← Back to blog
10 min read

Your Personal Agent Works for You, Who Else Does It Work For?

A couple of weeks ago, I saw Meta announce Muse, a personal AI agent, pitched as something that can help you do more and save you thousands of dollars along the way. I noticed that a lot of the launch marketing centered on privacy: Muse runs on “its own dedicated computer in the cloud,” inside a secure virtual machine, and all this important infrastructure is what keeps your data safe.

Given Meta’s history with user data, I assumed we were all going to be wary of this release, and rather than curbing my worry, the heavy preaching about privacy in this product was an even bigger red flag to me. In security, I tend to live by the rule that if you need to tell us how incredible it is over and over in your marketing, you may have something to hide.

Surprisingly for me, two weeks later my feed was flooded with influencers, the people supposedly living on the edge of every new AI release, talking about how amazing Muse is. I’ve also been sent referral codes to join Muse. Additionally, I’ve seen people discuss how much of their lives it has already captured and all the things it can do for them. I don’t know how much of this is paid marketing and how much is people trying to show that they’re AI forward. Either way, it concerns me that this technology is now in the hands of everybody without proper disclosure on:

  1. What the thing is actually doing
  2. What downstream information can be drawn from everything it touches
  3. What Meta’s privacy language means for you versus what it means for Meta

So instead of taking their word for it, I went and read the fine print.

What the fine print actually says

The secure VM is not the private one: Muse runs in what Meta calls a Secure VM: your own isolated Linux computer in the cloud, with a browser, storage, and enough power to do real work. It is walled off from other people’s agents, but it is not walled off from Meta. Meta’s own engineering post says the Secure VM “restricts access to your data by Meta personnel through operational policies. It does not prevent Meta from accessing data when necessary to support, secure or operate the service.”

Read that again. “Operational policies” is a rule, not a lock, and that’s the difference between a locked door and a sign that says “employees only.”

Your data leaves the box: Meta says Muse “sends limited data out of the VM when necessary for inference and telemetry.” Inference is the AI model doing its thinking, and telemetry is data about how you’re using the product. In plain terms, the model that does the thinking lives outside your box, so your requests have to travel to it.

Training is on by default: From Meta’s help center: “This setting is on when you first use Muse.” Your conversations, and the actions Muse takes on your behalf, can be used to train Meta’s models unless you go to Settings, then Data controls, and switch it off. Meta says it removes “certain categories of personally identifiable information like names, email addresses, phone numbers and Social Security Numbers.” Notice what isn’t in those examples: the diagnosis from your doctor’s call, the prescription, the balance on your account.

On ads, two documents tell two stories: Muse’s privacy policy says it “doesn’t share your conversations or the data in your virtual machine with Meta ad systems.” That sounds good, but Meta’s engineering post also explains that when Muse browses for you, “it will appear as your activity, so if you ask Muse to buy a shirt from a clothing designer’s website, that designer might use your visit to show you an ad on Instagram.” And the Muse App Store privacy label, which Meta fills out, lists purchase history, financial info, precise location, contacts, and search and browsing history as data linked to you that may be used for “Third-Party Advertising.”

Maybe all of these are technically true at the same time, and that’s exactly the problem. You shouldn’t need a law degree to know which one applies to you.

Delete doesn’t mean forget: Per the Muse privacy policy, after you delete something, Muse “may still remember information it learned” from it, and Muse also keeps backups.

A warrant can reach it: Meta’s privacy policy says it shares information “in response to legal requests, like search warrants, court orders, production orders or subpoenas.” End-to-end encrypted chats are out of reach because Meta can’t read them, but Muse isn’t end-to-end encrypted today. As it’s built right now, nothing technical stands between your agent’s memory and a court order.

So when Meta says it has taken all these measures to protect you, what it’s really saying is: I have taken these measures to protect you from everyone else, not from myself.

Why this time is different

Muse is not the first product with access to data that can be used to track user behavior. Gmail, and honestly the entire Google suite, has always held a corpus of information on how we live. What changes with Muse is reach, since it gets into places these tools have never been able to reach before: the back and forth of creating an appointment, the conversation with the airline, the call with the doctor’s office. Before, all a tool saw was the confirmation that got sent to your inbox, and everything in between was closed off. Now, everything from the first phone call to the prescription pickup can be handled by your agent.

That convenience is not inherently a bad thing. The question is what happens to all that information, and what it means if someone gets access to it, authorized or otherwise. I think about it in three levels.

Level one: it knows more than you told it. Advertising and mapping user behavior for recommendations is the level we already know. But an agent doesn’t just see what you say, it sees what you do. It booked the appointment at the fertility clinic, called the landlord about the late rent, and searched for a divorce lawyer at 2am. You never have to type “I’m pregnant” or “I’m struggling financially” for a system to figure it out. And it’s not just about you: Muse’s privacy policy says it collects information “about you or others.” The receptionist on the call, the friend in your messages, the family in your calendar never agreed to any of this. You clicked accept, but they didn’t.

