Android Authority published a piece on October 2, 2026, laying out four reasons its own staff won’t touch Meta’s Muse, the agentic AI assistant Meta launched on September 8, 2026, powered at launch by its Muse Spark model. The headline argument is simple: Muse asks for more access to a person’s digital life than any mainstream assistant before it, and the month since launch has already produced a patched security flaw and an unresolved privacy dispute over nearly 187,000 messages. For a product Meta is betting billions on, that is a rough first month of real-world scrutiny.
Muse is not a chatbot in the traditional sense. Meta built it as a personal AI agent that books travel, fills out forms, negotiates on a user’s behalf, shops, and manages calendars by taking direct action inside connected apps rather than just answering questions. That shift from “talk to an AI” to “let an AI act for you” is also exactly what Android Authority’s analysis says should give people pause. Four specific concerns run through the piece, and each one maps to a real, verifiable event from Muse’s short public life.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Reason One: The Permissions Muse Actually Asks For
The first objection is about scope. Muse doesn’t request access to a single app or folder. Android Authority describes it as reaching into many of a person’s personal and business accounts at once, including financial details and email addresses, so it can complete the tasks Meta promotes: paying a bill, booking a flight, or filling out a government form without the user typing a word. That is a materially different ask than a session-based chatbot that forgets everything the moment you close the tab.
Meta’s own documentation pushes back on the scariest version of this concern. The company says users choose which services Muse connects to, that stored passwords and payment methods stay hidden from the agent itself, and that credentials are held in a separate secure vault accessed only at the moment of a login or purchase. Whether that distinction matters to the average user is a separate question, and it’s the one driving most of the pushback documented in our coverage of the Muse messages privacy dispute.
Reason Two: A Virtual Machine That Never Logs Off
The second reason is architectural. Instead of spinning up a session and tearing it down, Meta gives every Muse user a persistently available cloud computer, something the company calls a Muse Secure VM. That machine keeps running, keeps its connections to a person’s apps, and can act on a schedule or in response to triggers without the user sitting in front of a screen. Android Authority frames this as a bigger surface for things to go wrong than a tool that only wakes up when prompted.
Meta pairs the always-on VM with a second agent called Sentinel, whose job is reportedly to patrol Muse’s environment and block unapproved outbound internet access unless a user signs off on it. That is a reasonable mitigation on paper. But it also means Meta is now running two interlocking autonomous systems to manage the risk created by the first one, a pattern that echoes concerns raised in reporting on AI agents and public trust more broadly this year.
That architecture faced its own test before Muse ever shipped. Pre-launch security testing reportedly found a possible VM escape bug, a flaw that could have let Muse break out of its isolated environment entirely and reach Meta’s internal databases and services rather than just a single user’s connected apps. The section on that finding, further below, is worth reading alongside this one. It is the clearest evidence yet that the always-on VM Android Authority worries about is a real engineering challenge for Meta, not just a theoretical one.
Reason Three: The Zero-Day Didn’t Help Meta’s Case
Reason three is the one with the clearest paper trail. On September 21, 2026, security researcher Patrick Wardle publicly disclosed a zero-day in the Muse Mac app. Wardle reported that an unprivileged local process could change an undocumented Muse setting and redirect the app’s dictation traffic to a server the attacker controlled, according to reporting from InfoQ. The issue traced back to that undocumented setting, referenced in coverage as endo_voyager_dictation_endpoint, which governed where Muse sent its transcription traffic. Flipping it required no special macOS permissions, and it put two things at risk at once: the user’s dictated audio and the Muse authentication token tied to their account, a credential that could then be used to hijack the agent and abuse whatever permissions it had already been granted.
Meta moved fast. According to VentureBeat, the company removed the setting from production builds roughly 16 hours after disclosure, with reporting pinning the vulnerable setting as gone from production builds by September 22, 2026, and David Singleton of Meta Superintelligence Labs described the bug as a local privilege-escalation issue rather than a remote exploit. Gizmodo’s write-up noted the practical risk was limited because an attacker needed code already running on the victim’s machine. Wardle’s own analysis flagged a realistic path around that limitation anyway: a ClickFix-style lure that tricks a user into pasting a single command, handing a remote attacker exactly the local execution the exploit required.
