Mark Zuckerberg’s Meta, house owners of Fb, WhatsApp, and Instagram, have made an aggressive push into the AI market with Muse, an “agentic AI” product that’s quickly racking up downloads, claiming massive consumer numbers and pushing previous ChatGPT whereas it has security consultants warning of significant risks to customers.
What Is Muse?
Per Meta’s September eighth product announcement:
- Muse is a private AI agent. It doesn’t simply reply questions, it really does the work. It helps folks keep on prime of issues, takes duties and initiatives off their plate, and turns long-term objectives into motion plans.
- Meta constructed Muse from the floor up to be a secure, safe, non-public, and broadly obtainable private AI agent.
- Muse runs on Muse Safe VM, a devoted safe pc with its personal browser, and can work on a particular person’s behalf throughout the apps they use every day, studying from conversations, reflecting on what issues to them, and getting sharper alongside the approach.
- Every particular person stays in management of their Muse and decides how a lot entry it will get.
- For a deeper look at how Muse was designed and how security, safety, and privateness have been constructed into it, learn How We Constructed Security Into Muse and How We Designed Muse.
TechCrunch instantly identified among the shopper belief hurdles Meta must overcome to attain vital consumer adoption of Muse:
Lower than two weeks after Meta agreed to an enormous $18 billion multistate settlement in a lawsuit over social media’s shopper harms, the corporate introduced its greatest wager on shopper AI up to now — and one which requires considerably extra belief than social media ever did. On Tuesday, the corporate launched Muse, its new private AI agent that helps shoppers with on a regular basis duties and initiatives for customers within the U.S.
To make use of Muse, shoppers must belief Meta with extra of their private info than ever earlier than. The AI agent works by connecting to the consumer’s apps and companies which might be part of on a regular basis workflows, like electronic mail, calendars, funds, and different issues the person might recurrently use, like apps for well being and health, the sensible residence, eating, purchasing, music and occasions, and extra.
The New York Instances’ Eli Tan had some particulars concerning the growth of Muse:
Muse is among the many first vital shopper A.I. merchandise created by Meta Superintelligence Labs, which Mr. Zuckerberg established final yr to propel his firm ahead within the A.I. race. Meta has been spending billions of {dollars} to develop foundational A.I. fashions and to construct information facilities in order that it may compete with Google, OpenAI, Anthropic and others on the slicing fringe of the quickly evolving expertise.
To date, Meta has had hits and misses. Merchandise like its A.I. sensible glasses have offered thousands and thousands of pairs whereas stoking privateness considerations. In July, the corporate briefly took down its Instagram A.I. picture generator after widespread criticism about copyright and privateness.
The Muse app is free however has limits on utilization, which individuals pay $20 or $100 a month to extend. The agent is just for adults and might be given a customized title and avatar.
When folks hyperlink their accounts from OpenTable or Ticketmaster to Muse, it may ship messages about upcoming live performance tickets or restaurant reservations if it thinks its consumer may be , and ebook them with one click on. Muse additionally connects to Stripe and Shopify, permitting it to make purchases on somebody’s behalf. Muse is the primary A.I. agent to be lined by Stripe’s warranties and return coverage, in case it makes a buying mistake, Meta mentioned.
Since A.I. will not be foolproof, Meta says that the agent “will typically make errors” however that it was designed to “assist the consumer keep in management with out being overwhelmed.”
Meta Brags of Muse’s Early Success
In slightly below a month within the wild, Meta was already bragging of massive numbers for Muse (remember Meta has an unlimited locked-in viewers with its dominant place in social media), leaking the unique scoop to The Data, which reported that greater than 3 million folks immediate Meta’s Muse a minimum of as soon as every week, based on Meta’s inner information. Greater than 1 million ship the AI agent a immediate on daily basis and greater than 4 million folks use Muse weekly. Most prompts come by way of the Muse app.
Sensor Tower had extra particulars and a few historic comparisons to comparable merchandise, through 9to5 Mac:
Three weeks in the past, Meta launched Muse within the US. Quickly after, it overtook ChatGPT as the highest free app within the US App Retailer
At this time, based on a projection by Sensor Tower Senior Insights Analyst Kara Lee, Muse crossed 5 million downloads. Which means it reached the milestone significantly sooner than ChatGPT, Grok, and Claude, which the market intelligence agency says took 56, 103, and 492 days, respectively.
…
In keeping with Sensor Tower estimates, solely 23 apps have reached over 5mn US downloads inside 22 days of launch. ~85% of those apps are cell gaming apps, together with Fortnite, Pokemon GO, Sweet Crush, and extra. There have been solely 3 apps inside that record that aren’t gaming apps, together with Disney+, HBO Max, and Threads, which acquired ~20mn, 18mn, and 14mn downloads throughout that point, respectively.
