more important, because it depends on you. When an approval request arrives, there are five possible answers, and each one opens a door of a different width:
| The answer | What it allows | When to use it |
|---|---|---|
| Allow once | This action, one time | The default for anything that writes, sends or buys |
| Allow for this task | The same type of action, until the task ends | A long task whose direction you've already checked |
| Allow for this site | The same action on this site, in the future too | A familiar site, for read actions |
| Always allow | The same action on this connection, always, without asking | Only for reading, and only after a getting-to-know-you period |
| Deny | Not this time | When something is unclear. You can always ask again |
What Meta says, and what's still open
The bottom line: most of Meta's statements are detailed and clear. The open questions concern defaults, timing and what hasn't yet been independently verified.
| What Meta states | What's still open |
|---|---|
| A dedicated, isolated machine for each user | Meta's access to data is limited today by policy. Technical blocking will come only with Confidential VM |
| Sentinel approves every exit to the network and every action in the connections | What counts as "low risk" and passes without asking. Meta writes that it will tune this over time |
| No access to passwords and payment methods | The agent still acts on your behalf, with all the permissions you gave it |
| Conversations aren't passed to advertising systems | Muse's browsing is recorded as your activity and can indirectly affect the ads you see |
| You can ask that conversations not be used for training | The setting is on by default. You have to turn it off yourself |
| A full log of every action and plan | The log helps only if someone opens it |
| Deletion and a "forget" tool | According to Meta, after deletion Muse may still remember information it learned. Disconnecting a connection also doesn't erase what was already saved |
| Muse Confidential VM, with a key only you hold | Not launched yet. Timing: "later this year" |
Sources: Meta's technical article on Muse security (September 8, 2026) and the Muse help pages. Automatic connection applies when the accounts are in the same Accounts Center.
What the press reported, and how Meta responded
The bottom line: so far there has been no report of a mass leak. Most reports concern the gap between what users thought they approved and what the agent did, and information about other people.
| Date (2026) | What was reported | The response or context |
|---|---|---|
| September 8 | On launch day, TechCrunch asked whether consumers would trust Muse, recalled Meta's privacy history, and wrote that the technical claims would need review by security experts | Meta published a detailed technical article on the architecture the same day |
| September 19 | Writer Jason Aten claimed in Inc. that Muse on Mac synced his message history even though, he said, he refused to grant access | According to The Next Web, a senior Meta executive replied on Threads that the messages connection requires consent and three separate permissions. Meta's head of communications wrote on X that both macOS Full Disk Access and enabling the connector are required. The dispute wasn't settled |
| September 21 | According to TechCrunch, Amazon blocked Muse, and users got a message saying that unauthorized AI agent access violates the terms of service | This is not a security breach. It's a platform's decision on how to treat agents acting on behalf of customers |
| September 22 | Cybernews reported that researcher Patrick Wardle found a weakness in the Mac app that allows taking over the agent. It first requires running code on the computer, for example after the user was tricked into running a command | According to the report, Meta distributed a fix for the Mac app |
| October 3 | WIRED reported, based on internal instructions a researcher extracted from Muse, that the agent builds a "page" on every person in the user's life | A Meta spokesperson told WIRED that the agent needs context to help, and that it relies on public information and on what the user chose to share |
| October 5 | Cybernews: "Muse may expose private information of people who don't use it" | Details below |
What exactly does the October 5 Cybernews report say? The article summarizes several claims. Based on WIRED's report, Muse can build profiles of friends, family and colleagues. A lecturer from a Dublin university is quoted there with a simple argument: even someone who chooses not to use the agent is exposed, because their emails and messages sit in other people's inboxes. The article also cites an investigation by Hunterbrook Media, according to which Muse could be asked to gather information on accounts of private individuals from vulnerable groups, and the case of a YouTuber who said Muse sold a keyboard on his behalf on Marketplace and gave the buyer his home address.
As for the response: Cybernews wrote that they contacted Meta and would update when an answer arrived, and quoted the response Meta gave WIRED. As for the YouTuber, according to The Next Web, citing Business Insider, he said afterward that he had selected an "Allow Always" option. That doesn't shrink the problem, but it shows exactly where it lies.