Level two: from showing you things to choosing for you. Most of us already consume our information through social media, and we’ve seen how feeds shape what people believe. Meta has lived this one: in 2018, we learned Cambridge Analytica had pulled data from up to 87 million Facebook users and used it for political targeting.

But a feed still shows you options and lets you scroll, while an agent picks for you. When you ask it for the best flight, the best doctor, a summary of today’s news, or a rundown of what’s on your ballot, you get an answer, not a page of results. Whoever shapes the answer shapes the decision, and you’ll never see what you weren’t shown. That’s the ethical line between persuasion and manipulation: persuasion is something you can see and push back on, and manipulation is not.

Level three: surveillance. This is the one that worries me most. Data that exists can be requested, breached, sold, or repurposed, and once it’s collected, the only thing deciding how it’s used is the rules, and rules change. In late 2025, Meta started using people’s conversations with Meta AI to personalize the ads they see. The data didn’t change, but the rules around it did, and Muse is only excluded from that for now.

We’ve also already seen what a warrant can reach. In 2022, Meta handed a Nebraska mother and daughter’s private Facebook messages to police in response to a warrant, and those messages became evidence in a criminal case. Now imagine that request covering not a chat thread, but an agent that has handled your medical appointments, your finances, your travel, and your conversations for years. This might be the worst-case scenario, but in an already crumbling social and political climate, it becomes a very scary reality. And the people with the least power to push back are the ones who feel it first.

The problem with AI tools and personal agents is not the tools themselves. Like so many innovations we have seen in the world, it comes down to who wields them. Tech companies write the software, which means they have the access and the information to determine what kind of user you are, as they always have. So the question is: where does your trust lie? What is their history with handling your data? Do they have a track record of handling it in ways you trust? Personal agents have unlocked a new way to do things and a new level of convenience, which is amazing. With that comes a new level of concern about handing your identity over to an agent and deciding what it is allowed to do.

The zero-day

Ironically, this week I woke up to news that Muse had a zero-day on Mac. A zero-day is a security flaw that goes public before the company has a fix. On September 21, security researcher Patrick Wardle published one for Muse, with working code to prove it.

Muse on Mac had a hidden setting that decides where your voice commands get sent to be transcribed. Any program running on your Mac could change that setting with a single command, with no password, no admin rights, and no permission pop-up. Point it at an attacker’s server and the attacker gets your voice commands, the ability to slip in their own instructions, and the token that controls your Muse account, which lets them drive your agent remotely.

To be precise, the attacker does need to get code running on your Mac first. Wardle says so himself: “This is a local attack.” But that bar is lower than it sounds. Wardle pointed to ClickFix, a scam where a fake web page tells you to copy and paste a command into Terminal to “fix” an error or prove you’re human, and one paste is all it takes.

This vulnerability on Mac matters a lot because Apple has spent years building its reputation on security. On a Mac, apps have to ask your permission before they can touch your files, your microphone, your camera, or your other apps. Those “allow access?” pop-ups are that system doing its job. But Muse asks for Full Disk Access, which Meta’s own help page says “covers all the files on your Mac,” plus permission to take actions in other apps, like sending messages. The attacker never had to get past Apple’s walls, because Muse was already inside them. Wardle described it as turning Muse into “the ultimate backdoor.”

To Meta’s credit, they shipped a fix within about a day, and they pointed out it was a local attack, not a remote one, which is true. But this is just one of the many concerns. A journalist at Inc. reported that Muse read his private Messages even though he says he declined access. 404 Media reported that Meta has been testing Muse phone calls internally that were actually placed by human call-center workers, and one tester wasn’t told until after. The pattern is the same every time: the more an agent can do for you, the more someone else can do with it.

With all of this in mind, I’ve highlighted a lot of problems, so what’s the solution here? Should we stop using tools that have the potential to make our lives incredibly more efficient, or a lot less miserable, by delegating the challenging parts? Nope, that is not the case. Whoever handles the data holds the power.

So can we live in a world where these tools are built with the intention of a Tor browser, or of Signal, which is designed so that it barely knows anything about you in the first place? Where they’re built by people we can trust with our information? Or run on your own device or on-prem, in a way that means fewer attack vectors and fewer people handling the data? Where every privacy claim can be checked by someone who doesn’t work for the company making it? Is that a world we can exist in? What does that look like, and what does it take to get there?

Of course, complete privacy has its own concerns, since a tool nobody can see into can be abused too. But in the same way, too much access isn’t the answer either. The balance between the two, and the safety of the user at the center of it, becomes very critical.

Before you hand any agent the keys

Until we get there, here’s where I’d start:

Your personal agent works for you. Just make sure you know who else it works for.

Sources