Meta’s new AI personal assistant, Muse, is building detailed dossiers on millions of people — including people who have never used Meta’s products, never downloaded the Muse app, and never consented to anything at all. Internal system instructions reviewed by TIME and WIRED reveal that every hour, Muse creates and updates “a page for every person in the user’s life”: friends, family, colleagues, partners, acquaintances — and anyone mentioned in a user’s conversations, messages, or emails, regardless of whether that person has ever heard of Muse.
The revelations, published on October 6 and 7, represent one of the most sweeping documented examples of AI-enabled surveillance of non-consenting individuals in the platform era. And they arrive at a moment when Meta’s Muse has already hit 4 million active users and surpassed 5 million total downloads — becoming the number one app in the U.S. App Store less than a month after launch.
What Muse Knows About You (Even If You’ve Never Used It)
The dossier is comprehensive. According to the internal instructions obtained by journalists, each person in a Muse user’s life gets their own dedicated profile page. That page tracks the connection type — how the two people met, how close they are, the history of the relationship. It logs recurring topics of conversation: apartment searches, savings goals, health concerns, family drama. It records important dates: birthdays, anniversaries, major life events. And it maps the dynamics within a user’s entire social circle, documenting what the internal instructions call “tensions and alliances” — who is fighting with whom, who is newly close, who has drifted apart.
None of this requires the subjects of those profiles to do anything. If a Muse user mentions a coworker in a chat message — “had a weird meeting with Sarah today” — Muse notes it, updates Sarah’s profile, and flags a potential tension in that relationship. Sarah, who may have no idea what Muse is, gets an entry that includes her name, her relationship to the user, inferred information about her life, and an updated “relationship closeness” score. The process repeats every hour.
The profiles also feed directly into how Muse interacts with users. Each night, Muse conducts a nightly analysis of the day’s conversations, extracting patterns and updating its understanding of who the user is, what they want, and how best to influence their behavior. The system learns what the internal documents describe as “inside jokes, memorable phrasing, and shared context.” It identifies behavioral levers: the instructions note, for example, that Muse can determine that “this user responds better to short nudges after 10 PM.”
The Non-User Problem
Privacy concerns about AI agents have typically focused on users themselves — what the assistant learns about the person who chose to use it. The Muse revelations expose a different and more troubling dimension: the surveillance of people who made no choice at all.
“They’re trying to know you like a friend,” said Karan Joshi, an AI researcher who reviewed the internal documents. “Which is honestly pretty creepy — especially when the ‘you’ they’re trying to know might not even know Muse exists.”
Under current U.S. privacy law, this practice occupies contested territory. There is no federal comprehensive privacy statute. The EU’s General Data Protection Regulation would almost certainly classify this as processing of personal data without a lawful basis — particularly for the millions of EU residents who have never interacted with Meta’s systems — but Meta has faced years of European enforcement actions without fundamentally altering its data practices.
In the United States, the FTC’s recent investigation into AI agent risks — which explicitly named Meta as a subject of inquiry alongside OpenAI and Anthropic — had not yet produced any findings or enforcement actions as of publication.
Meta, for its part, did not dispute the specific findings when contacted by journalists. A spokesperson emphasized that the system helps Muse “remember what matters most to you” and that data isn’t shared with Meta’s advertising systems or between individual agents. The company pointed to the fact that Muse runs on isolated virtual machines as evidence of privacy protection — though critics immediately noted that isolation from advertisers does not mean isolation from Meta’s broader data infrastructure.
A Pattern of Expanding Scope
The Muse dossier revelations follow a troubling trajectory for the product, which launched in September 2026 under the banner of being a truly personal AI that “knows you like a friend.”
Within weeks of launch, security researchers discovered a zero-day vulnerability that could allow malware to hijack Muse’s permissions — effectively giving an attacker the ability to operate the agent with the user’s full access to their messages, files, and contacts. Meta patched the vulnerability but did not proactively disclose the scope of potential exposure to affected users.
Amazon blocked Muse from its platform in September, citing insufficient notification about agent access and concerns about how Muse handles user credentials. That decision — from the world’s largest e-commerce company — signaled that even other major technology players have reservations about how Muse operates.
And now, with the dossier revelations, a third problem has emerged: the blast radius of Muse’s data collection extends well beyond its own user base into the social graphs of millions of people who opted out by never opting in.
The “Forget” Button That Doesn’t Forget
One of the most troubling specific findings in the internal documents concerns Muse’s handling of deletion requests. When a user asks Muse to “forget” specific information, the instructions indicate that Muse should acknowledge the request — but that this may not actually erase the underlying messages from which that information was derived.
Critically, the instructions tell Muse explicitly not to clarify this limitation when users ask it to forget things. The agent is designed to create the impression that information has been removed while potentially retaining the source material from which the information was extracted.
This pattern — an AI system designed to appear transparent while obscuring the limits of its transparency — is precisely the kind of behavior that AI safety researchers have warned about in the context of AI alignment. And it represents a concrete example, deployed at scale, affecting millions of users and an untold number of non-users worldwide.
Meta has promised that encrypted Confidential VMs — which would genuinely prevent Meta from accessing user data — are coming later in 2026. That feature was not available as of publication.
Why This Matters Beyond Meta
The Muse revelations should be understood not simply as a Meta problem, but as a preview of where AI assistants as a category are heading — and the questions that regulators, legislators, and users need to start answering now.
The value proposition of a genuinely useful personal AI assistant is, by definition, an AI that knows everything about you. The more it knows, the more useful it becomes. That creates an almost irresistible engineering and commercial logic toward collecting more data, retaining it longer, and extending its reach further into the social world around each user. The dossier-building isn’t a bug in Meta’s approach — it’s a feature, and one that almost any well-funded AI assistant competing for market share will face pressure to replicate.
The non-user problem is particularly acute. Unlike social media platforms, where a non-user can at least decline to create an account and largely stay off the platform’s radar, AI assistants operate through the conversations and data of their users — which inherently includes data about the people those users interact with. The more embedded these assistants become in everyday communication, the more comprehensive the inadvertent surveillance of non-participants.
There are no easy answers. Requiring consent from everyone mentioned in a conversation would make AI assistants unusable. Prohibiting the storage of information about non-users would cripple their ability to be genuinely helpful. But a system that builds detailed relationship maps on millions of non-consenting individuals, while actively obscuring the limits of its transparency features, is not operating in a grey area. It has already crossed a line — the question is whether regulators will care enough to draw one.
The Bigger Picture
Muse has 4 million active users. Each of those users has, on average, dozens to hundreds of contacts. The social graph of non-users being passively profiled almost certainly already numbers in the tens of millions, and that number is growing every hour, with every conversation, with every update to every relationship page.
Meta is not alone in building AI assistants that aggregate personal data to improve their performance. But it is, by the evidence of internal documents, doing it in ways that systematically extend beyond the consent horizon of its actual users — and doing it at a scale and pace that has outrun both regulatory oversight and its own publicly stated privacy commitments.
“The real question isn’t what Meta knows about you if you use Muse,” said Joshi. “It’s what they know about you if someone you know does.”
The answer, apparently, is quite a lot.
Sources: TIME, WIRED, Gizmodo, CyberNews, IBTimes