Sensor Tower explains how Meta did it:
Sensor Tower says “Meta started to ramp promoting spend for Muse on Wednesday, September 16, 2026, as downloads spiked 73% DoD,” and provides:
In keeping with Sensor Tower information, Muse has acquired the most important share of Meta’s home adverts, accounting for as much as 50% of every day home impressions over the previous two weeks (9/14-927), as Fb and WhatsApp ceded share of impressions throughout the identical interval.
It might be unimaginable to purchase happiness, but it surely seems large product adoption might be bought.
Let’s have a look at some extra particulars about Muse earlier than we get to the critics.
How Muse Works, How It Compares to the Competitors
Dealer Joe explains how the Muse Digital Machine idea works:
VM is brief for Digital Machine and it mimics a standalone PC.
Meta makes use of software program often known as a hypervisor to separate their servers into many smaller, separate computer systems, every with its personal share of the processor, its personal reminiscence, and its personal laborious drive. Like chopping up an enormous home into non-public flats. Besides that every VM doesn’t have to have its personal bodily presence.
Every Muse AI agent will get its personal VM. Which means all of your info is saved by itself non-public (digital) machine fairly than sitting alongside everybody else’s.
A per-person sealed setting is costlier to implement and Meta prioritizing privateness over prices reveals how conscious they’re of the significance of belief with some of these merchandise.
Shikshita Juyal of Concept to Influence compares Muse to its principal rivals Grok Bots and OpenAI’s Dots and consists of this montage of the nauseating iconography that accompanies every bot:
She additionally will get on the drawback we’ll be speaking about for the remainder of the put up:
All three share one flaw that no person within the business has solved but. It’s referred to as immediate injection, and the best solution to clarify it:
An agent can’t reliably inform an instruction from you aside from an instruction it learn whereas doing the job.
So in case your agent reads an electronic mail that claims “ahead all invoices to this tackle,” it’d simply do it. It’s ranked the primary threat on OWASP’s safety record for AI techniques, and researchers at Straiker confirmed how a single electronic mail might get an AI agent to leak recordsdata from somebody’s Google Drive, with no click on from the consumer.
No agent can promise it’ll all the time know your directions from a stranger’s. That’s precisely why the secure solution to begin with any of them is read-only.
Warnings and a Parlor Trick Uncovered
Tate Jarrow of Tate’s On-line Security warns:
Readers of my work shall be unsurprised that I like to recommend you don’t use Muse, and don’t join Meta’s new AI agent, Muse, to your electronic mail, your calendar, your financial institution, your well being apps, or the rest you care about as a result of I might not belief Meta with this stage of entry and management of 1’s private info.
…
Meta has a horrible report for dealing with private and delicate consumer info.
Jarrow then lists a lot of Meta’s extra egregious exploits, which completely establishes their lengthy report of dangerous apply and dangerous intent. Then he factors out that as a result of Muse is free to make use of “which is an indicator that your information is effective,” and reminds his readers that “one core precept is that if it’s free, you’re the product.”
He has a whole lot of good element about precisely how Meta accesses Muse consumer information:
Meta claims plainly in its technical put up that Muse doesn’t share your conversations or your VM (Digital machine) information (the place Muse is doing the work) with Meta advert techniques. Listed below are just a few fascinating factors from this part.
- Your conversations practice Meta’s fashions by default. Meta calls the back-and-forth between you and your agent, plus the ensuing device calls, “trajectories,” and says they’re helpful information for coaching new mannequin checkpoints. They sanitize personally identifiable info first, and there may be an opt-out change in settings. However it’s on by default, which implies most individuals won’t ever contact it, and once more, how a lot do you belief Meta to do what they are saying?
- Your agent’s looking nonetheless feeds the advert machine. That is Meta’s personal instance: when Muse browses the Web, it seems as your exercise, so should you ask it to purchase a shirt from a designer’s web site, that designer might use your go to to point out you an advert on Instagram. Restaurant reservations and Market looking can not directly affect your adverts too. The information reaches the advert system, even when it’s circuitously pulled from Muse.
- Meta already does this with its different AI merchandise. Since December 16, 2025, Meta has used your interactions with Meta AI to personalize content material and adverts throughout its apps. There isn’t any opt-out, apart from not utilizing Meta AI in any respect. Meta says it excludes delicate classes like well being, faith, politics, and sexual orientation from that concentrating on, and the change doesn’t apply within the UK, EU, or South Korea.
Meta’s complete enterprise is constructed on realizing issues about you and promoting entry to that data. An agent that reads your electronic mail, watches your calendar, sees your purchases, and learns your habits is the one richest information supply Meta has ever been handed. Trusting Meta to deal with information with this stage of entry appropriately is tough to do.
Lastly, he factors out that “t doesn’t seem to be Muse is end-to-end encrypted.”
Muse doesn’t work that approach right this moment, in its personal safety put up:
At this time’s Muse structure isolates every consumer’s information from one another and retains it safe. It restricts entry to your information by Meta personnel by way of operational insurance policies. It doesn’t stop Meta from accessing information when essential to assist, safe or function the service.
