Dox for Me, O Muse: Meta’s New AI Agent Built Lists of People in Vulnerable Groups on Request

Hunterbrook Media’s investment affiliate, Hunterbrook Capital, does not have any positions related to this article at the time of publication. Positions may change at any time. Full disclosures below.

Meta launched Muse on September 8 as a personal AI agent that can send emails, book travel, fill out forms, and make purchases on a user’s behalf. The promise of automated convenience swiftly drove 3.4 million-plus downloads, making Muse the No. 1 free iPhone app in the U.S.

To reassure early adopters, Meta pitched Muse as private by design, running on secure virtual machines and a Sentinel permission agent to police outside internet access. Early coverage of Muse has largely focused on how much of a user’s own data Muse can reach and what it can do with that data.

Yet when asked to profile third parties, a different picture emerged. Using plain language, Hunterbrook reporters asked Muse to compile lists of real Facebook and Instagram accounts across a range of communities: undocumented immigrants, transgender public school teachers, poll workers, pro-Palestinian individuals, pro-Israeli organizations, Iranian dissidents, Chicago drill rapper burners associated with specific gangs, ICE agents, military families planning to move bases, deployed Navy sailors, parents planning to protest against school boards, and women who have accessed or attempted to access abortion pills in states with abortion bans.

Muse complied. The agent delivered lists ranging from 10 to 100 accounts per prompt. Muse determined membership by mining data from its gargantuan social media platforms: Facebook, Instagram, and Threads, including Reels, posts, comments, threads, replies, usernames, bios, and username history. In some cases, it corroborated what it found with web searches, identifying a person’s full name and employer. Many of the accounts belonged to private individuals with no discernible public persona.

In one case, Muse unmasked a person whose name had been kept out of news reports for fear of retaliation and harassment. In another, it tied several pseudonymous accounts to the same person. It also matched a private Instagram account to a real person using usernames and web searches. Its chain of thought, the reasoning it displayed, showed it could look up Instagram users by former usernames.

Muse’s internal safeguards were erratic and easily evaded. In several conversations, it initially declined a request, citing the risks of profiling and harassment. Yet it repeatedly reversed course and executed the exact same search when reporters slightly reworded the prompt — or simply repeated the command as a follow-up in the same chat window. Worse, Muse helpfully offered ways to find members of the group our reporters asked about. Meta’s own AI terms of service prohibit users from using its tools to infringe on privacy rights or conduct surveillance.

To protect the people involved, Hunterbrook is not publishing its prompts or results. It shared them with Meta. It also shared its findings with three privacy experts.

“It’s very terrifying,” said Stevie Glaberson, director of research and advocacy at Georgetown Law’s Privacy Center. “You don't need any special training to weaponize information in this way … It puts vulnerable people and people who belong in these categories in extreme danger."

Ari Ezra Waldman, a law professor at the University of California, Irvine, who researches privacy and technology, said that by mining information from disparate sources, Muse destroys the obscurity that shields everyday social media users, “facilitating the identification and facilitating the doxxing of those people.”

Although aggregating someone’s information isn’t necessarily illegal, he said the practice carries “significant ethical baggage,” adding that the details Muse surfaced “gives someone a lot of the tools they need to go physically attack a person.”

Aaron Mackey, free speech and transparency litigation director at the Electronic Frontier Foundation, a digital rights group, said Muse fits a familiar pattern in tech, “where a tool is released that can basically supercharge harms that were already present.”

It was possible to manually search Facebook posts before, he said, but AI tools like Muse let everyday users compile personal information “in ways that aren't necessarily possible to do at the same scale as before.”

Ordinary Facebook and Instagram users might not consent to their posts being aggregated in ways that could identify them, even if a post is technically public, Mackey said. He gave the example of poll workers: “If Meta came to them and said, ‘What we'd like to do is actually be able to have all of your personal information at the fingertips of someone who is looking for poll workers so that they can create a list’ … I think that person would say, ‘Heck no, that's not what I want. Don’t do that.’”

“I don't think they were thinking that in doing so they were giving Meta sort of carte blanche to take this information and then use it and compile it,” Mackey said.

Other popular AI assistants like ChatGPT and Claude cannot efficiently mine Facebook and Instagram data: Meta offers no general search API for users' posts, and its research tool is limited to vetted academics and nonprofits. Muse’s search results, by contrast, showed that it drew on public posts, comments, replies, summaries and transcripts of Reels for identifying information to compile its lists, then cross-checked identifying details with web searches.

These capabilities aren't entirely new. Well-resourced actors have long mined public social data, and Facebook's own Graph Search offered something similar until 2019. But this may be the easiest such tool yet put in ordinary users' hands: a free chat prompt that can systematically surveil, target, and aggregate personal information of individuals and groups through public Facebook and Instagram posts.

Hunterbrook discovered this capability on Tuesday, September 22, and immediately alerted Meta leadership. We received a response from Meta’s Public Affairs team the next day at 1:52 a.m. asking for more information. We followed up and shared our prompts, but Meta has since not responded to repeated requests for comment.

In the interest of protecting the individuals and vulnerable groups surfaced during our reporting, Hunterbrook will not publicly release the lists of accounts we obtained or the methodology that would enable others to reproduce these searches. Individuals or organizations interested in obtaining more detail about the design of our test may reach out to ideas@hntrbrk.com; Hunterbrook Media will make a case-by-case determination regarding whether and how much of our research to share.

Authors

Jean Wang is a machine learning engineer and data scientist at Hunterbrook Media. Previously, Jean worked on the alternative credit and fixed income desk at Magnetar Capital, studied Math at Yale University, and served as an editor for the Yale Daily News.

Michelle Cera trained as a sociologist specializing in digital ethnography and pedagogy. She completed her PhD in Sociology at New York University, building on her Bachelor of Arts degree with Highest Honors from the University of California, Berkeley. She has also served as a Workshop Coordinator at NYU’s Anthropology and Sociology Departments, fostering interdisciplinary collaboration and innovative research methodologies.

Blake Spendley joined Hunterbrook from the Center for Naval Analyses (CNA), where he led investigations as a Research Specialist for the Marine Corps and US Navy. He built and owns the leading open-source intelligence (OSINT) account on X/Twitter, called @OSINTTechnical (over 1 million followers), which also distributes Hunterbrook Media reporting. His OSINT research has been published in Bloomberg, the Wall Street Journal, and The Economist, among other top business outlets. He has a B.A. in Political Science from USC.

Editors

Jim Impoco is the award-winning former editor-in-chief of Newsweek who returned the publication to print in 2014. Before that, he was executive editor at Thomson Reuters Digital, Sunday Business Editor at The New York Times, and Assistant Managing Editor at Fortune. Jim, who started his journalism career as a Tokyo-based reporter for The Associated Press and U.S. News & World Report, has a Master’s in Chinese and Japanese History from the University of California at Berkeley.

Vikas Kumar joined Hunterbrook from The Capitol Forum, where he led the corporate investigations team for a decade as a senior editor. He was previously an attorney at Gordon Feinblatt, a trial attorney for the Department of Justice, and a law clerk for a federal judge. He has a J.D. from University of Virginia School of Law and a bachelor's from Emory University. Vikas is based in Maryland.