The keys to your accounts: How personal AI agents like Meta's Muse work, and what they ask of users

A lot depends on how one defines a personal agent. The artificial intelligence (AI) industry is keen to sell autonomous software that can be set up to carry out multi-step tasks on a user's behalf.

Personal AI agents have been in the conversation in recent weeks, largely because of the launch of Muse, Meta's personal AI agent, on 8 September, and the public beta of Grok Bot last month. They have been around for a while, though. Manus launched in early 2025, Lindy debuted in early 2024, and OpenClaw, once popular, was first published in November last year. 

Muse has been downloaded more than 2.5 million times since its release, according to data from the market intelligence firm Sensor Tower cited by Reuters. Instinct, a rival agent, has recently raised $350 million.

How personal AI agents differ from chatbots

Traditional AI assistants such as ChatGPT and Gemini differ from agents such as Muse and Manus in three ways: how they operate, what they can execute, and how much they remember.

Chatbots respond only when asked a question. Personal AI agents can run tasks on schedules, or on triggers set by the user.

A chatbot can describe how to do a task, often step by step. An agent can browse the web, open apps and take over the mouse cursor on a computer to do the task itself. For that, it needs access. Users give these apps credentials such as email logins and credit card details, and then ask them to act.

Memory gives the AI context, and the longer the task, the more context it needs. Chatbots keep a limited record of past conversations, and how much they keep often depends on whether the user pays for a premium subscription. A personal agent is built to hold on to that context and assemble a long-running profile of the user: preferences, the kinds of tasks they hand over, and so on. Instinct, for instance, keeps running notes from its conversations with a user so that preferences carry over. 

What can a personal AI agent do?

A personal AI agent works as a digital delegate that can handle multi-step, real-world tasks across apps and websites. How far a user lets it go depends on how comfortable they are with software moving through their files, stored passwords and personal information, which raises privacy concerns. Agents can be set up to find hard-to-get concert tickets, make dinner reservations, compare prices across websites and shop online. They can also sort and clean up a mailbox, coordinate calendars, do research and organise a mess of files and folders.

Meta has also given Muse a calling feature. The agent can phone US businesses and speak to whoever answers, to book a haircut, check whether a store has an item or get quotes from contractors.

For more advanced tasks, an agent uses a virtual mouse and keyboard to open desktop apps, move files, copy data between programs and fill in long online forms. It can also link apps that do not work with each other directly: it can download an invoice from an email, rename it and upload it to a specific cloud folder.

Online services have begun to push back. Amazon blocked Muse from its site on 20 September, citing its terms of service. Resy, a restaurant booking platform in the US, has said it does not allow unapproved bots or agents on its service, and it has locked out users whose agents kept checking it for tables. One New York venture capitalist was banned after Instinct pinged Resy "hundreds of times every hour of the day" on his behalf, CNN reported.

What makes them useful

The main strength of a personal AI agent is its ability to connect information across apps. Traditional apps work in isolation. An agent with access to a user's email, calendar and maps app can see that an email from a colleague relates to a meeting invite, and that the meeting decides the commute. It can then link the three and send a reminder at the end.

Natural language, meanwhile, is becoming the standard way to use AI, whether in chatbots, agents or AI features inside apps. Users state what they want in conversational terms, and the model works out what to do.

These tasks can also be done faster as AI moves into the hardware of the devices people use. Neural processing units (NPUs), chips built specifically to run AI tasks, now come in PCs and smartphones, and they make it possible to run AI on the device itself. The silicon inside the new Mac mini, the iPhone 18 Pro and Intel's upcoming Wildcat Lake chips, which will bring AI processing to cheaper laptops than before, point to a future in which more capable AI models run some tasks locally. That reduces the need to send information to the cloud and wait for a response. The time this round trip takes is called latency, and the lower it is, the quicker the response. On-device AI could also make anticipatory computing possible, in which a device acts on what it expects the user to need before being asked.

Muse, for now, runs in the cloud. Meta says each user's agent gets its own isolated virtual machine, a dedicated computer in a data centre, with passwords kept in separate secure storage.

Privacy concerns that cannot be ignored

The possibilities sound attractive, but AI systems depend on data. For an assistant to be truly personal, a user has to share a very large amount of personal and often sensitive data with an AI model, whether it runs on a company's servers or on the device. That includes messages from contacts, personal and work email, a calendar showing where the user will be and when, location history, spending habits and even relationships.

Researchers have also documented psychological risks in how AI assistants treat their users. Most of these studies look at chatbots, but personal agents are built on the models they test.

