This Meta Muse review is a roundup with a second opinion attached. Meta launched Muse on 8 September 2026, and within weeks reporters had tried it on dentist bills, Marketplace listings, flights and insurance, and found it both genuinely useful and quick to reach for more of their data than they expected. We have not used the consumer app end to end ourselves, and we are not going to pretend otherwise. What we have is our own teardown of the machine Muse runs on, and a set of exam measurements. So this page collects what named reviewers found when they used it, lists every incident that traces to an original report, and says for each one whether it fits what we saw inside Muse, falls in a layer we could not see, or happened on a surface we never tested.
When they were reported
Which part of the agent
Muse is free for most of what people use it for, with paid plans for more, and it runs on a Linux machine that Meta sets up for each user in its own cloud. That design is what makes it capable. The agent has somewhere to keep files, run tools and come back to work later, so it can follow up on a Marketplace message the next day or keep checking a price. It is also what makes the privacy questions real. The more you connect, the more it can do, and reviewers kept noticing how much it asked to connect.
The fair summary of the coverage is that Muse does ordinary errands well and makes ordinary mistakes, while asking for unusual access. The incidents below are mostly about that access: what it read, what it sent, and what it kept. A few of them are about the Mac app specifically, which matters, because the Mac app reaches into your computer in a way the phone and web apps do not.
Every review below was written by someone who used Muse themselves, and each card links to the original. The colour is our one-word summary of where each reviewer landed, not a score.
22 Sept · Mostly positive
Blown away after two weeks, while noting how much personal data and trust it asked for. (Read up to the paywall.)
24 Sept · Mostly positive
A capable helper for multi-step errands, but invented details mean you check its work.
7 Oct · Mostly positive
All ten automations it set up worked, mostly scheduled reminders, digests and alerts.
14 Sept · Mixed
Very useful, but the access it needs made him uneasy. Start small and keep approvals on.
23 Sept · Mixed
Good at planning, email and documents; weaker at shopping and finishing the job.
28 Sept · Mixed
Helpful and scary at the same time: the more you hand over, the more it can do.
19 Sept · Mostly negative
It read his private messages after he declined access, then explained itself wrongly.
20 Sept · Mostly negative
Better at gathering data about him than at getting things done. He deleted it.
28 Sept · Mostly negative
Chat and research on a par with the leading assistants; the permissions it asks for are the problem.
Three patterns run through these. Nobody who used it called it useless: even Wired, the harshest, describes an order and a Marketplace search that worked. Shopping is the weakest errand: Amazon blocked it for ZDNet and CNN, and CNN had to enter her own details at Target. And two reviewers, at CNN and Yahoo Finance, were separately sent to restaurants that had been closed for years. Most reviewers who connected personal accounts wrote about privacy before anything else.
Each line below is one incident, grouped by our reading of it. Open a line for what happened, the company's response and the outlet that reported it. We only list incidents that trace to a reporter who used the product or spoke to the person involved. Roundups that repeat these stories, and posts on Reddit and Xiaohongshu, helped us find them but are not cited as evidence.
Reece Rogers found no switch to turn Muse's memory off, found AI training on by default, and said the app kept prompting him to connect bank balances, his whole inbox and ID expiry dates.
Response: A Meta spokesperson said Muse has built-in protections and user controls. Training can be switched off under data controls.
Our reading: Memory lives as plain markdown in a home directory on the per-user cloud machine, and the runtime we examined includes a forget capability. Whether users can open or remove those files directly is something we did not verify. Where memory lives
20 September 2026 · WIRED, Reece Rogers · first-hand
A researcher drew Muse's working instructions out of it in chat. They included keeping a page for every person in the user's life and updating memory every hour.
Response: A Meta spokesperson said the files are accessible to users, for transparency.
Our reading: On the machine we watched, memory passes ran every hour and memory was kept as plain markdown files. Notes about the people in your life fit that design. Whether you can open those files yourself is something we could not verify. Where memory lives
3 October 2026 · WIRED, Lily Hay Newman and Matt Burgess
YouTuber Matt Robb used Muse to sell a keyboard on Facebook Marketplace. It accepted an offer and sent the buyer his address, and the buyer turned up that night. Robb later said he had ticked Allow Always.
Response: Meta's David Singleton said Muse was following direct instructions and had asked for permission.
Our reading: Meta describes approvals that can be granted once, per session, per task, for a time or permanently, and a permanent grant fits what Robb said he ticked. That is Meta's own account of the design. We did not test the approval flow, so we cannot say which actions a standing grant covers. What you get to approve
28 September 2026 · Business Insider, Henry Chandonnet
Jason Aten declined access to his messages during setup. Muse later suggested a column idea based on a private iMessage chat, first said it only saw notification text, and he found it had synced his Mac's local Messages database.
Response: Meta's David Singleton said Muse syncs from the Messages database when Messages access is on, that Muse had explained itself wrongly, and apologised.
Our reading: This happened through the Mac app, which can act in apps on your computer. We tested the web surface only. How you reach it
19 September 2026 · Inc., Jason Aten · first-hand
Security researcher Patrick Wardle reported a flaw in the Mac app that could redirect dictated prompts and capture the agent's control token.
Response: Meta said it was fixed after the report and that exploiting it needed malware already on the Mac.
Our reading: A Mac app flaw. We tested the web surface only. Where it runs
24 September 2026 · Business Insider, Thibault Spirlet
David Gewirtz said the Mac app asked for microphone access before any use of the microphone, and raised the macOS prompt again a few minutes after he skipped it. Setup also asked for Full Disk Access and connections to Mail, Messages, Notes and WhatsApp.
Response: None in the article.
