Why You Should Not Use Muse for Business

Muse is the first mainstream AI agent that can act on almost everything a person touches: inbox, calendar, forms, shopping, and on the Mac, files and messages. For one person running errands, that is the point. For a business, it means an employee can hand a Meta-run agent access to client email, company cards and work devices, under consumer terms, with no one in IT ever deciding it.

This article is for the people who answer for where company data goes: owners, COOs, CTOs and whoever signs the security questionnaire a client sends. Every claim below links to the reporting it came from, as read on 20 October 2026. Muse is six weeks old, so some of this will change, and the last section says plainly where the evidence is still thin.

What Is the Short Answer?

Do not connect Muse to company email, client messages, company payment cards or work computers. Not because Meta intends harm, but because the controls that matter for business data are missing or sit with the individual user: training is on unless that user opts out, memory is stored where Meta can read it, and every permission is set by the employee who installed it.

That is the same shape of problem as an employee pasting client work into a personal chatbot account, only larger, because Muse can also send, sign up, buy and share. If you want the general rule for personal AI accounts at work, our comparison of what the ChatGPT and Claude enterprise terms actually say covers it. This article covers what is specific to Muse.

What Is Muse, and What Can It Reach?

Meta announced Muse on 8 September 2026 as a personal AI agent, rolling out in the United States on iOS, Android and the web, running on a model Meta calls Muse Spark (TNW, 9 September 2026).

Last verified: 20 October 2026. Each row links to the report it was taken from.

Read the table as a list of what an employee can switch on alone. None of these settings belongs to a company administrator; they belong to whoever installed the app.

Why Does It Matter That Muse Acts, Not Just Answers?

Because a chatbot that is wrong produces a bad paragraph. An agent that is wrong sends the email, accepts the offer or shares the address. Meta puts a component it calls Sentinel between Muse and the internet, which allows low-risk tasks and pauses for approval before consequential ones (TNW). That is a sensible design. It is also only as strict as the permissions the user picks.

One early case shows how that plays out. A YouTube reviewer, Matt Robb, said he chose "Allow Always" expecting Muse to check with him before sharing his address; instead it arranged a Facebook Marketplace pickup and the buyer drove half an hour (Malwarebytes). Meta investigated, and Robb acknowledged he had granted the permission that allowed it (TechCrunch).

Meta's account is that the system did what it was allowed to do. For a business, that is the problem, not the defence. A permission screen one employee clicks through at 11 p.m. is not an approval process, and the action it allows can land on a client, a vendor or a company card.

What Happens to the Data You Give Muse?

Two things, and neither is a company decision. First, Meta uses Muse interactions to train its models unless the user opts out in settings (Malwarebytes). Second, Muse's memory files are stored in Meta's cloud, where Meta can access them; Meta has said it will offer encryption that keeps them private even from Meta, and according to TIME that option was not yet available (Malwarebytes, citing TIME). TNW reported the same plan as a future confidential version in which Meta cannot observe the workspace (TNW).

Meta also says Muse conversations and stored data are kept away from its advertising systems. That is a stated policy, and a reasonable one. But policy is not a contract with your company, and a client's data processing agreement usually asks for the second.

Why Do Muse's Notes on People Matter to a Business?

TIME analysed Muse's internal instructions and reported that it keeps constantly updated notes on users and the people they know, refreshed every hour, which can include how the user met someone and tensions inside a group (Malwarebytes, citing TIME). TIME also reported that Muse can collect data on the people a user messages if it has access to that messaging.

In a personal life, those people are friends. In a working life, they are clients, prospects, candidates and colleagues. None of them agreed to a profile in Meta's cloud, and many of your contracts promise them that their details stay with you. That is a confidentiality question before it is a technology one, and it is the one most likely to come back as a client complaint.

How Was Muse's Mac App Turned Into a Backdoor?

On 21 September 2026, the security researcher Patrick Wardle published a proof of concept showing that an undocumented setting in the Muse Mac app controls where dictated prompts are sent. Any program running as the logged-in user could change it, redirect the audio and text away from Meta, inject instructions Muse would trust, and capture the account token used to read chat history and control the assistant, including on other devices signed into the same account. In his demo that reached his iPhone's location and a Bluetooth scan (The Hacker News, 22 September 2026).

The limits matter, and they are stated in the same report. The attack needs code already running as the user, so it does not break into a clean Mac on its own, and it did not break Meta's cloud. Wardle said a remote attacker could get there by tricking someone into running one command, and that security software may not notice because the actions come from a signed, legitimate app. He did not report the flaw to Meta first; he later said Meta had pushed a fix, which The Hacker News could not confirm, and Meta had not published an advisory (The Hacker News).

For a company, the lesson is general. An agent with wide access is a high-value target: whoever controls it inherits everything the user granted. That is the same reason we design internal agents with narrow, enforced permissions, as we cover in how to build internal agents without creating an unaccountable insider.

What Does Meta Say Protects Muse Users?

Meta has described real safeguards, and they belong in a fair assessment. Each user gets an isolated virtual machine holding the agent and their data. Sentinel separates read access from write access with time-limited permissions and asks before consequential actions. Credentials are stored so Muse cannot see passwords or card details, and every action leaves an audit trail (TNW). Users can opt out of training and tell Muse to forget specific things (Malwarebytes).

Meta has also pushed back on at least one report. An Inc. columnist, Jason Aten, said Muse read his private messages while Full Disk Access was off; Meta's communications chief and a Meta Superintelligence Labs executive said that could not have happened, because reading Messages requires both Full Disk Access and the Messages connector, behind macOS protections, and that Muse gave him an incorrect explanation of what it had done (TechCrunch).

None of these safeguards changes the business answer, because each one is configured by the individual user, not by the company. Good consumer design is still consumer design.

What Should a Business Do Instead?

1. Write the rule down. No company email, client messaging, company card or work device connected to a personal AI agent, Muse included. A one-line policy beats an unspoken expectation.
2. Check managed devices. Find out whether the Muse app is installed on company Macs and phones, and which permissions it holds, starting with Full Disk Access.
3. Give people a better approved tool. Use AI under business terms, where training is off by default and retention is set by the company. Our dated comparison of enterprise terms shows what those plans promise and what they do not.
4. Build agents you control for the work that matters. If you want an agent that acts on company systems, it should run with permissions your company sets, approvals your managers own, and an audit trail you keep.
5. Keep regulated data off rented models. If a contract or regulation limits who may process the data, it belongs on a model you host. See whether an LLM can be used with HIPAA, ITAR or CMMC data and on-prem versus API for security and IP.

Where Is the Evidence Still Thin?

Muse launched six weeks before this was written. Several reports come from individual users, at least one is disputed by Meta, and Meta is changing the product quickly, including a promised confidential version that would keep the workspace from Meta itself. If that ships with company-level controls and business terms, parts of this article will need revisiting, and we will update it with a new verification date.

What will not change is the principle: an agent that can act on company accounts should be governed by the company, not by the settings screen of whichever employee installed it.

Frequently Asked Questions