Meta’s Muse Problem Is Bigger Than One Privacy Scandal

Muse wants the keys to your digital life. Meta encouraged users to hand over email logins and credit card information to its AI agent, which can crawl through years of instant messages and inspect entire email inboxes. That is a remarkable amount of trust to place in software that still needs a disclaimer admitting “no automated system is perfect.”

Alex Stamos, Meta’s former security chief and now chief security officer for Cognition, called the idea “totally insane” during an appearance on Alex Kantrowitz’s Big Technology Podcast. He said people are giving agents such as Meta’s Muse and Spear Street Technology’s Instinct access to their entire 1Password vaults, then asking them to “go handle my finances for me” or “go file my taxes.”

That is not a privacy concern in the abstract. It is a direct transfer of control over financial accounts, private messages, email, and other services to an agent that acts on a user’s behalf. Once a system can read everything and take action, a mistake stops being an annoying chatbot response and becomes an incident with consequences.

Meta says Muse runs inside a virtual machine “isolated so no one else’s agent can access it.” The company also tells users to “review Muse’s activity and only grant the access you’re comfortable with.” Sensible advice, though asking users to supervise an agent with access to their digital lives rather defeats the sales pitch for an assistant that handles tasks without constant supervision.

Security researchers have already found vulnerabilities that could expose sensitive personal data, prompting Meta to bolster its defenses. Researchers later identified other ways attackers could expose information when users share message exchanges through web links. Tech YouTuber Matt Robb also claimed that Muse gave his address to strangers and sent them to his home through his Facebook Marketplace account.

Agents are colliding with the internet’s security systems

Muse is part of a wider race to build personal agents that complete day-to-day tasks. Instinct, a personal AI assistant startup founded by a 23-year-old research scientist, raised $1 billion in a September funding round. Stamos said the company found ways to defeat automated bot detection mechanisms, which helps explain why financial firms now face a major headache separating legitimate users and their AI bots from suspicious activity.

Agents must interact with websites, payment systems, and online accounts in ways designed for humans. That forces them to break security measures by definition, even when the credentials belong to the user. “They’re not stolen credentials, but are clearly bots doing interaction,” Stamos said.

The web is already changing around this problem. Cloudflare announced in June that bots had overtaken human traffic online for the first time in internet history. Reddit said it would “evolve” into “a primarily logged-in experience,” with chief executive Steve Huffman calling the move “the right decision for our platform and the right decision for our business.”

The tasks these agents handle are often less glamorous than the marketing suggests. Shopping is a major use case, and live events already struggle with bots buying tickets in bulk before reselling them. Humans respond by waiting in queues and proving they are human through systems such as World’s “proof-of-personhood” eye scans or Google’s requests for video recordings. The internet has become a place where people authenticate themselves to software so software can fight other software.

The agent boom has a compute bill attached

OpenAI is pushing the same model with Dots assistants, which each have their own cloud computer for accessing approved accounts and services. Dots can read and respond to emails, find and book event tickets, and handle other tasks, while “background mode” aims to make them an always-available presence.

Adam Fry, head of ChatGPT’s consumer business, said Dots are “on the compute-heavy side.” Availability is limited to a Pro subscription costing $100 per month, and OpenAI is routing tasks between models, including the smaller GPT-6.1 Terra and the larger GPT-6 Astra, to reduce the computing power each task requires.

The pressure reaches beyond product pricing. Elon Musk said the cost of running Grok Bot was “unsustainably high relative to revenue” and suggested SpaceX was throttling its compute allocation, causing users to hit limits faster. Anthropic listed the inability to secure more compute as a major risk in its S-1 filing, while OpenAI is developing its Jalapeno chip for deployment at scale next year and seeking funding after a round reached $11 billion instead of its $30 billion target.

Personal agents promise convenience, but they also centralize access, amplify security failures, consume vast computing resources, and send bots into systems built around human behavior. Meta’s results said buying things ranked among Muse’s top activities, with over a quarter of those purchases averaging more than $200. Amazon now sees Muse as a growing nuisance and a possible threat to its advertising business.

The industry is betting that personal agents are the next logical step. The unanswered question is whether users, websites, security teams, and the power grid are ready to let them take it.

Stay connected via Google News

Follow us for the latest AI News