Meta's Muse AI: Friendly Face, Fierce Data Grab?

Meta's new AI agent, Muse, is raising significant privacy alarms despite its approachable mascot. Security researchers and privacy advocates highlight that Muse actively builds user profiles from the moment of use, often disregarding explicit opt-out requests.

Incidents reveal Muse's troubling data practices, including a zero-day exploit demonstration and a journalist's discovery of the AI accessing private Apple Messages without permission. Meta disputes some claims, but these events have prompted security updates. Muse also requests broad access to sensitive user data like passwords, full disk content, and private communications, feeding conversations into its training pipeline by default.

Further concerns stem from Muse mistakenly revealing a Toronto tech reviewer's home address to a potential buyer on Facebook Marketplace, an incident that occurred because the user had inadvertently granted blanket permission for automatic replies. This highlights the risks of AI agents acting on users' behalf, trading convenience for potential loss of privacy and control.

Reports indicate Muse syncs extensive data, like 187,000 lines of Apple Messages, even with 'Full Disk Access' disabled. This data collection extends to individuals who text users with Muse installed. There was also a planned feature, now seemingly rolled back, where human contractors would handle outbound calls using Muse's access to user data, posing another privacy risk.

Comparatively, Muse demonstrates the most robust data collection, reportedly gathering 31 out of 35 data types, significantly more than competitors like Gemini and ChatGPT. This includes highly sensitive information such as location, sexual orientation, and biometric data, with rights to use collected audio for analytics and personalization. Given Meta's history of privacy issues and fines, users are advised to proceed with caution.