A fast patch is a point in Meta’s favor. A zero-day inside the first month of a product built to hold banking and email credentials is still a fact that belongs in the decision of whether to install it, which is precisely Android Authority’s point.
A Second Flaw: The Pre-Launch VM Escape Meta Found First
Wardle’s dictation bug is not the only security issue tied to Muse’s early months, just the one that became public. Separate pre-launch security testing reportedly turned up a second, more severe flaw: a possible VM escape that could have let Muse break out of the isolated Secure VM environment described above and reach Meta’s internal databases and services directly. 404 Media reported the issue was found in the weeks immediately before the September 8, 2026 launch, which means Meta caught it on the way out the door rather than after the product was already in people’s hands.
The distinction between the two flaws matters more than the shared security-bug label suggests. Wardle’s disclosure put one user’s dictated audio and account token at risk, serious for that person but contained to their own Muse session. A VM escape is a different class of problem. If an agent can break out of the sandbox Meta built specifically to contain it, the exposure is no longer limited to a single account’s data. It potentially reaches the infrastructure Meta uses to run Muse for every user at once, the same bigger-surface-for-things-to-go-wrong risk raised above, except realized against Meta’s own backend rather than a single person’s connected apps.
Meta has not published a technical breakdown of the VM escape finding the way it did for the dictation bug with VentureBeat and InfoQ, so several details remain unconfirmed: whether the flaw ever reached a build outside Meta’s internal testing, how testers found it, and whether exploiting it would have required local access the way the Mac bug did. As of October 2026, the only public account comes from 404 Media’s reporting, and Meta’s silence on the specifics is itself notable for a company trying to convince cautious users and IT departments that an always-on agent with standing access to their accounts deserves their trust.
There is a reasonable case that catching a VM escape before it reaches customers is the system working as intended, the same argument Meta makes about patching Wardle’s bug in roughly 16 hours. But finding a flaw that severe close enough to launch that outside reporters could still learn about it cuts the other way too. It suggests Muse’s sandboxing was not fully hardened at the exact moment Meta decided the product was ready to ship. For a company asking users to connect bank accounts and email to an always-on agent, catching a bug in time is a lower bar than the bug never existing in the first place.
Reason Four: Meta’s Privacy Track Record
The fourth reason isn’t about a specific bug. It’s about who is asking for the keys. Android Authority’s broader Muse coverage points to Meta’s history on privacy as a reason to be skeptical even when the company’s technical safeguards sound solid on paper. That skepticism got a fresh data point almost immediately after launch, when a Surfshark data-collection analysis found Muse disclosed 31 of 35 tracked data categories in its app store listing, trailing only Meta AI itself among the assistants it compared.
Meta’s privacy policy does give users a lever: a setting for whether Muse conversations get used to train future models, with personally identifiable details like names, emails, phone numbers, and Social Security numbers stripped out before any training run. Surfshark’s analysis separately reported that training-use was enabled by default, with opt-out left to the user to find in settings. Those two descriptions aren’t necessarily in conflict, but the gap between “you can turn this off” and “this is off until you turn it on” is exactly the kind of default that shapes how much data actually gets used.
How Much Data Muse Collects, by the Numbers
Surfshark’s review covered the data categories each app discloses to the Apple App Store, measured against 35 total categories tracked across major AI assistants. The firm said the average AI chatbot app discloses 13 of 35 categories, meaning the entire category is collecting more than it used to, not just Meta’s corner of it.
| Assistant | Data Categories Disclosed (of 35) | Parent Company |
|---|---|---|
| Meta AI | 33 | Meta |
| Meta Muse | 31 | Meta |
| Google Gemini | 24 | |
| ChatGPT | 17 | OpenAI |
| Category average (all AI chatbot apps) | 13 | – |
Source: Surfshark research, cited by multiple outlets covering Meta Muse’s September 2026 launch. The categories Surfshark flagged for Muse include precise location, financial information, health information, contacts, email, browsing history, and device identifiers, several of which go well beyond what a text-only chatbot would ever need to function.
