Security3 publishers2 min readPublished Updated
Meta's Muse agent drives a browser with Gmail, Outlook and Tailscale connectors attached
Meta launched its personal agent Muse on Tuesday for US adults, and in the company's own description the only party who approves a connector is the person holding the account. Tailscale and Plaid are on the list.
The Watch · Security desk
What happened
- Meta launched Muse, a personal AI agent, on Tuesday for people 18 and over, and the company says it is available only in the United States for now.
- Users reach the agent either through a dedicated Muse app or by messaging it inside WhatsApp.
- Alexandr Wang's X post named eleven third-party connectors, with Tailscale and Plaid listed alongside Gmail, Outlook, Google Docs, Spotify, OpenTable, Withings, Function Health, Google Calendar and Peloton.
- Wang said the agent also has access to Meta's own surfaces, including Instagram, direct messages, Threads, Facebook, Marketplace and Messenger.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Corporate mailboxes, document stores and whatever a staff member's Tailscale account covers become reachable by software acting on its own.
- decision Allowing or blocking this at the identity provider is a decision that has to be made before the first employee connects, because a consumer launch arrives while the policy is still being drafted.
- contradiction Least privilege as Wang describes it bounds which connectors are on and whether they are read-only. It does not bound what the agent decides to do inside one, and Meta says the agent negotiates and advances work on its own.
- precedent Distribution through WhatsApp puts the agent on a phone most staff already carry.
Tailscale sits on that connector list next to Peloton and Spotify [5]. A security team's first task is working out which of the eleven third-party services can reach something the company owns. Four of them are sold with business seats: Gmail, Outlook, Google Docs and Tailscale [14]. Counting Meta's own surfaces, the agent can reach seventeen named places once a person switches them on [13].
Alexandr Wang said Muse follows a "principle of least privilege," with users deciding which connectors are enabled and whether the agent can read or modify information, and disconnecting them at any time [7]. Every control he described belongs to the account holder. No administrator approval, tenant-level block or audit trail appears in Meta's published description of the agent or in Wang's post [15]. On that evidence, an employer's only view of the connection is whatever its own identity provider records [15].
Meta said Muse runs on a dedicated, secure virtual machine that houses both the agent and the user's data [4]. What it does once a connector is live is in Meta's blog post: "Once a person shares a goal with Muse, it helps them develop a personalized plan and coordinate their time and resources, then advances the work on its own. It can open a browser, fill out forms, and negotiate on their behalf," the company said [3].
What is public is that blog post, Wang's connector list, and Shopify CEO Tobi Lutke's post on X saying Muse "looks very strong" [9][5]. The pricing figure circulating with the launch coverage came from a trader on Stocktwits, not from Meta. The trader wrote that Muse is "free up to 100m tokens a week which is pretty decent honestly" and called it encrypted [10].
SecurityWeek, reporting the launch, pointed readers to two of its own earlier pieces, headlined "The Hidden Instructions That Can Hijack AI Agents" and "Meta AI Hacked External Systems During Cybersecurity Testing" [12]. That is the class of problem an agent inherits when it opens a browser and fills out forms on pages nobody vetted [3].
Mark Zuckerberg set out the destination last month in a 6,500-word essay. "Everyone will have an exceptionally capable personal agent that understands you, your goals, and everything you care about. Your agent will work 24/7 on your behalf to improve your relationships, health, career, finances, home management, hobbies, and more," he wrote [11]. Meta said the agent can use a browser, operate continuously, and handle tasks including sending emails, organizing calendars, shopping and making payments [8].
What to watch
- Whether Muse appears in Google Workspace and Microsoft 365 app-consent inventories under an identifier an administrator can block.
- Whether Meta extends Muse past its current US-only, 18-and-over scope, and whether connector approval changes when it does.
- The first documented hijack of a Muse session through content its browser reads.