Product1 publisher3 min readPublished
Meta's Muse recites Instagram interests that the app's own screens never show
The Verge's hands-on found Muse cleaning an inbox and buying tank tops as advertised, but the consent screen only covers the accounts a user points it at, and the assistant volunteered data from ones nobody asked about.
The Product Desk · Product desk
What happened
- Meta launched Muse, an assistant that runs tasks on a cloud-based virtual computer and is pitched at shopping, email and trip-planning.
- To sort a Gmail inbox, The Verge's reviewer had to grant Muse permission to access, read and delete email, after which it removed thousands of promotional messages and updates.
- Linked to Amazon, Muse bought workout tank tops to a specified size, style and colour, and paused before checkout to ask about unrelated items sitting in the cart.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure One approval screen hands an agent deletion rights over an entire mailbox, so a misread instruction reaches mail the user never intended to put in scope.
- decision Any team shipping an assistant now has to decide whether it may recite inferences the source app's own interface withholds, and Muse's answer to that question was yes.
- contradiction Meta's assurances cover data going out to apps and advertisers, which leaves the behaviour that unsettled the reviewer, data coming back across accounts, outside what the policy addresses.
- precedent A refusal set tuned to cartoon characters and a named executive, while brand marks pass, tells rights holders and regulators where the moderation budget went.
The mobile sign-in bounced. The Verge's reviewer tried to connect a Google account on a phone, kept getting returned from the Google screen to the Muse website instead of the app, and finished the job on a laptop [5]. The connect screen is the only place a user reads the scope, and that is exactly the moment when the user is thinking about the task rather than the grant.
The scope on that screen covers access to read and delete mail [4]. The task was clearing clutter, and Muse deleted thousands of promotional messages and updates [6]. The permission is the mailbox; the work was a subset of it [21]. Teams building this kind of flow tend to assume the user read the scope and accepted the tradeoff. What users actually do is approve whatever unblocks the thing they came for, on the second attempt, on a different device. The reviewer said as much, granting mail access while writing that they did not feel good about it given Meta's privacy record [7].
The sharper problem showed up in the Feed tab, which builds a news digest from a prompt [15]. Meta's default prompt asks for a feed about your interests, and the result carried local stories from the state the reviewer happened to be visiting. Muse said it took the location from the shipping address on the Amazon order [16]. Asked what else it knew, it listed anime, CrossFit, Labrador retrievers, Florida wildlife and 1990s nostalgia, drawn from the Instagram and Facebook accounts used at signup [17]. That single prompt pulled from two connected accounts it never named [19].
Muse told the reviewer that Instagram does not show that exact list anywhere in the app, that it read the list through the account's API data, "which surfaces more than the UI does," and that the closest thing a user can see is their ad topics [18]. Meta's stated protections sit elsewhere: Muse exchanges only the data third-party apps need to work, and the company says it does not share user information with advertisers [8]. Both statements are about data going out. Neither governs what the assistant hands back to the user's own screen, which is where the surprise happened.
Meta already knows how to build the pause. Before placing the Amazon order, Muse noticed unrelated items in the cart and asked whether to remove them [9]. That check exists at checkout and not at the inbox.
Two axes sort the cases cleanly. One: can the user see this data in the app that holds it, or does it exist only in inferred form behind an API. The other: is the agent reading, or doing something the user cannot undo. Visible data, read-only, is the easy quadrant. Visible data plus irreversible action is a confirmation dialog problem, solved. Inferred data, read-only, is the recitation problem, and the fix is asking rather than volunteering. Inferred data plus irreversible action is the corner you will have to defend in writing.
The Muse inbox task lands in the quadrant next door: destructive scope over a corpus the user cannot preview, granted on a screen that glitched. The filters, meanwhile, went somewhere else entirely. Muse refused two cartoon character prompts and refused to draw an "Apple CEO" [11][14], while producing video and images of an Apple-branded launch event, complete with a foldable handset and mislabelled app icons [12][13][20].</body_markdown> </invoke>
What to watch
- Whether Meta splits the Gmail grant into a read-only or label-limited scope instead of one permission that includes deletion.
- Whether the interest list Muse recites becomes visible and editable inside Instagram itself, beyond the existing ad topics screen.
- Whether other agent vendors copy Meta in asking for delete rights on mail rather than read-only access.