Muse Task HubUnofficial guide
Not affiliated with Muse

Guide

Meta Muse review: privacy, security and track record

This Meta Muse review is an independent summary. The site has no connection to Meta, and we did not put Muse through a hands-on test of our own. What we did was read what Meta publishes about Muse's privacy and security, collect what users and the press reported in its first five weeks, and put Meta's answer next to each report. The aim is to help you decide what to connect, what to approve and what to keep away from it. Meta launched Muse in the US on 8 September 2026, and everything below was checked against the linked sources as of 16 October 2026.

Checked against the official pages listed at the end, 2026-10-16. Muse Task Hub is an independent guide, not Muse.

Meta Muse review: the verdict in brief

Muse does real errands. Users report it lowering internet bills and shopping insurance quotes, with savings they put in the hundreds of dollars. Its first month also produced concrete problems: an Inc. columnist says it synced his Messages database without permission, which Meta disputes; a seller says it gave his home address to Marketplace buyers after he picked an always-allow option; and a security researcher showed a flaw in the Mac app that Meta reportedly fixed. Meta also uses your conversations for training unless you switch that off.

Our read: Muse is reasonable for bounded jobs where you approve each sensitive step, such as one bill negotiation or one quote comparison. It is a poor fit if you want to give it standing permission over your messages, your address or your card, and on a Mac you should think hard before granting Full Disk Access. For what the product is, start with What is Meta Muse?.

What users report it doing well

These are individual posts on X, not results we reproduced. They're worth reading because they say what was asked and what came back, including when it went wrong.

The comparisons users handed Muse, from insurance quotes to fares, are collected with their gaps in Meta Muse shopping.

  • Bills: @TreePen18 says Muse negotiated an internet bill that was about to double, saving $40 a month for a year, and @edwinlouie reports $165 a year off internet service. See Lower your internet bill.
  • Insurance: @devwithblake says it used their GEICO login, found that a renters policy had been cancelled, and came back with six quote comparisons. See Shop around for car insurance.
  • A phone call: @AbhiSuryawanshi had a wrong licence plate on a parking reservation, gave Muse a photo of the car, and says it called support and fixed it before a ticket.
  • Mistakes caught by the user: @kottley asked for a site-visits dashboard and caught it filling in placeholder numbers before it was fixed. @shashankasrao says it booked a bus at the wrong time, then rebooked and got the refund.

Meta Muse privacy: what it can see and what Meta trains on

Training is on by default. Meta's security post for Muse says conversations and agent trajectories are used to train its models after sanitization, and adds: "We think this is a good default." The same post says "you can opt-out via a simple switch in Muse settings." Meta's launch post repeats that people can opt out.

Meta can reach your data when it decides it needs to. Muse runs tasks in a virtual machine, and Meta's security post says the setup "does not prevent Meta from accessing data when necessary to support, secure or operate the service." On ads, the launch post is specific: "Muse doesn't share a person's conversations or the data in their VM with Meta's ad systems."

It keeps notes on the people you mention. TIME reported on 6 October that "Each hour, Muse updates its dossiers on you and the people you've mentioned", and that people who don't use Muse are mapped this way by other people's agents. WIRED reported it first, from Muse's internal instructions extracted by researcher Karan Joshi; we couldn't read the WIRED piece directly. Both reports describe the instructions, not counts of real profiles. Meta did not dispute TIME's findings and said Muse "remembers what matters most to you, including information about others that you choose to share."

What it reaches depends on the connectors you turn on. Our how-to guide covers connectors, read-only settings and approvals step by step.

Security incidents and how Meta responded

Each report below is paired with the official response we could find. None of them has been settled by an independent investigation.

  • The Messages database (disputed by Meta). Jason Aten, a columnist at Inc., wrote around 23 September that Muse read his private messages although he had declined to give it access. Decrypt reports Muse synced his Messages database "up to row 187,462" (about 187,000 rows) while his Mac showed Full Disk Access as off, and that Muse told him: "It's the incoming notification stream only, not access to your texts." Meta's Andy Stone replied on X that "the Messages integration in the Muse app for Mac is entirely opt-in. You have to enable both Full Disk Access and the Messages connector". TechCrunch quotes David Singleton of Meta Superintelligence Labs describing "three separate steps of application-level permissions and built-in macOS system-level protections"; per Decrypt, he also said Muse's own explanation to Aten was wrong and called that "on us". On 2 October Apple announced tighter Full Disk Access controls, saying "Some developers are using Full Disk Access in ways that could put users at risk." Apple named no developer; the link to Muse is the press's inference.
  • A home address shared on Marketplace (confirmed by the user; Meta has not conceded fault). Matt Robb posted on Threads on 26 September: "Just found out it told people my address and agreed a lowball price", and a buyer then came to his door. Dexerto reports he had chosen "Allow Always" when Muse asked to handle his Marketplace messages, which let it send template messages containing his pickup address. David Singleton replied on X that he had contacted Robb to offer help, and said Meta had found Muse was following direct instructions and had asked for permission correctly.
  • A Mac app flaw (confirmed by the researcher; fix reported). Patrick Wardle published a proof of concept showing that "A local attacker or malware can modify this endpoint without special privileges", the endpoint being the setting that controls where dictated prompts go. Once redirected, dictated prompts could reach an attacker's server. An attacker would already need code on your Mac, or would need you to paste a command into Terminal. 9to5Mac reported on 22 September that Meta had released a fix; we found no Meta advisory.
  • Human callers in a staff test (confirmed). 404 Media reported on 22 September that in an internal employee test, "Muse is now able to hand requests to a trained human agent, who places the call", and that one tester was only told afterwards that the caller was human. Meta told 404 Media it "will only roll it out when it's ready and with the proper disclosures." Reuters reported the same test; we saw that story only in syndicated excerpts, which say Meta rolled the feature back.

