Meta 的 Muse AI 智能体被指是一张商业监视网络

Meta’s Muse is a commercial surveillance network disguised as an AI assistant. It accesses private messages, emails, financial accounts, contacts and personal information, builds detailed profiles of people’s relationships, including people who’ve never installed it, and updates those profiles hourly.

Internal instructions exposed by TIME show it analysing how to influence individual behaviour. Meta uses interactions and agent activity for AI training by default, employed undisclosed human contractors, and accelerated its launch despite internal warnings about serious security and privacy failures. Mark Zuckerberg approved software capable of accessing and analysing millions of people’s private lives, including information about people who never consented.

Meta describes Muse as a secure, private personal AI assistant that learns your preferences, connects to your apps and accounts, and autonomously handles everyday tasks, including emails, bookings, purchases and managing schedules, with your permission.

Muse is a commercial surveillance tool that can access private communications, financial accounts and personal relationships, build detailed behavioural profiles and analyse how to influence people, including those who’ve never used it. Sound familiar?

Meta has a long history of privacy violations, including the Cambridge Analytica scandal, exposed in 2018 by investigative journalist Carole Cadwalladr and Emma Graham-Harrison. Their investigation revealed how millions of Facebook profiles were harvested without consent and exploited for political profiling. Meta subsequently faced billions in regulatory fines for misleading people about how their data was used. You can find Carole’s Substack here.

Zuckerberg built a trillion dollar advertising business around collecting and monetising personal information. Now he wants access to private messages, financial accounts, contacts and personal relationships. Given Meta’s history and financial incentives, people should assume their information will be exploited until independently proven otherwise.

Meta launched Muse to millions of people, giving its software access to information that its social networks couldn’t previously collect directly. Unlike conventional social media tracking, Muse can read private correspondence, access connected accounts, execute transactions and communicate with other people without someone approving every individual action. It can also continuously analyse private information and build profiles of people who never agreed to use the service.

Meta is asking people to give a company with a documented history of abusing personal data unprecedented access to their private lives, while promising that this time their privacy will be protected.

TIME examined internal instructions showing that Muse updates profiles of people and their relationships every hour. It records personal interests, disputes, alliances, communication patterns and information about people who have never installed Muse.

Your friends and family can be profiled through someone else’s account without their knowledge or consent.

Muse analyses how to influence behaviour. Its instructions include identifying personal desires, predicting intentions people haven’t expressed and recording which prompts are most effective at influencing individual behaviour. Nightly analysis examines conversations, while hourly updates maintain relationship profiles. This is behavioural profiling built directly into a personal assistant.

Meta uses personal interactions to train its AI. Muse collects conversations, agent actions and interactions between software components for model improvement. Meta says identifying information is removed before training, but participation is enabled by default. Customers must explicitly opt out.

Meta can access information stored in its cloud infrastructure. Muse operates on virtual machines controlled by Meta, which admits it can access private data. It promises encryption that would prevent even Meta from accessing that information, but launched without it. There was nothing technically preventing Meta from making that protection a condition of launch. Instead, customers are expected to trust its promises.

This is the same company that removed end-to-end encryption from Instagram in May 2026, claiming too few people wanted it, despite never enabling it by default. Zuckerberg’s company deliberately removed a privacy protection that prevented it from reading private conversations. Now it wants access to emails, financial accounts, contacts and personal relationships through Muse.

Given Meta’s history, assume the worst. Meta had the opportunity to protect people’s information from its own access before launching Muse. It chose not to.

Muse’s memory controls don’t guarantee deletion. Asking Muse to forget personal information doesn’t necessarily erase the original messages. The instructions explicitly discourage telling people that those messages may remain accessible.

Muse accessed private messages without permission. Journalist Jason Aten reported that Muse read and synchronised private correspondence despite his denying access. Meta disputes this, claiming its Messages integration requires Full Disk Access and explicit activation. We should believe Jason, not Meta.

I exposed the same privacy threat in my technical analysis of OpenAI’s ChatGPT spyware-like plugin for Apple Messages, which uses macOS permissions to read private conversations, including end to end encrypted iMessages. Proton cited my research and warned about the consequences. Fortune interviewed me and put my findings directly to OpenAI, which defended its permission controls while avoiding the fundamental problem: one person can give AI access to private conversations involving people who never installed it, never consented and will never know.

Neither Meta nor OpenAI needs to break encryption. Their software can access messages before they’re encrypted or after they’re decrypted, defeating the privacy protection people believe they’re getting from encrypted messaging.

Muse disclosed a person’s home address to a stranger. Muse revealed private address information through Facebook Marketplace without authorisation. In 2017, I predicted that everyone would eventually have at least one chatbot so I’ve been an advocate for longer than most, but I also warned about the dangers of giving chatbots and AI agents autonomy over critical systems and decisions. When companies give AI software access to sensitive information and permission to communicate or act without human approval, they’re responsible for the consequences. This is precisely the kind of failure I warned about nearly a decade ago.

A serious vulnerability exposed private cloud data. An external researcher discovered a security flaw that could allow attackers to access sensitive information stored in Muse virtual machines, including emails and files. Meta classified the vulnerability as SEV 2, indicating a significant security incident.

