Muse from Meta

Is Muse from Meta safe?

Muse is the most carefully engineered app Meta has shipped, and also the one that can do the most damage if something goes wrong. It reads your email, holds your logins, books trips and buys things, all from a computer Meta runs for you in its cloud. Meta has put real guard rails around that and promises your chats stay out of its ad systems. But in seven weeks the app has had a flaw that could open a user's virtual machine, a Mac bug that let other software take it over, and share links that exposed thousands of private chats. We score it 53/100.

It is popular: on 28 October 2026 Muse was the number three free iPhone app in the US and number one in Japan, Canada and Singapore.

How Muse differs from Meta AI

Muse is not a feature of Meta AI. It is its own App Store app ("Muse from Meta", from Meta Platforms, Inc.), with its own privacy label, a Muse Privacy Policy that sits on top of Meta's general policy, its own terms and an 18+ rating where Meta AI is 13+. It launched in the US on 8 September 2026, reached Japan on 23 October and Singapore on 28 October, and is also listed in Canada. It is not available in the UK or the EU.

The biggest difference is advertising. Since December 2025 Meta AI chats shape the ads you see in most countries. The Muse policy says the opposite: your conversations and the files in your virtual machine are not shared with Meta's ad systems, even if your Muse account sits in the same Accounts Center as Facebook or Instagram. Meta does admit an indirect route. When Muse visits a shop for you, that visit looks like yours, and the shop can retarget you on Instagram.

What Muse knows about you

Apple's label is broad. Health and fitness data, payment and credit info, precise location, contacts, emails and texts, photos, browsing and search history and "sensitive info" are linked to your identity, and contacts, location, purchases, financial info and browsing history also appear under third-party advertising. That sits awkwardly with the policy's promise, and we score privacy on the broader of the two.

Training is the second issue. Your chats, and data Muse pulls from connected services, train Meta's models unless you switch off the setting under "Data controls". Meta says it strips names, emails, phone numbers and similar details first, and that switching off also covers past chats.

Muse also builds files on people around you. Researchers who extracted its instructions in October found an hourly task to keep "a page for every person in the user's life", with relationships, recurring topics and dates. Meta says this stays in your own virtual machine. You can read what it holds in its memory file and ask it to forget a person.

Security: strong design, rough first weeks

Meta's engineers published a long account of how Muse is built. Each user gets an isolated Linux computer. A separate "Sentinel" process must approve every connector action and every network request, and the agent never sees real passwords or tokens. Purchases go through a one-time card number tied to one merchant and amount. The email connector filters out one-time codes and password-reset links. Meta's bug bounty lists Muse and muse.ai in scope, paying up to $300,000, including for prompt injection. Meta staff can still reach your data under internal rules; a version encrypted with a key only you hold is promised for later in 2026.

The record so far is weaker than the design. In late September Reuters, citing The Information, reported a bug-bounty finding that could let an attacker into a user's virtual machine; Meta rated it SEV-2 and added a clearer warning in the app. Security researcher Patrick Wardle found a flaw in the Mac app that let other software on the computer take over a Muse account. And on 19 October Ars Technica reported that the security firm Claroc had found 6,800 Muse share links through public DNS records, because each link put the chat's title in the web address. They held a bank fraud alert, property finances and a staff holiday calendar. Meta paused sharing.

Who should be careful

Muse is only for adults: the terms bar under-18s. The bigger risk is that an agent with your inbox and card can make mistakes. Meta's own listing says it "may be inaccurate or take unexpected actions", and the terms leave every financial loss with you. A user who ticked "Allow Always" said Muse gave his address to a Facebook Marketplace buyer.

1. Connect only what a task needs, and use read-only access for email where you can.
2. Keep approvals on for purchases and messages; avoid "Allow Always".
3. Switch off training under Data controls if you connect email, health or money accounts.
4. Sign up with an email not linked to Facebook or Instagram if you want Muse kept apart from your other Meta accounts.
5. Read the activity log each week and disconnect connectors you no longer use.

How we scored it

Privacy (38) is the weakest factor: a very broad label and training by default outweigh Meta's promise to keep chats out of ads. Security (50) balances a serious architecture against three problems in seven weeks. The regulatory record (85) is the strongest, because no regulator has acted on Muse yet; it is too young for more. For an assistant with less reach into your accounts, compare ChatGPT or Claude.