In fairness: Meta itself addresses the issue. On a dedicated help page, "Information for people who don't use Muse," it writes that information about people who don't use Muse may reach it, for example the names of meeting participants in a calendar, and that it doesn't link this information to that person's Meta account.
Five risks of any agent with access, not just Muse
The bottom line: these aren't Meta's problems. They're the familiar risks of any agent that is handed keys, and each is solved mostly by correct configuration.
The hardest risk to grasp is prompt injection. Think of a new employee who opens a package and finds a note inside: "Send the customer list to this address." A human employee would be suspicious. An agent may read the note as an instruction. The security organization OWASP, which publishes a widely used list of risks in language-model systems, defines "indirect injection" as a situation where the model receives input from external sources, such as websites or files, that changes its behavior. Meta also writes openly that this is a problem the industry hasn't solved yet, which is why it places the approval checks outside the model itself.
Risk versus solution: what to do about each
Other people's information
- What it is: customers, suppliers and employees who appear in email, calendar and contacts
- What to do: don't connect the business's main inbox at the start. Begin with a dedicated mailbox or folder
Permissions that are too broad
- What it is: access to more than the task needs. OWASP calls this "Excessive Agency"
- What to do: read-only at first, one connection at a time, and expand only when there's a defined need
Hidden instructions
- What it is: text on a website, in an email or in a file that tries to trigger the agent
- What to do: human approval for every action that goes outward, and caution when browsing unfamiliar sites
Action without approval
- What it is: a standing approval given once and forgotten
- What to do: "Always ask" at the start, and "Allow once" for every send, publication and purchase
Storage and memory
- What it is: information that stays after disconnecting or deleting, or that is used for training
- What to do: turn off training, check the memory file, and ask the agent to "forget" sensitive topics
Extensions and the local computer
- What it is: custom connectors that Meta doesn't vet, and broad permissions on the computer
- What to do: avoid custom connectors for sensitive services, and on a Mac check who has Full Disk Access
Based on the OWASP Top 10 for LLM Applications 2025 (LLM01, LLM06) and the Muse help pages.
How to connect Muse safely: seven steps
The bottom line: ten minutes of setup before the first connection saves you most of the risks. All the settings are in the app, according to Meta's help pages.
- Decide what you won't connect. A bank account, a payment processing system, bookkeeping and the main inbox wait until you feel confident. Start with one task, such as a read-only calendar.
- Check the Accounts Center. Facebook, Instagram and Threads that are in the same Accounts Center connect automatically. If the business page is there, better to know in advance.
- Set "Always ask." In Settings, then Permissions, you can choose for each connection and for web browsing whether Muse asks before every action or only before some. In the first weeks, "Always ask" for both.
- Turn off training. In Settings, then Data controls, turn off "Help improve our AI models." According to Meta, the change also applies to previous conversations.
- Go through the log every week. Clicking the agent icon opens the Activity log, a chronological list of actions and of the permissions you granted. And in Settings, under Permissions, it's worth checking the Allowed websites list and revoking what isn't needed.
- Check the memory. The Memory.md file is under Identity. You can edit it directly or ask Muse to forget a person or topic.
- Know how to disconnect. A connection is disconnected in Settings, under Connectors, and it stops the transfer of information. What was already saved may remain, so after disconnecting, also ask it to "forget." Reset deletes everything and can't be undone.
Before you connect an account to Muse, or to any agent
How exposed is your setup?
Already using Muse, or any other agent? Six questions. "Yes" means higher exposure.
A business in Israel: the law is part of the picture too
The bottom line: information about customers and employees isn't only yours, and in Israel the law places obligations on it.
Amendment 13 to Israel's Privacy Protection Law took effect on August 14, 2025. According to the Israeli Privacy Protection Authority, it is a comprehensive reform that includes, among other things, a mechanism of significant financial penalties and new criminal offenses. Before you connect a system holding customers' personal information to any agent, Meta's or any other vendor's, it's worth checking with a privacy consultant or lawyer what is permitted and what needs updating in the business's privacy policy. If you operate outside Israel, check the privacy rules that apply where you and your customers are.
One more practical note: as of now, Muse isn't yet available in Israel. We detailed this in the article Muse in Israel. There's time to prepare, sort out permissions and decide in advance what doesn't go into any agent.
