AI agents promise to take work off your hands. First, they may need access to your messages, accounts, and personal details, which makes privacy less a feature than the price of admission. Meta and OpenAI are each pitching their agents as the safer choice, but Muse’s early problems show why the promise deserves scrutiny.
The safety claim keeps moving
Meta introduced Muse as a more secure successor to OpenClaw. Mark Zuckerberg described it as built with privacy and security in mind, while Nat Friedman, who leads product at Meta Superintelligence Labs, said the aim was to make an OpenClaw-like agent safe, easy to use, and capable of serving billions of people.
OpenAI made a similar argument for Dots at DevDay. Sam Altman said the company wanted to set a higher privacy standard for advanced AI, and OpenAI executives contrasted their approach with Meta’s. In this market, “safer than the other agent” is becoming a familiar pitch. It is also a claim that users can check only after the product meets real people and real data.
What happened with Muse
Meta says Muse keeps user information in a secure virtual machine, an isolated computer environment with its own browser, processing power, memory, and storage. The company has also said it intends to add a way to verify cryptographically that Meta cannot access information in that environment. That protection was still planned for later in the year, rather than already in place.
Isolation does not remove every security risk. A security researcher found a previously unknown vulnerability that could have let an attacker take control of Muse. Meta patched it. Other serious problems reportedly appeared shortly before launch, including one that could have exposed Meta’s internal databases.
There are also questions about what Muse is meant to do with information once users provide it. The agent defaults to allowing Meta to use user input to train its models, though users can opt out. Reports from users described Muse reading private messages without a clear request and sharing one user’s home address with a stranger through Marketplace. In those cases, the agent was apparently acting as designed, but users had not understood how much access or initiative that involved.
Muse has also been reported to build detailed profiles of users’ friends and family. That may be consistent with an agent designed to help with personal tasks. It is less consistent with the comforting idea that the agent will touch only the information a user has consciously chosen to share.
The product gained attention quickly. It topped the App Store charts and, according to Apptopia, reached 600,000 daily active users in the United States within weeks. A large audience makes the stakes larger, but it also means early problems are more likely to become visible. Privacy promises tend to sound most confident before the first crowded week of use.
OpenAI’s case, and its limits
OpenAI has emphasized user controls. At DevDay, Altman demonstrated rules that could restrict what an individual Dot is allowed to do, such as setting a spending limit for purchases. Company executives also described enterprise options for stronger data controls, including zero-data-retention policies under which information is not stored on OpenAI’s servers.
So far, Dots has not been associated with many public privacy scandals. That is encouraging, but it is not a direct comparison with Muse at scale. Dots is available only through ChatGPT subscription tiers priced at $100 or more, so its user base is likely smaller. A quieter record can reflect safer design, fewer users, or both.
OpenAI’s argument is partly that it is taking more care before exposing an agent to a huge audience. The company’s head of app platform pointed to Meta’s much larger existing user base as a reason the risks differ. That may be true, but it does not settle whether Dots will handle personal data better once more people use it.
The awkward bargain
Agents become useful by acting on information and services that ordinary chatbots can only discuss. That creates a basic tension: the more capable the agent, the more a user may need to trust it with private material, account access, or decisions with real consequences. A request for bank information can be relevant to a task and still feel like a request too far.
Cute design and a friendly voice can make an agent feel less strange. They do not change its permissions. Nor does a claim that data is isolated answer every question about who can access it, whether it is used for training, or what the agent might share while doing its job.
A useful test is to look past the broad promise and ask what controls already exist. Can users limit actions, such as purchases? Can they opt out of training? Is data retained, and who can access it? Are promised protections already available, or still on the roadmap? Meta’s planned cryptographic safeguard and OpenAI’s retention options illustrate why those distinctions matter.
Meta has said Muse may still make mistakes, though its safety systems are intended to reduce their frequency and impact. That is a more realistic claim than perfection, but users still need to understand what the system can do when it makes one. OpenAI has made a case for tighter controls, but its record will be easier to judge as Dots reaches more people.
AI companies want users to share more with their agents. The sensible response is not to assume every promise is empty, or to treat a reassuring launch presentation as proof. Trust is not something a product can quietly collect by default. It has to survive the moment the agent asks for access.