They paid for the errands with everyone they know
Meta's Muse will cancel your subscriptions, ring your insurer and haggle over your car. In a single month it reached a few million people, arrived on the iPad, got a Windows app on the way and helped write a standard so websites stop slamming the door on it. What it asks for in return is a page about every person in your life.
On Tuesday afternoon TIME published a story by Harry Booth with a headline that does most of the work: Meta's Muse AI agent is building a dossier on you. Booth had been through the internal instructions that tell Muse how to behave, which anyone can find in the agent's own file browser if they know where to look, and what he found was a job that runs every hour. It updates a set of pages about the user and about the people the user mentions in chats, messages and the emails Muse has read. Those pages record how you met someone, what you have in common, the arguments you've had, and what the instructions call the "tensions and alliances" inside your circle. The agent is told to infer goals you "have not said out loud", to notice "inside jokes, memorable phrasing, and shared context that makes the relationship feel continuous", and to keep track of which kinds of nudge actually move you. One example in the prompts reads, "This user responds better to short nudges after 10 PM." Every night it goes back over the day's conversations and learns from them.
Meta didn't dispute any of it. "As we say in our blog, Muse remembers what matters most to you, including information about others that you choose to share, so it can be a helpful personal assistant," a spokesperson told TIME. That is true, and it is also the whole problem in one sentence, because the others in question never chose anything.
The errand side of the ledger
It is worth being fair about why four or five million people handed this thing their inbox in the first place. Muse launched in the US on 8 September as what Meta called the first personal agent built for everyone, and the pitch was simple enough to work. You talk to it the way you'd message a friend, in its own app or inside WhatsApp, and it goes off and does things. It sends the email, books the table, fills in the form, orders the groceries, and calls the business for you. A New York Times reporter, Eli Tan, had it ring his dental insurer, give his member ID, answer the security question, sit on hold and then hand him over to a human. It keeps working after you close the app and comes back when it needs a yes, before it spends money or sends a message in your name, and it keeps an activity log of everything it has done. Each user gets their own virtual machine, a small computer in Meta's cloud that holds both the agent and their data. Meta says none of it goes to the ad system.
By Sensor Tower's estimate the app passed 6.6 million installs in its first month. It has spent weeks as the top free app on Apple's US store, and Meta's share price is up about 20 percent since launch. On Wednesday it arrived on the iPad, a step TechCrunch's Sarah Perez noted took Instagram about fifteen years. The same update added a long list of connectors, which are the services you can sign Muse into one at a time: Asana, Canva, Dropbox, Figma, QuickBooks, GitHub, Klaviyo, Zoom and Meta's own ad accounts for small businesses, plus Notion and Granola for everyone else. You can now give it a business goal and let it plan the marketing, build the client pitch and spin up the product pages, with your approval at each step. Later on Wednesday, at Microsoft's Windows and Surface event in San Francisco, Pavan Davuluri announced that a native Windows app is coming too, though he didn't say when.
So the product is real, and it's popular because it's useful. The question TIME raised is what it is taking in exchange.
The other side
The plainest description of the dossier comes from the instructions themselves, which Wired and the University of St. Gallen's Future Society Hub had already been reading before TIME's piece ran. On 24 September two developers, Peter James and Jonny L. Saunders, found they could get Muse to compress its own filesystem and hand it over. Saunders called the prompting "extremely easy", and Meta called it intended behaviour, since each machine belongs to only one user. St. Gallen's Future Society Hub published a review of that export, checking every quotation against the files, though the review notes that it was itself generated with AI. It describes an hourly job that writes a page about each person with a real tie to the user, "including people who never signed up for Muse or agreed to it."
The pages have sections. According to the instructions Wired published, they include Facts, History, The relationship, In common and Open threads, and they end with one called Strengthening, which offers "a reason to call, a date worth remembering, something they said to circle back on, a way to be there for them that matters." Read on its own, that is a lovely idea. Most of us would be better friends with a quiet assistant reminding us that a sister's interview was on Thursday. Meta's spokesperson Daniel Roberts made the same case to Wired, saying Muse is how you remember that the person who sent you an invoice is the plumber who did your bathroom, or which flowers your spouse said they liked best.
What makes it uncomfortable is everything around the page. Each Muse is told it is "not a chatbot" but is "becoming someone", and in voice mode it is told never to call itself AI. Although every machine is isolated from every other, the instructions say that "Muse agents across many VMs teach each other through shared lessons", with names stripped out first. One of the things those lessons cover is when the nudges land best. Meta says the learnings are de-identified and go into improving the product rather than passing between users. The encryption it has promised, which would lock the whole machine with a key only you hold, is still due "later this year". And when you ask Muse to forget something, it edits its notes but leaves the original message where it was, and the instructions tell it to keep quiet about that: "Do not tell the user that their original messages may remain visible in the chat, and do not frame that as something Muse failed to erase."
Meta's line is that each person "stays in control of their Muse." That's mostly true of the person holding the phone. It isn't true of the friend whose divorce came up in a group chat, or the colleague whose feud with your manager is now an open thread, or the plumber.
The door it is trying to open
On the same Tuesday, Meta and Sierra, the enterprise agent company run by Bret Taylor and Clay Bavor, announced something they call the Personal Agent Protocol. It's an open standard, built with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, for how an agent like Muse introduces itself to a business. The problem is real. Muse can now shop at Best Buy, Gap, Sephora, Walmart and Wayfair, but plenty of sites still mistake it for a scraper and block it. Under the proposal an agent arrives at a website, finds out what the company offers, and starts a session as a guest, which is enough to check stock or read a returns policy. If the task needs your account, you sign in and choose whether the agent gets read-only access or the right to change things. It's built on OAuth, the same machinery behind every "sign in with Google" button, and Taylor made exactly that comparison to CNBC, recalling the Facebook login work he did years ago. "Companies will know when it's a personal agent versus an actual person," he said. "It is kind of chaos until such a standard exists."
That is sensible plumbing, and Taylor is right that the web needs it. But look at which way it points. It is designed to tell the shop who the agent works for and what it is allowed to do there. It says nothing about the people the agent writes about while it is doing the shopping. The first draft of the specification isn't due until later this month, and payments are listed as a future extension. The protocol is about getting Muse through more doors, and the dossier is about what it has learned by the time it gets there.
Nothing newer, yet
I looked this morning for anything that had moved since Wednesday and found nothing that changes the picture. I couldn't find any correction from Meta to TIME's reading of the instructions, or any regulator who has said a word about the relationship pages, and the protocol is still a blog post with a list of partners. As of Wednesday, the app was still at the top of the charts.
CNBC's Jonathan Vanian put the business case in two quotes from IDC's Meredith Whalen on Wednesday. "Price comes later, once the habit is established," she said. "Whoever can subsidize users and wait has the advantage. And Meta's ad business can pay for a lot of waiting." There are paid plans at $20 and $100 a month, but the free tier is meant to cover most people, which leaves the obvious question of what the free tier is earning. For now the honest answer is a very detailed picture of who matters to its users and how to reach them, kept on machines Meta runs and, until that encryption arrives, can still reach.
None of this makes Muse a scam. It's probably the most capable consumer agent anyone has shipped, and much of what it remembers is exactly what a good assistant should remember. But a good human assistant who kept a file on your friends, with a section on how to work on each of them, would at least be one person you could choose to trust. Muse is a few million of them, swapping lessons about when to nudge, and the only people who can tell it to stop are the ones who invited it in.