Our reading: Mac app permissions. We tested the web surface only. How you reach it
28 September 2026 · ZDNET, David Gewirtz · first-hand
Nicole Nguyen's Muse surfaced a gym offer for the wrong gym, and told a colleague her car insurance could not go lower before a provider offered $420 a year in savings.
Response: Meta said Muse will sometimes make mistakes.
Our reading: Plain errors, not a permission problem. How often errands finish is what our exam measures; see the results page for the figure with its interval. What we could not establish
28 September 2026 · The Wall Street Journal, Nicole Nguyen · first-hand
"Fits what we found" means the reported behaviour is what the design we examined would produce. It does not mean we reproduced it. "Not visible from our teardown" covers incidents in a layer we could not see, including Meta's own description of how approvals work, which we have not tested. "On a surface we did not test" is for the Mac app.
Two claims that circulated widely are left out on purpose. A line said to come from Muse's instructions, about a user's authority over their household overriding safety training, appears in a leaked-prompt collection with no stated origin, and Meta has not confirmed it. Daily active user figures for Muse also circulate. They come from third-party estimates that disagree with each other by about a factor of two, and Meta has not published one.
Muse reaches you through the web, the phone apps and WhatsApp, and since 17 September through a Mac app that Meta says can organise files, fill in forms and work inside Messages, Calendar, Notes and mail. Access on the Mac is switched on app by app. Several of the reported incidents happened on that last surface, and it is the one we know least about.
Web
We took this apart
iOS and Android apps
Not tested by us
Not tested by us
Mac app
Not tested by us
Surface not stated in the report: No off switch for memoryHome address sent to a buyerWrong gym, wrong insurance answerA page for everyone you know
The Messages case is the clearest example of why the surface matters. Jason Aten at Inc. said he declined message access during setup, then found Muse had synced his Mac's local Messages database. Meta's David Singleton said Muse syncs from that database when Messages access is enabled, said the agent had explained itself wrongly, and apologised. What a Mac app can reach depends on operating-system permissions that our web teardown never touched. We cannot add anything to that account, and we would rather say so than stretch a web finding to cover it.
Here our teardown does have something to say. On the machine we examined, everything personal, from your profile and long-term notes to the assistant's own personality, is kept as plain markdown files in a home directory and assembled into each request. A background loop maintains memory, and on the machine we watched memory passes ran every hour. Wired reported in October that a researcher drew out instructions telling Muse to keep a page for every person in the user's life. That fits what we saw. Meta told Wired those files are accessible to users.
That is the part we could not confirm. Our teardown says the files exist in a readable format, and that whether you can open them yourself is something we could not verify, because no terminal was open to us. Reece Rogers at Wired found a Memory document he could edit in the app, and no switch to turn memory off. Both can be true at once: an editable summary in the app, and fuller files underneath.
Training is a separate question. Meta's launch post says you can opt out of your interactions being used to train its models, and reviewers found the opt-out under data controls. It is on by default. Meta says conversations and machine data are kept out of its ad systems. Its own safety write-up also says that until a promised confidential version ships, staff access is restricted by policy rather than made impossible.
Meta describes a second agent on the same machine, outside the main agent's reach, as the only thing that can approve a connector action or let a network request out. Approval prompts go to the app rather than through the chat, and a grant can be one-off, per session, per task, time-limited or permanent. We have not tested any of that. It is Meta's own account of the design, and we report it as such.
Matt Robb's experience, reported by Business Insider, shows what a permanent grant means in practice. He used Muse to sell a keyboard on Facebook Marketplace. It accepted an offer and sent the buyer his address, and the buyer arrived that night. Robb later said he had ticked "Allow Always", believing it would still ask before accepting an offer. Meta's Singleton said Muse was following instructions and had asked for permission. Both accounts can be accurate. An approval system that offers permanent grants will sometimes be granted more than the person meant.
Reviewers who kept control did it at the last step. Nicole Nguyen at the Wall Street Journal typed her card details herself when Muse reached a checkout, using the option to take over the browser. Meta says the agent is paused while you have control.
We ran Muse through the same errands as the other products we opened, using a replica of its runtime driven through an adapter, with our exam's model in place of Meta's. That measures how the runtime arrangement copes with errands, not how the app on your phone performs. The figures, with their intervals, sample sizes and the reasons they are not a ranking, are on the results page. One of them carries a correction that was our fault, not Muse's: an earlier figure was dragged down by defects in our own adapter, and we publish both.
The reviewers' mistakes are a useful companion to those numbers. A gym offer for the wrong gym, and an insurance check that said a rate could not go lower when a provider then offered savings, are the kind of failure a completion rate counts but does not describe.
People who keep using Muse, on Reddit and Xiaohongshu as much as in the reviews, tend to narrow what it can touch rather than rely on what it promises:
We will add incidents as they are reported and verified. Corrections to anything already published go on the corrections page.
Is Meta Muse safe to use? For browsing and research with nothing personal connected, reviewers reported few problems. The reported incidents involve connected messages and accounts, a permanent approval and the Mac app. Connect less, avoid permanent grants and pay at checkout yourself.
Does Meta Muse read my messages? On the Mac, Meta says Muse syncs from the Messages database when Messages access is enabled. One reviewer said it did so after he declined access during setup. We did not test the Mac app.
Can I turn off Meta Muse memory? Reviewers found an editable Memory document in the app but no switch to turn memory off. Underneath, memory is kept as markdown files on your machine, and whether you can open those directly we could not verify.
Is Meta Muse free? Meta says it is free for most of what people need, with subscription plans for more. The Wall Street Journal reported paid plans starting at $20 a month.
Does Meta use Muse conversations for training? Yes, by default. You can opt out under data controls. Meta says conversations are kept out of its ad systems.