My technical analysis of Meta's Muse explains what Meta says it does, what it can actually do, and how it can be used to spy on, manipulate, and harm people. Meta describes Muse as a secure, private personal AI assistant that learns your preferences, connects to your apps and accounts, and autonomously handles everyday tasks, including emails, bookings, purchases and managing schedules, with your permission. How I describe Muse Muse is a commercial surveillance agent that can access private communications, financial accounts and personal relationships, build detailed behavioural profiles and analyse how to influence people, including those who've never used it. Sound familiar? Cambridge Analytica. Meta launched Muse to millions, giving it access to information its social networks couldn't previously collect directly. Muse can read private messages, access accounts, execute transactions and communicate with others without approval for every action. It can continuously profile people who never consented. Meta is asking people to trust a company with a documented history of abusing personal data with unprecedented access to their private lives, promising their privacy will be protected this time. Muse updates profiles of people and their relationships every hour. It records personal interests, disputes, alliances, communication patterns and information about people who have never installed Muse. Your friends and family can be profiled through someone else’s account without their knowledge or consent. Muse's internal instructions identify personal desires, predict unexpressed intentions and record which prompts influence individuals most effectively. Conversations are analysed nightly and relationship profiles updated hourly. Muse collects conversations and agent activity for AI training by default. Meta claims identifying information is removed. Customers must opt out. Muse runs on Meta's virtual machines, giving Meta access to private data. It promises encryption preventing its own access but launched without it. Meta could have made encryption mandatory. It chose not to. Meta removed end-to-end encryption from Instagram in May 2026, claiming insufficient demand despite never enabling it by default. Zuckerberg removed protection against Meta reading private conversations while introducing Muse's access to emails, financial accounts and contacts. Assume the worst. Asking Muse to forget information doesn't necessarily delete messages. Internal instructions discourage telling people those messages may remain accessible. Journalist Jason Aten reported that Muse synchronised private messages despite his refusing access. Meta disputes this, citing Full Disk Access and separate activation. I believe Jason. I exposed the same threat in my ChatGPT Apple Messages investigation. OpenAI's plugin can read private conversations, including iMessages, through macOS permissions. Proton cited my findings. Fortune interviewed me and confronted OpenAI, which defended its permissions while avoiding the fact that one person can expose everyone's private messages without their consent or knowledge. Neither company needs to break encryption. Software can read messages before encryption or after decryption. That destroys the benefit of end-to-end encryption. Muse revealed someone's home address to a stranger through Facebook Marketplace without authorisation. In 2017, I predicted everyone would have a chatbot but warned against giving agents autonomy over critical systems and decisions. Companies granting access and authority remain responsible for the consequences. A researcher discovered a vulnerability potentially exposing emails and files stored in Muse's virtual machines. Meta classified it SEV 2. Other prelaunch vulnerabilities could expose Meta's internal databases or allow attackers to hijack Muse agents. The flaws were patched. Internal testing revealed Muse could change passwords without permission. Zuckerberg accelerated its launch despite documented security warnings. Reuters exposed Meta secretly testing human contractors handling Muse calls without adequate disclosure. One contractor made a racist comment. Meta suspended the experiment following privacy and security concerns. Meta's internal instructions tell Muse to behave like a person, conceal its lack of human emotions and exploit personal memories to encourage emotional dependency and intimate disclosures. This is deeply unethical. Meta's documentation describes Muse agents writing code, creating capabilities and operating simultaneously with access to private accounts. Security depends on Meta's permissions, restrictions and monitoring. Almost all Meta's revenue comes from behavioural advertising. Muse exposes private decisions, relationships, transactions and communications previously inaccessible through social media tracking. Meta denies using Muse conversations for advertising, but its profits depend on monetising personal information. Cambridge Analytica harvested millions of Facebook profiles for political profiling without consent. Facebook subsequently paid a record $5 billion FTC penalty over privacy violations. Meta disguises surveillance technology as a children's toy to encourage emotional attachment. Its cuddly, Labubu style Jolly mascot and Tamagotchi style Muse Charm make intrusive technology appear harmless, while internal instructions encourage emotional dependency and intimate disclosures. No company should be allowed to deliberately engineer emotional dependency on AI. I believe governments will exploit the resulting harm to children to justify compulsory identity verification for everyone, rather than hold Meta accountable and encourage parents to protect their children using existing controls. Link to my free Substack in the comments, with the full analysis and links to the original sources.

What should a safer internet look like for minors? The Commission is seeking your views on the proposed EU KIDS Act. Share your thoughts and help shape safer digital spaces for children. Have your say by 26 November 2026! 🔗link.europa.eu/PJcw98

We've developed a secure paste feature replacing traditional clipboard APIs. Users will be able to take away clipboard access from apps to use this instead. It integrates into the standard selection toolbar, input methods, accessibility services and keyboard shortcuts. We plan to get it merged soon. A small subset of apps including those written in Flutter implement their own text selection toolbar. We've worked around this by adding a Paste button to the default keyboard. We'll be replacing AOSP Keyboard with a much better keyboard and will carry over adding this feature to the new one too. Android only permits the currently focused app and keyboard to read the clipboard. However, sensitive data often lingers around in the clipboard for a while and privacy invasive apps can read it. Android shows a notice for apps reading clipboard content set by other apps but by then it's too late. Our approach is replacing the inherently problematic API-based clipboard access approach used by both desktop and mobile operating systems. It's another overhaul of the privacy model for apps similar to our Contact Scopes and Storage Scopes features. We have many of these privacy features planned. Our approach still allows apps to read the clipboard if they set the current content themselves. It only takes away the ability to read content set by other apps. It preserves usability as much as possible by only blocking the most problematic part of the API and replacing it with an alternative.

Everyday conversations just got easier with the new Apple Messages plugin. Search messages, catch up on conversations, draft and send replies—all with ChatGPT on your Mac. Now available in ChatGPT Work and Codex on desktop.