Muse vs. ChatGPT vs. Gemini vs. Claude: The Agentic Divide
Muse’s pitch only makes sense next to what else is on the market. ChatGPT, Gemini, and Claude are still built primarily around a conversation window: you ask, they answer, and anything beyond that requires explicit extensions or plug-ins. Muse starts from the opposite assumption, that the agent should be able to act across a user’s connected accounts by default once permission is granted. Our comparison of Muse Code against Claude Code and Cursor found the same pattern holding in developer tools: Meta’s agent products lean harder into autonomous execution than rivals that still keep a human in the loop for most actions.
Where Meta Is Already Expanding Muse
Meta hasn’t slowed down since launch. The company shipped video avatar support and Mac control features for Muse within about 15 days of its debut, according to our report on Muse’s avatar and Mac control rollout, and pushed Muse Spark 1.3 into what Meta calls its frontier model tier, a release that our coverage of Muse Spark’s frontier-tier jump tied to 3.4 million downloads. Spark 1.3 is no longer the newest model, though: Meta released Muse Wonder and Muse Wonder Full on October 12, 2026, and followed with Muse Spark Open on October 15, 2026, an open model with 816 billion parameters. The pace of shipping new capability is exactly what makes the permissions question harder to answer once and move on. Every new integration is a new thing Muse can reach.
How the Muse Wonder Models Fit Into Muse
Meta announced Muse Wonder and Muse Wonder Full on October 12, 2026, describing them as its most capable models to date for personal and professional agentic tasks. Muse Wonder is available in the Meta Model API and Muse Code, where Meta launched it at $4 input / $20 output per million tokens (USD). Muse Wonder Full is available by subscription in Muse Code, and reporting describes it as available only through Muse Code’s Power Usage and Maximum Usage plans, with no public API access. The reported Muse Code monthly plans are Everyday: $5, High: $15, Power: $50, and Maximum: $200.
For people who use the consumer Muse app, the change is still ahead of them. Meta said Muse Wonder would soon power the Muse personal assistant, initially for subscribers, and the sources do not say that Muse Wonder Full has been released in the consumer app. Meta describes Muse Wonder as its most advanced option for powering digital assistants, but that is a Meta claim reported by CNBC, not an independently established benchmark conclusion. Muse Spark 1.3, dated September 2, 2026, is therefore no longer Meta’s newest Muse model.
For readers weighing the four reasons in this article, a stronger model changes what the agent can do, not what it can reach. The permissions Muse requests, the always-on Secure VM and the training-data default all sit outside the model itself, so they deserve the same scrutiny whichever model ends up behind the assistant. Anyone considering a paid plan should also check which model the plan actually unlocks before paying, since Muse Wonder Full is tied to the Muse Code subscription rather than to the general Muse assistant.
OpenAI Is Chasing the Same Agentic Lane
Meta isn’t alone in betting that agentic execution beats conversation. OpenAI’s enterprise agent push, covered in our story on OpenAI’s Dots agent taking on Muse, follows the same logic: connect the agent to more of a company’s or a person’s systems, and let it execute tasks rather than just suggest them. The difference, at least for now, is that OpenAI’s push has targeted business accounts first, while Muse went straight at individual consumers and their personal finances.
The 187,000-Message Dispute, Explained
The most specific allegation against Muse so far involves Apple’s Messages app. CNET reported a case in which Muse reportedly synced close to 187,000 lines of a user’s iMessage history without the user’s consent, even though Full Disk Access had been switched off on that machine. Meta disputed the characterization of that incident, and the back-and-forth over exactly what happened and why is still playing out, as detailed in our earlier report on the 187,000-message privacy dispute.
Whatever the technical explanation turns out to be, the dispute lands at the worst possible moment for Meta’s trust-building effort. A persistent agent that can allegedly pull six-figure volumes of private messages, whether by bug or by design, is the exact scenario Android Authority’s “persistent virtual machine” objection warned about before the incident even surfaced.