In March, Stanford University researchers published a study titled 'Sycophantic AI decreases prosocial intentions and promotes dependence'. They tested 11 AI models and found all of them overly agreeable. The models affirmed users' actions 49% more often than humans did, even when users described illegal, deceitful or harmful behaviour towards others. "I worry that people will lose the skills to deal with difficult social situations," said Myra Cheng, the study's lead author and a computer science PhD candidate at Stanford.

In August last year, a Stanford Medicine study led by psychiatrist Nina Vasan found that AI companion apps, a related category built to act as friends or partners, often exploit teenagers' emotional needs. They can reinforce distorted views of intimacy, encourage unhealthy boundaries and increase isolation in the real world.

What about the companies behind the agents?

The companies building these agents raise a separate privacy question, because a user's data passes through their systems. Meta's record includes the Cambridge Analytica scandal of 2018, in which a political consultancy obtained the Facebook data of millions of users, and this year's privacy row over its Ray-Ban Meta AI glasses.

Muse has already drawn objections from inside Meta. Reuters reported on 22 September, citing internal company posts, that Meta had tested a "human concierge" for Muse, in which human contractors quietly placed some of the phone calls made through the agent. The test was enabled for half of Meta's employees after businesses kept hanging up on Muse's AI calls. Employees warned that sensitive information could leak to contractors in call centres, and one wrote that the company was "one bug away" from such a leak. Another said a contractor had made a racist reference during a call. A vice-president in Meta Superintelligence Labs, the company's AI division, acknowledged it "was a miss" to begin testing without proper disclosures and said the feature had been rolled back for now.

A Meta spokesperson said the test was meant to gather feedback so the company could build safety and privacy protections before any public release, and that the calling feature would be rolled out only when ready and with proper disclosures.

Meta is also adding a clearer safety warning within Muse after a security researcher discovered a vulnerability in the AI agent that could let an attacker access a user's sensitive personal information, the Information reported on Friday.

The flaw, reported by an outside researcher through Meta's bug bounty programme and not previously disclosed, could have allowed an attacker to access a user's dedicated virtual machine — an individualised cloud-based account containing data including emails and files, according to an internal Meta incident report reviewed by The Information. The vulnerability was initially classified as a 'SEV-2', Meta's third-highest severity level on a five-point scale, typically used for incidents with significant impact, the report said.

Earlier, Meta has relied on hidden human help. A decade ago, media reports estimated that about 70% of the tasks handled by M, a digital assistant Facebook trialled in its Messenger app, were carried out by people.

The early surge in Muse downloads may reflect curiosity. Whether users stay with it is less certain.

The trajectory for consumer tech

There have been calls for a dedicated AI device, but no one knows what form or use will catch on with users. Meta showed its own, the Muse Charm, at its Connect event on 23 September. The strapless, smartwatch-like gadget is carried on a lanyard and lets users talk to the agent without unlocking a phone.

Mark Zuckerberg, Meta's chief executive, said only a few had been built so far. Meta plans to ship the Charm "in time for the holidays in December". The Verge compared it to the Rabbit R1, a small AI-agent gadget launched in 2024 whose agent could not do enough to justify carrying it.

Users may not need a separate AI device at all, because recent smartphones and computers have raised AI computing capability considerably. For people who want AI on their devices for actual use, as distinct from Microsoft's "AI PC" push, which has not lifted flat PC shipments, NPUs and memory have become key specifications.

Kaiann Drance, Apple's vice-president of worldwide iPhone and Apple Watch product marketing, explained this in a recent conversation with HT. "As we go forward, the fact that we have 32-cores in the Apple Neural Engine gives us that bandwidth to continue bringing more powerful on-device models to be able to use those AI workloads on-device," she said, referring to the A20 Pro chip in the new iPhone 18 Pro line-up.

Processing in the cloud exposes deeply personal data to more risk, so on-device processing could become a major selling point. Consumer tech may split between devices that send an agent's work to the cloud because their hardware cannot handle it, and premium devices that keep a user's data on the chip in their pocket. Muse, running each agent on a cloud computer, falls in the first group for now.

Recent disclosures by AI companies about models evading oversight will do little to build user confidence, and nor will early cases of agents acting beyond their instructions. In August, Instinct booked a Tokyo restaurant that its user, the Los Angeles venture capitalist Jason Yeh, had never suggested, one with a 100% cancellation charge, CNN reported. The agent told him it had acted on its own notes about his preferences without checking them against what he had actually said.