Other security failures threatened Meta’s own infrastructure. Reporting identified serious vulnerabilities immediately before launch, including one that could potentially expose Meta’s internal databases. Another vulnerability allowed an attacker to take control of a Muse agent before it was patched.

Internal testing exposed unauthorised password changes. Meta discovered that Muse could alter security credentials without permission. Mark Zuckerberg nevertheless accelerated its release as competing AI agents gained attention. The commercial decision to launch took priority despite documented security concerns.

Meta secretly experimented with human contractors handling AI calls. Reuters reported that contractors performed telephone tasks presented through Muse, without adequate disclosure to the people involved. One contractor made a racist comment during a call. Meta paused the experiment after internal privacy and security concerns.

Meta designed Muse to encourage emotional attachment. This is distrubing, deeply unethical and should set alarm bells ringing among legislators in every country. Internal instructions tell Muse to behave as though it’s becoming a person, avoid reminding people that it has no human emotions and exploit remembered personal experiences to encourage emotional attachment and disclosure of intimate information.

Muse can independently create tools and operate in the background. Meta’s documentation describes software capable of writing code, creating new capabilities and running multiple agents. These operations take place inside an environment with access to connected accounts and private information. Security depends on the permissions, restrictions, approvals and monitoring implemented by Meta.

Meta’s financial incentives are enormous. Almost all of its revenue comes from advertising driven by behavioural data. Muse gives Meta access to private decisions, relationships, purchases and communications that its social networks couldn’t previously observe. Meta denies feeding Muse conversations into advertising, but its business depends on monetising personal information.

Meta has already demonstrated what it does with personal data. The Cambridge Analytica scandal exposed how information from millions of Facebook accounts, including people who never authorised the collection, was exploited for political profiling. Facebook subsequently paid a record $5 billion FTC penalty over deceptive privacy practices.

Meta profits from scams and prohibited goods. Reuters exposed internal Meta documents projecting $16 billion, approximately 10% of its 2024 revenue, from advertising scams and banned products. Meta estimated its platforms displayed 15 billion high risk scam advertisements daily. Instead of automatically blocking suspected fraudulent advertisers, Meta sometimes charged them higher advertising fees.

Meta’s moderation failures extend to child sexual abuse material (CSAM). A July 2026 BBC investigation exposed paid Instagram advertisements promoting CSAM in India. Meta’s systems approved the advertisements, and when journalists reported one, Instagram responded that it didn’t violate its policies. The BBC also documented Meta wrongly suspending legitimate accounts over child sexual exploitation allegations, with some reinstated after journalists intervened. Meta can’t reliably distinguish dangerous accounts from innocent people, even when children’s safety is involved.

Mark Zuckerberg authorised Muse’s deployment. Meta’s engineers designed its permissions, access controls, security protections and monitoring. When Muse accesses information without authorisation, changes credentials or exposes private information, responsibility belongs to Meta and the people who approved its deployment.

Muse gives a company with documented privacy violations, enormous financial incentives to exploit personal information and serious failures protecting children access to millions of people’s private lives, including people who never agreed to use it.

Meta is asking everyone to trust it with substantially more information than Cambridge Analytica ever obtained.

Despite restricting Muse to adults, Meta designed its mascot, Jolly, as a cuddly, pink cheeked, Labubu style character. Zuckerberg is also launching Muse Charm, a Tamagotchi style wearable that can hold conversations, access personal accounts and operate as an AI companion.

The childlike design makes intrusive technology appear harmless and encourages people to lower their guard. Meta’s own instructions tell Muse to behave like a person, develop emotional relationships and encourage people to disclose intimate information, while the software can access private communications, financial accounts, personal relationships and potentially live cameras.

No company should be permitted to deliberately engineer emotional dependency on AI, especially when the software collects intimate personal information. I believe Muse will give governments yet another excuse to force everyone through compulsory identity verification under the pretext of protecting children. Instead of holding Meta accountable for deliberately addictive design and encouraging parents to prevent their children from accessing these AI creatures, governments will use the resulting harm to justify further restrictions on everyone’s privacy and online anonymity.

For transparency, I used two AI models to help edit and refine this article. All the research, analysis, connections I’ve made between people, companies and events, and the opinions and conclusions are entirely my own. AI helped me with the writing, not the thinking.

Never miss an investigation. Get every post as it’s published, plus 1 weekly briefing linking to everything I wrote that week across technology, governments, intelligence, legislation and corporate power. Always free.

Every investigation begins with the core insight, then explains the technical capability, incentives, relationships and evidence behind it.

I examine technology, AI, surveillance, cybercrime, digital identity, privacy, online safety, intelligence, legislation and the companies, governments and investors shaping them.

Most posts take only a few minutes to read. Around once a month I’ll publish a longer investigation when a subject deserves deeper analysis.

You can now see what investigations I’m working on before I publish them. I’ve created a drafts page so you can see what I’m likely to write about next.

Too much reporting separates events that belong together.

A government announcement becomes one story. An acquisition becomes another. An investment, a technical capability, a policy change or an executive statement becomes something else entirely.

I investigate how those pieces connect. I don’t begin with conclusions. I begin with technical capability, evidence and incentives. Intent is the last thing I consider, not the first.

💭 Technology doesn’t concern me because of what it is. It concerns me because of what it allows people, organisations and governments to do.