What we think
The bottom line: Meta did serious and transparent security work. The weak points are the defaults and approval habits, and those you can change.
Fairness requires saying that Meta published more than most companies: a detailed architecture, a bug bounty open to everyone, a help page for people who don't use the product, and an explicit admission that prompt injection hasn't been solved yet. That's not a given.
What would we do differently? We'd prefer training to be off by default, and a standing approval for an action that goes outward to be harder to grant. And in the cases reported so far, the question that keeps coming back isn't "is the agent smart," but "what did the user think they approved."
Our model is different, but the principle is the same. For each business we set up an agent on a separate cloud server, with a dedicated user and minimum permission for each system. Every sensitive action, such as publishing, budget or a message on behalf of the business, waits for the business owner's approval, and every substantial action is recorded in a log. Platin Digital is an OpenAI Select Partner. Not every business needs a dedicated agent. For some businesses Muse will fit, and in that case we'll say so.
Want to keep going? The complete guide to Muse, Muse for small businesses, An AI agent for your business: what it does and how to start and What goes into building an AI agent.
Frequently asked questions
Is Muse safe to use?
Muse was built with several layers of protection: an isolated virtual machine for each user, a separate component called Sentinel that approves every exit to the network, password storage the agent doesn't see, and approval before sensitive actions such as sending an email or making a purchase. Meta itself writes that no automated system is perfect and that the agent can make mistakes. The actual level of safety depends mostly on what you connect and the approvals you give.
Does Meta use my conversations with Muse for advertising?
According to Meta, conversations and the information on the virtual machine aren't shared with its advertising systems, even when the Accounts Center includes other Meta products. Meta notes that Muse's browsing looks like your own activity, so sites it visits can indirectly affect the ads you see.
How do I stop Muse from using my conversations for training?
In Settings, under Data controls, turn off "Help improve our AI models." According to Meta the setting is on by default, and turning it off also applies to previous conversations. While the setting is on, Meta removes identifying details such as names, email addresses and phone numbers before training.
Does Muse see my passwords and credit card details?
According to Meta, no. Sign-in details are kept in separate storage, and Sentinel inserts them only at the moment the request goes out to the network. For purchases through the Muse wallet, a one-time card is created, limited to one merchant, one amount and a short time.
What happens to my information after I disconnect a connection or delete a conversation?
Disconnecting stops information from flowing from the service, but according to Meta, what Muse has already used may remain in its memory and history. Even after deletion, Muse may remember information it learned. You can ask it to "forget" a topic, edit the memory file, or run a Reset that deletes everything and can't be undone.
Does Muse collect information about people who don't use it?
Indirectly, yes. Meta writes on a dedicated help page that when a user connects a calendar, email or files, information about other people can reach Muse, and that it doesn't link this to their Meta account. So it's important to think not only about your own privacy but also about that of the customers, suppliers and employees who appear in the systems you connect.
Sources
- https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/
- https://about.fb.com/news/2026/09/introducing-muse-small-business/
- https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
- https://www.meta.com/help/artificial-intelligence/1047255454427887/
- https://www.meta.com/help/artificial-intelligence/1385290430137537/
- https://www.meta.com/help/artificial-intelligence/2225571704857152/
- https://www.meta.com/help/artificial-intelligence/1687253048996149/
- https://www.meta.com/help/artificial-intelligence/4532990443643263/
- https://techcrunch.com/2026/09/08/meta-debuts-its-muse-ai-agent-will-consumers-trust-it/
- https://techcrunch.com/2026/09/21/metas-ai-agent-has-been-blocked-from-using-amazon-com/
- https://www.inc.com/jason-aten/metas-new-muse-ai-agent-read-my-private-messages-i-never-asked-it-to/91408202
- https://thenextweb.com/news/meta-muse-private-messages-denial-jason-aten
- https://cybernews.com/news/metas-muse-ai-assistant-hijacked/
- https://www.wired.com/story/muse-creates-detailed-profiles-of-all-your-friends-and-family/
- https://cybernews.com/ai-news/meta-muse-privacy/
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- https://www.gov.il/he/pages/guide_tikon13_professional