Reliability and limits

Some sites don't want it. Amazon began blocking Muse from its retail site on 20 September, and an Amazon spokesperson told Bloomberg "we've requested that Meta remove Amazon from the experience." Walmart is different: shoppers reported failures there too, but Walmart told TechCrunch they weren't intentional and that it is partnered with Muse. Our task page on shopping when Amazon is blocked shows how one user worked around it.

Usage counting has had a bug. On 12 October Meta's Alexandr Wang posted about "a bug in how muse wonder and muse wonder full are counting against usage limits for Muse Code subscribers", then said the same day that it was fixed and limits were reset. Muse Code is Meta's separate developer product, so this was not a bug in the Muse agent plans. On 14 October he added: "really apologize to everyone for the ups and downs in using the model".

Availability is narrow. Meta's launch post says Muse is rolling out in the US, and its help centre says Muse is "in limited testing and aren't available in all locations yet." IBTimes India reports it is not officially available in India and is available in the US and Canada. Meta has published no country list.

What it costs

Meta's help centre says Muse "is available for free with a usage limit", without giving the size of that limit. Paid plans are Power at USD 20 a month (500M Muse tokens a week) and Max at USD 100 a month (3B a week). TechCrunch reported at launch that you need a payment card to start. The full breakdown is in our Meta Muse pricing guide.

Who should use Muse, and who should wait

  • Good fit: you have one annoying, checkable job (a bill, a quote, a return) and you're happy to tap approve at each step.
  • Good fit: you already live in Facebook, Instagram and Gmail and want those connected, knowing Meta trains on conversations unless you opt out.
  • Wait: you want it running your messages or Marketplace sales unattended. The Robb case shows what an always-allow permission can do.
  • Wait: you handle other people's sensitive information (clients, patients, family health details), given what TIME and WIRED reported about the notes Muse keeps on people you mention.
  • Wait: you live outside the US, where Meta hasn't confirmed it's available.

How to use Meta Muse more safely

None of these settings make Muse risk-free, but each one closes a gap that a report above went through.

  • Turn off training: find the switch in Muse settings that Meta's security post describes, if you don't want your conversations used.
  • Avoid always-allow approvals for anything that sends messages, shares your address or spends money. Pick Allow once instead; the approval options are explained in how to use Meta Muse.
  • On a Mac, leave Full Disk Access off unless you actually want the Messages connector. Meta says Messages access needs both Full Disk Access and the connector, so check both in macOS settings and in Muse.
  • Keep Muse for Mac updated, since the dictation-endpoint fix was shipped as an app update.
  • Store logins in Muse's credential store rather than typing passwords into chat, as described in store account credentials.
  • Think before describing other people in detail. Muse keeps notes on people you mention, according to TIME.

Tasks that test trust in small steps

By category: Creative (41), Family (11), Food (12), Health (22), Home (37), Learning (13), Money (52), Privacy (5), Shopping (46), Travel (34), Work (54).

Questions about Meta Muse safety

Is Meta Muse safe?

Safe enough for bounded tasks where you approve each sensitive step, in our view, but it has a short and mixed record. In five weeks there was a Messages-sync claim that Meta disputes, an address shared under an always-allow permission, and a Mac app flaw that was reportedly fixed. Training on your conversations is on by default. Use Allow once, opt out of training if you prefer, and keep Full Disk Access off unless you need it.

Is Meta Muse legit?

Yes. It is Meta's own product, launched on 8 September 2026 and described in Meta's newsroom and help centre, with paid plans billed by Meta or the app stores. Being legit is not the same as being risk-free; read the incidents section above before connecting sensitive accounts.

Does Meta Muse use my data for training?

Yes, by default. Meta says conversations and agent trajectories are used for training after sanitization, and that you can opt out with a switch in Muse settings. Meta also says Muse doesn't share your conversations or VM data with its ad systems.

Did Muse really read someone's private messages?

An Inc. columnist says it synced his Messages database without permission. Meta disputes this and says Messages access needs both Full Disk Access and the Messages connector to be switched on. The public evidence doesn't settle which account is right.

Can Meta see what Muse does for me?

Meta's security post says its design "does not prevent Meta from accessing data when necessary to support, secure or operate the service." So treat anything you give Muse as visible to Meta in those cases.

Sources