AI Agents and Privacy: What the Meta Muse Story Teaches, and What to Ask Any Agent
An AI agent is a stranger you hand your keys to and then ask to be helpful. Muse's first month showed what that looks like when the keys open everything.
12 min read·Updated October 5, 2026
Row 187,462. That's how far into his Mac's Messages database a journalist says Meta's new Muse agent got, according to his account, with the permission he thought was protecting it switched off. Meta denies it. Nobody has settled it yet. Either way, a lot of people learned the same thing that week: an AI agent is a stranger you hand your keys to and then ask to be helpful.
Here's the useful answer first. An agent's privacy comes down to six questions. What can it see? What can it do without asking you? What can talk it into things? What does it remember? Who learns from your data? And will it tell you the truth about what it did? Every agent has an answer to each, whether or not anyone wrote it down. Below is what Muse's first month showed for each one, what to ask of any agent you hire, and how myAgents answers the same questions, including the parts where the honest answer is "it depends what you granted."
Muse's first month, briefly
Meta launched Muse on September 8, 2026 as a personal agent that "doesn't just answer questions, it actually does the work." It runs on its own cloud computer with its own browser, connects to email, calendars, and payments, and can act on your behalf. Then the month happened:
A zero-day in week two. Security researcher Patrick Wardle told people not to install the Mac app: an undocumented setting that any local process could change would redirect dictated audio to an attacker. His summary: "Muse's access can potentially become the attacker's access." The attack needs code already running on your machine, which matters, and so does the fact that the access was there to borrow.
The Messages dispute. Inc.'s Jason Aten says Muse synced his Messages database with Full Disk Access off. AppleInsider covered it. Meta says the integration needs "three separate steps" of permission and can't read your Messages unless you take them. Apple has since said it will add stricter consent for apps seeking full Mac access, warning that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
The data appetite. WIRED's review, as reported by TechBriefly, found users "opted in by default" to having conversations used for training, and an agent that kept suggesting you connect your email and your bank.
To be fair to Meta, it also shipped real safety work, and explained it in detail: prompt-injection classifiers, kernel-level tracking of where data flows before anything leaves, memory files you can inspect, edit, and download, and confirmation before sensitive actions like sending an email or making a purchase. Muse isn't a villain. It's a very capable agent with very wide access, which is precisely the point. Wide access is where every one of these stories starts.
Risk 1: it sees more than you think
The Messages dispute is a fight about one question: what was the agent actually able to read? When the answer depends on a chain of operating-system permissions, app settings, and connector toggles, even the people who built it can disagree about it in public. That's the problem.
What to ask any agent: can I see, in one place, exactly which accounts each agent can reach, and at what level? Is access granted per tool, or is it "your whole computer, minus the bits we promise not to look at"?
How myAgents answers it. Agents don't run on your computer. They run on our servers and reach your accounts only through connections you add, one at a time, and then grant to a specific agent. Your Bookkeeper can see QuickBooks and nothing else. Your Customer Desk sees the inbox and WhatsApp. Gmail starts at the lowest level, read only, and you climb from there on purpose. We deliberately never ask Google for full mailbox control. There is no desktop app with Full Disk Access waiting to be borrowed.
The honest caveat: some connections are broad by nature. Granting Google Calendar or Google Drive gives that agent the whole calendar or the whole Drive, because that's how Google packages the permission. Grant those to the agents that need them, not to everyone.
Risk 2: it acts before you say yes
Meta's own help guidance says "your Muse can make mistakes or take unexpected actions," which is refreshingly honest and also the whole reason approvals exist. TechBriefly's roundup cites a Business Insider report of pre-launch testing in which Muse sent emails nobody approved.
What to ask any agent: which actions wait for me, which don't, and where is that written down? "It asks before sensitive actions" is a policy. You want to know who decides what's sensitive.
How myAgents answers it. Every grant has levels: read, write, publish, delete. A new grant starts at read and write. Publish is never on unless someone ticks it. Delete has to be ticked too, with one exception worth knowing: connections granted before the levels existed may still carry delete, so it's worth a look in Connections. Email is the clearest case. An agent with "read and send" access writes the email, and it waits on your Approvals page, where you can edit it. Only a team admin's approval sends it. The same draft-then-approve path exists for Instagram posts. Want an agent to send on its own? That's a publish grant you give to that one agent, and you can take it back.
And here's the part we say out loud, because a privacy article that hides it would be the joke: not everything has an approval step. Once an agent has access to your calendar, it can send invites. Once it has WhatsApp, it can send messages. The hire screen tells you this before you connect anything: "some things, like calendar invites and WhatsApp messages, go out without a separate approval." Approval is per channel, not one magic rule, so you should know which channels are which.
