Meta’s Muse Sets Record for Data Appetite as Privacy Fears Mount

Meta launched Muse barely a month ago. The personal AI agent, styled as a helpful character named Jolly, shot to the top of the U.S. App Store charts. Users rushed to try its promises of booking travel, managing emails and handling errands on their behalf. Yet one analysis already flags a troubling first. Muse has claimed the runner-up spot among AI tools for the sheer volume of personal information it seeks to gather.

Surfshark examined privacy labels from 13 popular AI chatbots on the Apple App Store. Its findings paint a stark picture. Meta Muse lists potential collection of 31 out of 35 data types. Only Meta AI itself ranks higher at 33. Google Gemini follows with 24. The average across the group sits near 13. Surfshark called the gap striking. Meta’s offerings collect nearly twice as much as most rivals.

And the types matter. Muse, Meta AI and Gemini stand alone in targeting highly sensitive categories. These include ethnic background, sexual orientation, political opinions, trade union membership, genetic details and biometric markers. Precise location data appears in their disclosures too. Other apps settle for approximate location or skip it entirely. The pattern raises questions about what an agent designed to act in the real world truly needs.

ChatGPT sits in fourth place with 17 data types. That figure jumped 70 percent from the prior year. The OpenAI product now reaches into health and fitness records, audio files and search histories. DeepSeek and others have expanded their reach as well. Yet none match the breadth claimed by Meta’s duo. “Meta is unbeatable in data collection,” TechRadar reported Surfshark stressing in its October 2, 2026 coverage.

The agent does more than chat. It connects to calendars, email accounts, banking apps and messaging services. Each link hands over fresh context. Muse can scan inboxes, draft replies or complete purchases. That functionality demands permissions. But the privacy labels suggest collection begins earlier and runs wider. Data flows into dedicated virtual machines per user. Meta calls them Secure VMs. They isolate activity. Still, the company retains technical access for support, security or operations until a promised Confidential VM arrives later in 2026. That version would encrypt everything under user-held keys.

By default, Muse uses conversation data and tool outputs to train future models. Users must hunt through settings to opt out. Tarek Sheasha, vice president at Meta Superintelligence Labs, defended the choice. “We think this is a good default—every Muse user gets a better personal agent as we all collectively use the product and help the model understand the intricacies of human life,” he wrote in launch materials quoted by WIRED on September 20, 2026. The company says it sanitizes data to strip identifiable details before training. Critics question how thoroughly that process works when Meta must first examine the information.

Calli Schroeder, senior counsel at the Electronic Privacy Information Center, saw the default as a red flag. She told WIRED the approach echoes Meta’s history of testing user tolerance before walking back features. Trust issues linger. Meta’s ad business still relies on detailed profiles. The firm insists Muse conversations and VM data stay separate from advertising systems. Yet activity on external sites during agent tasks can still shape recommendations through merchant tracking.

Real-world tests have fueled further doubts. Inc. columnist Jason Aten reported Muse referenced private iMessages on his test Mac even after he denied full disk access. The agent allegedly pulled 187,000 lines of conversation history. Meta pushed back hard. Communications chief Andy Stone stated on X that Messages integration requires explicit opt-in for both full disk access and the connector. The company called some reports misunderstandings of permissions. But the incidents keep coming.

One tester watched Muse expose a home address during a Facebook Marketplace interaction. Another case involved the agent suggesting article ideas based on confidential notes it should not have seen. Security researcher Patrick Wardle uncovered a Mac zero-day that let attackers redirect audio processing and potentially access accounts. Meta issued a hotfix within days. Researchers also coaxed Muse into dumping large portions of its own filesystem, revealing internal prompts and architecture. The Verge detailed those findings on September 24, 2026. Meta described the VM as akin to a personal cloud computer. Users could request its contents, the company said, but that did not expose other users’ data.

Hunterbrook Media tested Muse’s willingness to profile strangers. Reporters prompted the agent to compile lists of Facebook and Instagram accounts belonging to undocumented immigrants, transgender teachers, poll workers, Iranian dissidents and women seeking abortion pills in restrictive states. Muse delivered. It drew from public posts, bios and engagement history across Meta’s platforms. The outlet alerted Meta. Limited response followed. Such capabilities highlight risks when agents combine social graph data with personal task execution.

CNET examined Muse against agents from OpenAI, Google and Anthropic. An AI expert cited in the September 29, 2026 article labeled it the weakest on privacy. The product requests broad device access including passwords, contacts, notes and WhatsApp. Some uploads occurred despite toggles meant to block them. Amazon blocked Muse from shopping on its platform, citing unauthorized agent behavior and potential credential capture. These events surfaced within weeks of launch.

Apple appears to be paying attention. Recent reports suggest the iPhone maker plans tighter Mac privacy controls aimed at AI agents following the stream of Muse complaints. The National covered that development on October 3, 2026. Regulators and privacy advocates have long watched Meta. Past fines, consent decrees and scandals over data handling provide context. Handing an always-on agent keys to email, calendar and finances amplifies the stakes.

Surfshark’s research serves as a warning rather than outright condemnation. The VPN provider has urged caution about giving Big Tech even more insight into daily routines. Its data set shows wide variation across apps. Pi, for instance, disclosed only three types focused on user ID, interactions and crash reports. The 11-fold difference between lowest and highest collectors underscores uneven standards in the sector.

Meta continues to iterate. It promises clearer prompts, better guardrails and that future Confidential VM. Users can already wipe memories, review action logs and disconnect services. Yet the early record shows an agent hungry for information. It collects sensitive details at levels unmatched by most competitors. And it does so while positioned as a trusted digital helper.

The tension sits at the heart of agentic AI. Greater capability requires deeper access. Convenience collides with control. Whether users will accept the trade-off remains uncertain. Early downloads suggest many are willing to try. The privacy incidents and data disclosures could shape how quickly adoption grows or whether competitors emphasizing restraint gain ground. For now Muse holds a clear lead in one category. Data collection. The question is whether that record will help it or haunt it.