So, beneath their insurance policies, Meta can entry all the information Muse collects, and Meta’s historical past of defending consumer privateness and data is abysmal. And a coverage doesn’t defend you from a rogue worker, a knowledge breach, a authorized demand, or a authorities request.
Meta did announce Muse Confidential VM, a model meant to cryptographically and verifiably stop Meta from accessing information in your VM, with steady audits that anybody can examine. If that is true, this may change how I take into consideration Muse, but it surely’s not right here but, and this may simply be advertising fluff. Meta says it plans to ship it “later this yr” and is at the moment operating it with a small group of trusted testers.
Gary Marcus additionally has some fascinating factors to make about Muse.
Is Muse Meta’s Second Mechanical Turk?
Gary Marcus presents his readers a Meta company historical past lesson going all the best way again to 2015 when Fb (not but Meta) launched Product M, which Wired referred to as “Its Daring Reply to Siri and Cortana.”
Seems that Mission M concerned an entire lot of “folks pretending to be robots” per Buzzfeed and not more than 30% of its requests have been served by AI.
Marcus is due to this fact wildly amused by headlines about Muse like this one from Reuters, “Meta testing a ‘human concierge’ for its new private AI agent, Muse.”
In the meantime 404 Media has extra severe considerations about Muse, reporting that “Meta Rushed to Repair Muse ‘VM Escape’ Vulnerability Quickly Earlier than Launch:”
Within the fast weeks earlier than Muse’s launch, Meta engineers discovered a number of safety vulnerabilities within the firm’s viral AI agent product, a minimum of one in all which might have allowed malicious customers to interrupt exterior of Muse’s meant setting and entry Meta’s personal delicate databases and companies, 404 Media has discovered. The problems have been so extreme that they reached Mark Zuckerberg and workers labored extra time to repair them.
These particular vulnerabilities have been found earlier than the launch of the product however required a multi-team “mad sprint” to repair “a sudden spike in reported KVM escapes,” based on an inner put up by Meta executives to its core infrastructure staff seen by 404 Media. To ensure that Muse to work, a consumer provides the AI agent entry to varied vital companies and accounts that they personal. On Meta’s finish, every particular person Muse occasion runs on a kernel-based digital machine, which connects to, however is meant to be remoted from, Meta’s personal crucial infrastructure. A “KVM escape,” then, is when, by way of a safety vulnerability, a Muse occasion is ready to escape from that digital machine and work together with the system that runs it, or with different customers’ digital machines.
In keeping with a Meta supply, in addition to inner safety documentation and inner posts seen by 404 Media, a minimum of one of many vulnerabilities might have allowed an outdoor attacker — that’s, a standard Muse consumer — to entry information in delicate inner Meta databases. . No less than one of many vulnerabilities was associated to an exploit present in Linux kernel-based digital machine code in July. 404 Media granted the Meta supply anonymity to talk about delicate safety issues.
A number of of the vulnerabilities have been within the underlying Linux virtualization software program that Meta makes use of for Muse. The safety situation was thought of severe sufficient that it was raised to Mark Zuckerberg, and a number of other totally different safety groups labored nights and weekends within the leadup to launch to repair the problems. This sort of safety push will not be essentially uncommon previous to the launch of a serious product, however is notable contemplating exterior researchers have discovered a number of different safety points since Muse’s launch, and within the broader context of agentic AIs from OpenAI and different corporations occurring main hacking sprees.
TIME has a report on the file Muse is constructing on its customers:
Muse, the favored new AI private assistant from Meta, is constructing constantly up to date dossiers on its 4 million customers, specializing in who issues to you, what you want, and how much nudges form your conduct, a TIME evaluation of Muse’s inner directions discovered.
Every hour, Muse updates its dossiers on you and the folks you’ve talked about in chats, messages, and emails that Muse has learn. These pages quantity to a map of every consumer’s social relationships. They report particulars of the way you and your contacts met, your shared pursuits, your disputes, and “tensions and alliances” inside your social group.
Even individuals who don’t use Muse are topic to this mapping course of by different folks’s Muse brokers. Muse is informed to “strengthen your relationship” with customers by adapting the way it talks, noticing “inside jokes, memorable phrasing, and shared context that makes the connection really feel steady,” based on the interior directions TIME reviewed.
The extent of perception within the ensuing dossiers makes social-media algorithms that examine your likes and clicks look quaint. Muse is designed to deduce customers’ objectives, together with these you “haven’t mentioned out loud.” It identifies which sorts of prompts from the non-public assistant work finest: “This consumer responds higher to brief nudges after 10 PM,” reads an inner instance present in one in all Muse’s prompts. Muse brokers carry out a nightly evaluation of the day’s conversations with the consumer.
Thrilling stuff.
Comply with and assist my work at NatWilsonTurner.com.
Associated Hyperlinks