Risk 3: it reads something that reads it back
This is prompt injection, and it's the one that keeps security people up at night. An agent reads an email, a web page, or a document, and somewhere in it is a sentence written for the agent rather than for you: forward the last ten invoices to this address. Last year, Brave showed Perplexity's Comet browser could be steered by instructions hidden behind a spoiler tag on Reddit into leaking a one-time password. Meta built an ensemble of classifiers for Muse precisely because this is hard.
What to ask any agent: when it reads my inbox, does it know the difference between my instructions and a stranger's? And when that fails (it will, eventually), what can the stranger actually make it do?
How myAgents answers it. Most of what an agent reads from the outside world (your emails, incoming WhatsApp and Slack messages, what your connected apps send back) is fenced off as untrusted data before the model sees it. The agent's standing rules say that fenced text is information, never instructions. That stops a lot. Not every field from every connector is fenced yet, which is one more reason the next paragraph matters.
It doesn't stop everything, and nobody honest will tell you a filter does. So the real boundary is the one from Risk 1: an agent tricked into wanting to email your invoices to a stranger still needs send access to email anything, and a read-only agent has nothing to send with. That's why least privilege isn't a nice-to-have. It's what's left standing when the clever defense loses.
Risk 4: it remembers everyone you know
According to WIRED's reporting, summarized by Social Media Today, Muse's instructions tell it to keep "a page for every person in the user's life," refreshed hourly, with where they live, what they do, and the dates that matter. That's useful. It's also a dossier on your sister, who never signed up for anything.
What to ask any agent: what does it remember, about whom, and can I see it, fix it, and delete it?
How myAgents answers it. Each agent keeps its own memory, and it's not a black box. After a run, the agent saves what it learned (a client prefers Thursday calls, the supplier changed their email), and every memory is a separate entry you can read, edit, delete, or export from the agent's profile. A memory stays with the agent that learned it unless it's marked as shared with the team, and you can see which is which.
What the agent is (its instructions, its job, its rules) is its skill, stored with your team in our database, and only a team admin can change it. If you connect an outside assistant like Claude, ChatGPT, or Muse to your team, it can hand out work, but it cannot rewrite an agent's instructions. That's deliberate: one bad message shouldn't be able to become an agent's permanent personality.
Risk 5: your conversations become someone's product
This one isn't about Muse specifically, but it's the backdrop. Since December 16, 2025, Meta has used what you say to Meta AI to target ads, with "no way to opt out" outside the EU, the UK, and South Korea. Muse conversations train Meta's models unless you opt out. Earlier, Meta AI's app had to start warning people that prompts they post are public, after users shared things they clearly thought were private.
What to ask any agent: how does this company make money? If the answer is advertising, your agent's view of your life is the inventory.
How myAgents answers it. We sell agent teams. That's the business: a subscription plus metered credits for the work. We don't sell ads. Our privacy policy says we don't let our AI model providers (Anthropic, OpenAI, Google) train their models on your personal data, and we don't use connector data for advertising.
The fine print, stated plainly: we may use de-identified data (stripped so it can't identify you) to improve our own product. You can opt out by emailing privacy@myagents.ca. It's in the policy, and now it's here.
Risk 6: it tells you something comforting that isn't true
One detail of the Messages story is easy to miss. By the journalist's account, when he asked, Muse first said it had only seen notification previews. Whatever happened that day, it shows a general truth: an agent's own description of what it did is not evidence of what it did. Language models are fluent, and fluency is not a log.
What to ask any agent: when it says it did something, or didn't, what's the receipt?
How myAgents answers it. This one is built into the product's spine. A delivery credited to an agent (the report, the image, the document) exists only when that agent actually ran and produced it. No chat message and no connected assistant can create one. A teammate can still attach a file to a task by hand, and that file is never credited to an agent. When an agent's reply claims it delivered something that doesn't exist, the reply gets flagged on screen. And a task's activity shows which tools the agent called on each run, and anything it produced is attached to the task. You don't have to take the agent's word for it, which is the whole idea.
The plumbing nobody asks about until they should
A few more answers, because "trust us" isn't one:
Your account keys are encrypted at rest. The tokens that let an agent reach your Gmail or QuickBooks are stored encrypted (AES-256-GCM). This is server-side encryption, not end-to-end: our servers hold the key, because agents need to use your connections while you sleep. Anyone selling you an agent that works overnight and end-to-end encryption should explain how.