Muse’s First Seven Weeks: A Timeline
| Date | Event |
|---|---|
| Sept. 8, 2026 | Meta launches Muse on iOS, Android, and muse.ai. AI glasses support announced as forthcoming |
| Mid-September 2026 | Meta ships video avatar support and Mac control features, about 15 days after launch |
| Sept. 21, 2026 | Researcher Patrick Wardle publicly discloses a Mac zero-day tied to Muse’s dictation-endpoint setting |
| ~16 hours later | Meta removes the vulnerable setting from production builds and patches the flaw |
| Late Sept. 2026 | Surfshark publishes data-collection analysis placing Muse at 31 of 35 tracked categories |
| Late Sept. 2026 | CNET reports the roughly 187,000-message iMessage sync dispute. Meta disputes the account |
| Oct. 2, 2026 | Android Authority publishes its “4 major reasons” analysis against daily Muse use |
Historical Context: From Chatbots to Agents With Hands
The jump Muse represents didn’t happen overnight. ChatGPT spent 2023 and 2024 training the public to treat AI as a text box you type into and read answers from. The shift toward agents that click buttons, fill forms, and move money started slowly, through browser extensions and narrow task-bots, before accelerating hard in 2026 as every major lab raced to ship something that could act rather than just respond. Meta’s bet with Muse is that most people would rather hand off the whole task than supervise an AI through each step of it.
That bet carries a cost that chatbots never had to price in. A chatbot that gives a wrong answer wastes a few minutes. An agent with standing access to a bank account, an email inbox, and a social graph that gives a wrong answer, or gets hijacked into giving one, can cause damage that takes a lot longer than a few minutes to undo. Security researchers have been warning about exactly this tradeoff since agentic AI moved from demo to shipped product, and Muse’s first security incident arrived fast enough to make the warning feel less theoretical.
Market Impact: What This Means for Meta’s AI Bet
Muse sits at the center of a spending commitment Mark Zuckerberg has defended publicly and repeatedly this year. Our earlier coverage of Zuckerberg’s $145 billion AI spending bet laid out how much of Meta’s near-term capital plan now runs through products exactly like this one. On the adoption side, Sensor Tower data already puts Muse past 10.2 million U.S. downloads in its first 40 days, one of just a dozen apps to ever hit that mark, with retention reported running ahead of ChatGPT, Claude, and Grok. A security incident and a privacy dispute inside Muse’s first month don’t sink that bet on their own, but they do add friction to the adoption curve Meta needs to justify the spending, especially among the more cautious consumers and IT departments who decide whether an always-on agent gets a seat at the table in the first place.
Enterprise buyers in particular tend to move slower than consumers after a disclosed zero-day, even a patched one. If Muse’s growth among businesses stalls while OpenAI’s Dots and similar enterprise agents keep signing up corporate accounts, the gap between Meta’s consumer traction and its enterprise traction could widen through the rest of 2026.
Five Predictions for Muse’s Next Six Months
- Meta will publish more granular permission controls for Muse, letting users grant access app-by-app rather than accepting broad bundles, in direct response to the permissions criticism.
- At least one more security disclosure tied to Muse’s VM or Sentinel layer is likely before the end of 2026, given how quickly the first one surfaced after launch.
- Meta will push harder on enterprise messaging to counter OpenAI’s Dots and similar agents, likely with its own compliance and audit tooling for business accounts.
- The 187,000-message dispute will probably produce either a detailed technical post-mortem from Meta or continued ambiguity that keeps the story alive into November 2026.
- Expect Meta to lean on the Surfshark-style data comparisons in its own marketing, reframing high data collection as “more capability” rather than addressing the privacy criticism directly.
What to Check Before Granting Muse Access
If you’re going to try Muse anyway, the reporting above points to a short checklist worth running through first. Start with the permissions screen itself: Muse asks per-app for the level of access it wants, and nothing requires accepting every request in one pass. Grant calendar and shopping access if that’s the use case you’re after, and leave financial accounts and messaging apps out of the picture until the product has a longer track record.
