I Tried Meta’s Muse AI Agent. It’s Helpful and Scary at the Same Time.

My first task for Muse: “Change your name to Mark Zuckerberg.” Meta’s META -4.79%decrease; down pointing triangle AI agent refused.

Zuck, Mark and even Marc—no dice. So I pivoted to the Terminator, which was gleefully accepted.

I asked Muse to Terminator-ify its fuzzy blob mascot, and it adopted metal accents and a glowing red cyborg eye. Pretty stinkin’ cute.

Muse is designed to do stuff for you, like an executive assistant. The more you hand over, the more helpful it gets. When I connected my inbox and calendar, my little Terminator found unpaid bills and suggested a recipe based on an incoming produce delivery.

But are cute and helpful enough to overcome my trust issues with Meta, the ad-powered company that also operates Facebook, Instagram and WhatsApp? The company has a history of privacy scandals and data-use controversies.

The app has already been downloaded more than 3.4 million times and topped app-store charts, according to Sensor Tower data. After a week with the Terminator, I began to see how Muse became a hit. And how much data it needs to do its job.

As an AI agent, Muse can answer your queries like a chatbot, and also click around websites, use apps and work with files on your computer.

Muse is the first app I’ve experienced for normal people. Meta successfully hid the complexity of agentic AI behind a simple, friendly interface. And for now it’s free. Once you hit a usage limit, you can pay for more tokens, starting at $20 a month. (I’m reassured by this, in some ways, because it means Meta can make money without using my data or dumping ads into the experience.)

Each Muse user gets a secure “virtual machine,” an unseen cloud computer with its own file system and a web browser that pops up on the user’s screen from time to time.

For my test, I started thinking up real-life admin tasks. First: a rain poncho for my kid’s bike seat. I found a European one, and asked the Terminator to hunt for a U.S. retailer. It came up empty—but found a great alternative in California and loaded the checkout page.

Then the Terminator asked for my credit card.

Actually, it prompted me to connect Link by Stripe, which stores payment methods. Link gives vendors a one-time virtual card number instead of real card details and includes protections, such as a return guarantee.

I opted against Link, instead clicking “Take control of the browser” and typing in the card number myself. The poncho is currently en route.

Next, I asked if my gym offered a membership-referral benefit.

The agent responded with an exciting promo: 50% for both me and my friend. But the deal was for a totally different gym on a totally different coast. Even cuddly AIs can make mistakes.

Muse was, unsurprisingly, adept at perusing Facebook Marketplace. I asked the Terminator to find a white-noise machine. It found a cheap one nearby and drafted a pickup message.

But how would Muse handle our labyrinthine childcare-booking platform? I gave it four dates and times, and my preferred sitters. Once I manually logged in, it made the reservations while I made lunch. It even offered to add the events to my Google Calendar, so I connected that.

I heard the screams of cybersecurity professionals ringing in my ears. But I wanted to see what Muse could do.

I also connected my personal Gmail account with “read only” access: It could see emails but couldn’t delete them or shoot off embarrassing notes to my entire address book.

Muse surfaced a forgotten dentist bill. Watching the agent complete a lengthy form with details from my inbox, such as my appointment date and date of birth, was magical, but also a little creepy.

The agent was also able to gather everything I needed for Global Entry applications from my calendar and inbox, including five years of international travel history.

Not all tasks are successful, however.

My colleague Meghan asked Muse to find cheaper auto insurance. It submitted her information for quotes but said her current rate was as low as it could get. One provider called her, and ended up offering a better deal than Muse previously reported. If she hadn’t spoken to a human, she would have missed $420 a year in savings.

I know, you’re thinking, is it really that hard to fill out a form? I understand, but I also appreciate tools that can help tick things off my endless to-do list.

So why would I not continue using Muse?

Any information you share with Muse can technically be shared with Meta. The company says that won’t be used to serve ads, but it can be used to train AI models. You can opt out in Settings > Data controls. Meta says employees won’t access accounts except under specific circumstances, such as a law-enforcement request or a user-reported problem.

Meta says later this year it will offer a confidential virtual machine that encrypts data so the company can’t access the chats.

“The question for any user is what happens if their device is compromised or the service itself is breached,” says Trevor Hilligoss, chief intelligence officer at security firm SpyCloud.

Ordinarily, your email, your social-media apps and your shopping and banking accounts are all under secure, separate logins. By giving one service access to any or all of them, you’re creating a super resource for an attacker, Hilligoss says.

If your Facebook account gets hacked, that hacker has access to everything you’ve shared with Muse. Meta doesn’t generally require two-factor authentication on its accounts, so it’s up to you to turn that on—and come up with a strong unique password.

Also, AI agents can behave unexpectedly. Users should take control of the browser for any tasks involving money, passwords, account settings or messages sent in their name, says Katie Moussouris, chief executive of Luta Security.

Muse does have a “secure credentials store” for your logins, which Meta says allows the agent to use passwords without seeing them. An agent-friendly password manager integration would be better, and 1Password says its Muse partnership will be available in a few weeks.

AI agents can also be tricked, says Moussouris. A website or email can contain hidden prompts telling the bots to ignore instructions and send personal data to hacker accounts instead.

Meta outlined safety measures that direct the agent to disregard prompt injections and limit its access to secrets. The company says Muse will “sometimes make mistakes.”

I’m going to be cautious and reset Muse for now. Though I might reconsider once the confidential option is available.