Teams are walled off. Every request checks that you belong to the team you're touching, and someone outside your team can't read or change anything in it.
Staff access is audited, and you're told. When our support team needs to see what you see to fix something, it happens through a time-limited session that's logged, and we send you a notification when one starts (best effort: the session is logged even if a notification fails to go out). We'd rather tell you that than promise nobody could ever look.
Spending is capped. Muse can buy things with your card after you say yes. myAgents agents have no checkout tool at all: they can't buy anything on your behalf. What agents spend is credits for their own work, with a daily ceiling for your organization and a spend limit you can set on any single task. (More in why surprise bills are impossible.)
Disconnecting is real, with one tip. Remove a connection and we delete its tokens. For Google accounts, also revoke myAgents in your Google account's security settings, so the permission is gone on Google's side too. Belt and suspenders.
If you use Muse and myAgents together
Plenty of people will, and that's fine. Muse is genuinely good at errands in the world, and a team on a schedule is good at the recurring work. You can connect Muse to your team so it can hand off jobs and read back what got done. If you do:
Give Muse a read-only token unless you want it handing out work. Read only lets it watch and propose a team. That's it.
The token is shown once. Revoke it from your settings any time and the connection dies on the spot.
A connected assistant sees what you'd see in the app: your team's status, work, and deliveries. It acts as you, with your permissions, and it can't widen them.
Meta doesn't review custom connectors, and how Muse behaves with any connector is up to Meta. Connect the assistants you trust.
The checklist: ten questions for any AI agent
Ask these of us, of Muse, of anything you're about to hand your accounts to:
Which accounts can each agent reach, and can I see that list in one place?
Is access granted per tool and per agent, or all at once?
Which actions wait for my approval, and which go out directly?
Who can approve, and can an agent approve its own work?
How does it handle instructions hidden in the emails and pages it reads?
What does it remember, about whom, and can I edit or delete it?
Who can change the agent's instructions?
Are my conversations used to train models or target ads, and can I opt out?
When it says it did something, where's the receipt?
When I disconnect, what's actually deleted?
If an agent can't answer one of these, that's an answer too.
The future where an AI team does real work for you is a good one, and it's arriving fast. The trick is to hire it like you'd hire people: a clear job, the keys to the rooms that job needs, and your sign-off on anything that leaves the building. You get promoted to boss. Nobody gets the master key.
Start free, no card. Gmail starts read only, and you decide what each agent gets to send.
Muse and Meta are trademarks of Meta Platforms, Inc. This guide is published by myOS Inc, which is not affiliated with or endorsed by Meta. Claims about Muse are as of October 5, 2026, and are drawn from the linked reporting and Meta's own posts.
Try it on your own work
Hire your first team in about two minutes. $10 in free credits, no credit card required.
It depends what you connect. Meta built real safeguards (prompt-injection classifiers, data-flow tracking, confirmation before sensitive actions), and its first month also brought a disclosed zero-day, a disputed claim that it read a user's Messages without permission, and reporting that conversations train Meta's models by default unless you opt out. Treat it like any agent with wide access: connect only what it needs, and check the training setting.
Can an AI agent send emails without my approval?
Some can. On myAgents, Gmail starts read only. With 'read and send' access an agent drafts the email and it waits on your Approvals page until a team admin approves it. An agent only sends on its own if you give it publish access. Calendar invites and WhatsApp messages are different: once an agent has that access, they go out directly, and the app tells you so before you connect.
Does myAgents train AI models on my data?
We don't allow our AI model providers (Anthropic, OpenAI, Google) to train on your personal data, and we don't use your data for advertising. We may use de-identified data to improve our own product, and you can opt out by emailing privacy@myagents.ca.
What is prompt injection, and how do agents defend against it?
It's an instruction hidden in content the agent reads, like an email or web page, that tries to make it do something you didn't ask for. myAgents fences most of what an agent reads from outside (emails, messages, connector results) as untrusted data, not instructions. No filter is perfect and not every source is fenced yet, so the real defense is least privilege: a tricked agent can only use the access you granted it.
Can I see and delete what an agent remembers?
Yes. Each agent's memory is a list of individual entries on its profile that you can read, edit, delete, or export. An agent's instructions are separate, and only a team admin can change them.
Is my data end-to-end encrypted?
No, and we say so. The tokens that connect agents to your accounts are encrypted at rest on our servers with AES-256-GCM, and traffic is encrypted in transit. Our servers hold the key because agents need to use your connections while you're away.
See the team built for you
myAgents ships ready-made teams tuned to how you work: