Meta says Muse can hold information about people who never signed up

On 15 October 2026 at 16:21 UTC, Janus Rose reported in The Verge that Meta’s Muse agent can build a picture of people in a user’s life from what that one user connects and shares. The piece quotes Signal Foundation president Meredith Whittaker and Electronic Frontier Foundation cybersecurity director Eva Galperin criticizing that arrangement, and it quotes a Meta spokesperson who says the gathering is opt-in and draws on public information plus what the user chose to share.

Meta’s own pages, opened the same day, describe the mechanism in plainer terms. A help page for people who do not use Muse says: “When others use Muse, information about you may be provided to Muse, even if you don’t use Muse directly.” One path is a user connecting apps or sharing text, images, video, or documents that contain someone else’s information. The page’s example is a connected calendar: asking Muse about the week’s meetings can put attendees’ names and event details into the request and the response. Another path is “information that is publicly available on the internet, which may incidentally include information about you.” The page says Meta cannot predict what will be included, “since the person using Muse chooses what they share.”

What Meta says it does with that information

On information from external sources about people who do not use Muse, the help page says: “we don’t link that information to any Meta account.” It says the information “is not stored in a way that allows Meta to reasonably identify which information belongs to a particular person.” It says Meta does not sell that information. Rights requests, it says, can be honored when the information is linked to a Meta account or stored so Meta can tell which person it relates to.

The Muse Privacy Policy, effective 17 September 2026, says interactions with Muse can include “information about you or others.” Connector data, such as emails and calendar events, is part of that when the user connects a service. The policy says connecting is the user’s choice, that Muse by default “will not take many important actions, like sending an email, without your approval,” and that many connectors can be limited to retrieving data. It says a user can ask Muse to forget information about specific topics or people, and can ask what Muse remembers or look at files such as MEMORY.md. It also says Muse does not share conversations, or the data in the user’s virtual machine, with Meta ad systems.

A 12 October report here covers the Muse Wonder models Meta said would power the app. A separate report covers a security firm’s claim that Muse reached sites without identifying itself as an agent.

What The Verge was told

Meta spokesperson Daniel Roberts told The Verge: “For any agent to be useful and actually help you achieve your goals, it needs to have context about you and those you interact with.” He said Muse “gathers that based on public information and from what you’ve chosen to share,” and gave examples: remembering that the person who sent an invoice is the plumber hired for a bathroom job, or which flowers a spouse said they liked. The Verge says he pointed to Muse’s opt-in process and to settings that “help people make the privacy choices that are right for them.”

Whittaker told The Verge the actions reach the person who installed Muse and the people that person communicates with, using emails, messages, contacts, photos, and more. She said: “There is no way to assume with a straight face that the majority of people installing this system understand the consequences of using it, or the creepy dossiers that are being compiled about those they know and communicate with.” “Creepy dossiers” is her phrase.

Galperin told The Verge: “The way that the user interface is set up is designed to encourage you to share as much as possible, often more than you realize, until it’s too late.” She called that setup dark patterns: “It’s using dark patterns, and as a result you end up with Muse doing things that people don’t want.”

A profile process this story did not open

The Verge writes that security researchers extracted Muse’s operating instructions and found a process that compiles and updates profiles of people in a user’s life on an hourly basis. It says Wired reported that the app tracks relationships, including “how close they are, what it is built on, how they act with each other, and what it seems to need right now,” and uses that for suggestions. The Wired article and the extracted instructions were not opened here. Meta’s help page and privacy policy say a user’s sharing and connectors can include information about other people. They do not describe an hourly profile of every contact.