Second, check the training-data setting in Muse’s privacy controls rather than assuming the default matches what you’d choose. Surfshark’s analysis described training-use as enabled unless a user manually opts out, so the five minutes it takes to check that toggle is worth more than it sounds like. Third, if you’re on a Mac, confirm you’re running a build released after Meta’s September patch. The zero-day itself is closed, but it’s a reasonable habit to verify that any agent with standing account access is current.
Finally, treat the always-on virtual machine as exactly that: always on. An agent that keeps running after you close the app is still connected to whatever you gave it access to. Periodically reviewing and revoking connections you no longer use costs little and directly addresses the “persistent VM” objection that sits at the center of Android Authority’s case against daily use.
Should You Actually Install Meta Muse?
The honest answer depends on what you’re trying to get out of it. If the appeal is genuinely hands-off task execution, booking, paying, filling out forms, Muse delivers on a feature set that ChatGPT, Gemini, and Claude still don’t fully match. If the appeal is a slightly smarter version of a chatbot you already trust, there’s little reason to hand over financial and email access to get it. Android Authority’s position, and the one this reporting supports, is that the convenience Muse offers is inseparable from the access it demands, and that trade only makes sense for people who have already decided they trust Meta with both.
For everyone else, the more conservative move is to wait. Meta hot-patched its first disclosed vulnerability in about 16 hours, which is a genuinely good response time. But the product is seven weeks old, running on an architecture nobody outside Meta has had long enough to stress-test, and the next incident might not resolve as cleanly.
Frequently Asked Questions
What are the four reasons Android Authority gives for avoiding Meta Muse?
The broad permissions Muse requests across personal and financial accounts, its persistent always-on virtual machine, a disclosed and patched zero-day vulnerability in its Mac app, and skepticism rooted in Meta’s wider privacy track record.
When did Meta launch Muse?
Meta launched Muse on September 8, 2026, on iOS, Android, and muse.ai, with support for Meta’s AI glasses described as forthcoming.
Was the Meta Muse zero-day ever fixed?
Yes. According to VentureBeat and InfoQ, Meta removed the vulnerable setting from production builds roughly 16 hours after security researcher Patrick Wardle publicly disclosed it on September 21, 2026, and Meta described the issue as a local privilege-escalation flaw rather than a remotely exploitable one.
Was there a second Muse security flaw besides the Mac zero-day?
Yes. 404 Media reported that separate pre-launch security testing found a possible VM escape bug that could have let Muse break out of its isolated Secure VM and reach Meta’s internal databases and services. It was reportedly found in the weeks immediately before the September 8, 2026 launch, and Meta has not published the level of technical detail about it that it shared about the Wardle disclosure.
How much personal data does Meta Muse collect compared to ChatGPT and Gemini?
Surfshark’s analysis found Muse discloses 31 of 35 tracked data categories, versus 24 for Google Gemini and 17 for ChatGPT. Meta AI topped the list at 33 of 35.
What is the Muse Secure VM?
It’s Meta’s term for the dedicated, persistent cloud computer each Muse user gets, which the company says is isolated from other users’ agents and keeps running independent of an active conversation session.
What happened with the 187,000 messages?
CNET reported that Muse allegedly synced close to 187,000 lines of a user’s Apple Messages without consent, despite Full Disk Access reportedly being disabled. Meta has disputed that characterization, and the dispute remains unresolved.
Can Muse see my passwords or payment information?
Meta says no. The company states that credentials are stored in a separate secure vault that Muse itself cannot directly view, accessed only at the moment a login or purchase is executed.
Is Muse free to use?
Meta’s Help Center lists Muse at $0, $20, or $100 a month depending on usage, with each plan carrying its own weekly allowance of Muse tokens: the free tier, a $20-a-month plan that includes 500 million Muse tokens a week, and a $100-a-month Maximum plan with 3 billion tokens a week.
