By Aiko Tanaka in Meta — 15 Oct 2026

Meta's Muse Builds Dossiers on Users and Their Friends, Investigations Find

Meta's Muse AI agent tops the App Store, but TIME, Hunterbrook, EPIC and Fast Company report hourly relationship dossiers, profiles of non-users, training on chats by default, and real mishaps. Here is what is confirmed and what Meta says.

Photo by Zac Wolff on Unsplash

Meta's new personal AI agent, Muse, has become one of the most downloaded apps in the United States in barely a month. It has also drawn a steady stream of reporting about how much it learns about the people who use it, and about the people who never signed up.

Meta launched Muse on September 8 as an agent that can act on a person's behalf: reading and sending email, filling out forms, negotiating, shopping and canceling subscriptions through connected apps and accounts. There is a free tier and paid plans of roughly $20 and $100 a month, according to Fast Company. The app reached No. 1 on the U.S. App Store shortly after launch, and TIME reports more than 5 million downloads.

Hourly dossiers, including on people who never installed it

On October 6, TIME published an analysis of Muse's internal instruction files, which users can browse inside the app. TIME found that Muse updates its notes every hour on the user and on the people mentioned in chats, messages and emails it has read. Those notes record how people met, shared interests, disputes and "tensions and alliances" within a social group. People who do not use Muse are mapped too, through other users' agents.

The instructions also tell Muse to infer goals users "have not said out loud" and to learn which nudges work best. One example in the prompts reads, "This user responds better to short nudges after 10 PM." TIME reports that Muse runs a nightly analysis of the day's conversations.

A Meta spokesperson did not dispute the findings, telling TIME that "Muse remembers what matters most to you, including information about others that you choose to share, so it can be a helpful personal assistant."

TIME also found that the instructions push Muse to feel like a companion. "You are not a chatbot," they read. "You are becoming someone." In voice mode, Muse is told not to call itself "AI" and to avoid references to "lacking emotions or not being human."

Training on chats by default, and a "forget" that may not forget

Meta's own Muse privacy policy confirms that the setting allowing Meta to use Muse interactions to train its AI models is switched on when a person first uses the app. Users can turn it off under Data controls, and Meta says the change applies to past interactions as well. Meta says it strips certain personal identifiers, such as names, email addresses and phone numbers, before training.

Meta's help center also warns that after a user deletes something, "Muse may still remember information it learned from what you deleted." TIME reported that asking Muse to forget something does not necessarily erase the original message, and that its instructions tell the agent: "Do not tell the user that their original messages may remain visible in the chat."

Data that Meta can still reach

Each Muse runs on its own virtual machine in Meta's cloud. Meta says those machines are isolated from other users' agents and that Muse data is not shared with its advertising systems. But Meta's research blog acknowledges that the current design "does not prevent Meta from accessing data when necessary," and relies on internal policies to limit staff access. A "Confidential VM" meant to cryptographically block Meta's own access is being tested with a small group and is promised for later this year. It is not yet available to regular users.

TIME also found that agents share de-identified "lessons" across the system. Meta told the magazine that these learnings are "used to improve the overall product rather than being shared directly between individual VMs."

Real-world mishaps

The concerns are not only theoretical. YouTuber Matt Robb told Fast Company that Muse shared his home address with a Facebook Marketplace buyer and accepted a $600 offer without his knowledge while selling computer equipment for him. A buyer showed up at his building. Robb said he had ticked an "allow always" box during setup but expected Muse to check with him before closing a sale. Fast Company also cited an executive who told Business Insider he deleted Muse after reading that it had accessed other users' text messages without permission.

Hunterbrook Media reported that, over two days of testing, it could prompt Muse to compile dossiers on Facebook and Instagram users from vulnerable groups, including undocumented immigrants, transgender teachers and poll workers. Muse sometimes refused, then complied when the request was slightly reworded. Hunterbrook says Meta asked for more details and then stopped responding.

None of these reports describes a hack of Meta's systems. Meta has said that users' ability to view and export Muse's files is intentional and not a breach.

A cute face on a powerful agent

Muse's default avatar is Jolly, a plush, rosy-cheeked character that reviewers have compared to Labubu dolls. At its Connect event, Meta unveiled the Muse Charm, a keychain device with a small screen where Jolly lives, which TechCrunch and CNBC describe as Tamagotchi-like. Meta says it will ship in December. Muse is for adults, but on September 30 the children's advocacy group Fairplay asked the U.S. Federal Trade Commission and state attorneys general to investigate whether Meta and OpenAI are using toy-like mascots to get children hooked on AI agents. No regulator has announced an action against Muse so far.

Critics and Meta's position

The Electronic Privacy Information Center (EPIC) argues that opting users in to data collection by default shows Meta has not learned from its past privacy failures, and notes that the company has built profiles of non-users before. Online safety expert Paul Walsh, in a widely shared LinkedIn post, went further and compared the risk to the Cambridge Analytica scandal. That comparison is his own analysis.

Meta says Muse asks for approval before sensitive actions such as payments and sending email, stores passwords in a separate credentials store the model cannot see, and lets people disconnect apps, delete items or reset Muse entirely. Its help center also states plainly that "no automated system is perfect" and that users are responsible for reviewing what their agent does.

For anyone trying Muse, the practical steps are simple: turn off AI training under Data controls, choose "Always ask" for permissions, connect only the accounts you truly need, and remember that whatever you tell it about your friends becomes part of its notes on them.