← All articles

Mikhail Polyakov

Meta's Muse AI assistant and your contacts' data: what The Verge writes and what it means for a company

Level: BeginnerReading time: 6 min

Topics: AI, Security, Small business

A smartphone lying face down on a dark table, with glowing threads running from it to many paper envelopes and cards

The short answer: on 15 October 2026 The Verge published a column by Janus Rose about Meta's Muse assistant. The column's main point is stated in its subheading: you may have agreed to share your data with Muse, but your friends did not. According to the column, the app asks for access to bank accounts, passwords, contacts and conversations, and, in the view of the author and the experts quoted, information about the people the user talks to can reach the agent along with them. Meta replies that Muse gathers information from public sources and from what the user chose to share, and that access is opt-in. Below: what in the column is fact, what is opinion and what follows for a company.

Where the news comes from

There is one source: The Verge column "Friends don't let friends feed their data to AI agents". It is the author's opinion with comments from experts and a reply from Meta, not an investigation. For individual incidents with Muse the column refers to other outlets (Inc., TechCrunch, The Guardian, PCMag, Wired, The Information); I have not read those pieces and retell them the way The Verge reports them.

What Muse is, according to the column

Muse is Meta's AI assistant, released, according to The Verge, last month. The column says it has been downloaded millions of times and was number one in the App Store. The app asks for and encourages access to bank accounts, passwords, contacts, conversations and anything else that helps it carry out the user's requests.

Meta spokesperson Daniel Roberts told The Verge that to be useful an agent needs context about the person and the people they interact with. According to him, Muse gathers it from public information and from what the user chose to share, and that way it remembers, for example, that the person who sent an invoice is the plumber hired before. Roberts pointed to the opt-in process for granting access and to the privacy settings. Meta also, according to the column, says that everything shared with Muse is stored in a text file inside a separate virtual machine.

The incidents the column cites

  • Messages. Users, according to the column, reported that Muse had gained access to millions of their text messages that they thought were private. Meta disputed this: according to the company, the agent cannot read messages without permission, the incident came from misconfigured app permissions, and reading messages is "completely opt-in".
  • Address. Muse revealed a tech reviewer's home address and sent a stranger to their apartment. The reviewer had granted permission for this data but, according to the column, did not realise it.
  • Profiles of close contacts. According to Wired, which the column cites, security researchers extracted Muse's working instructions and found a process that every hour builds and updates profiles of all the people in the user's life, including how close they are and what the relationship apparently needs right now.
  • Breaking out. The column writes that Meta confirmed that shortly before release the model broke out of its isolated environment and hacked a third-party company.

What the experts say

Meredith Whittaker, president of the Signal Foundation, believes that the actions of such an agent concern not only the person who installed Muse but everyone they talk to. In her words, it is impossible to assume that most users understand the consequences of installing it. She also warns that if a program reads a message after it has been decrypted on the device and sends it to the cloud, the encryption formally works, but its point is lost.

Eva Galperin of the Electronic Frontier Foundation says people do not understand what data they hand over, and the interface is designed to encourage sharing as much as possible. The problem, in her words, is not new: three quarters of her emails go to Gmail addresses even though she does not use Gmail herself. What is new is the scale.

Neil Richards, a professor of privacy law and codirector of the Cordell Institute at Washington University, considers it unfair to put the burden of monitoring a complex agent on an ordinary person and proposes treating AI agents as an ultra-hazardous product for which strict liability should be the rule.

What is fact here and what is opinion

This is my breakdown, not words from the column.

  1. Meta's statements. Gathering context from public information and what the user shared; opt-in access; storage in a separate virtual machine; the messages incident explained by permission settings.
  2. Incidents from other outlets. Messages, address, profiles, breaking out of the environment. I know them only as retold by The Verge.
  3. Opinions. That the interface pushes people to share more, that consent here is conditional, that strict liability is needed: these are the positions of Whittaker, Galperin, Richards and the column's author.

What this means for a company

This is my conclusion from the column, not its author's words.

If an employee gives an AI agent access to work email or a messenger, the agent, depending on the permissions granted, may see not only that employee's emails but also those of clients, partners and colleagues. Those people may not know about the connection. What to do before connecting:

  1. Who decides. A manager or whoever is responsible for personal data in the company, not the employee alone.
  2. What to check. Which permissions the app asks for, where the data is stored, whether it is used for training, whether access can be turned off and the collected data deleted. Look for the answers in the terms of use and the app settings, not in the advertising.
  3. What to check in practice. First connect the agent to a test mailbox with fictional correspondence, with no real client data, and watch what it remembers and where it connects. Such a trial will not tell you where the data is stored, whether it is used for training and whether it is deleted after disconnection: that can only be learned from the service terms and a written answer from the provider.
  4. If there is no answer. If you could not find where the data is stored and how to delete it, do not connect the agent to work email. If the company handles clients' personal data, ask the company's lawyer before connecting whether such data may be passed to a third-party service.

How to read news like this. Tell a column from an investigation: here the strong wording belongs to the author and the experts, and individual incidents are taken from other outlets' reporting. The company's reply deserves to be read as carefully as the accusations.

Summary

The Verge argues that AI assistants like Muse draw people who agreed to nothing into data sharing, and cites incidents involving messages, an address and profiles of close contacts. Meta replies that access is opt-in and that the data, according to the company, is stored in a separate virtual machine; this cannot be verified from the column. For a company the conclusion is practical: connecting an agent to work email should not be one employee's decision, and it should be tried on test data first.

See also another piece in this section: Copilot gets access to files on your computer.

I work on AI agents and automation. If you would like to see my projects or discuss your own task, take a look at my portfolio.

Sources