All the latest news on Meta’s cute, creepy Muse AI agent

Meta has re-enabled Muse sharing after security researchers had reported that public conversation links could be easy to find. The researchers said they had been able to find Muse pages like a marketing company’s internal revenue review and a small business owner’s loan application.

Researchers at Claroc reported earlier this week that Muse the web addresses for shared conversations from Muse were named after a conversation’s title and written into public DNS. Ars Technica said Tuesday that Meta paused the sharing feature after it reached out about what was going on.

Meta is making up for lost time in the AI race. After launching Muse Spark, the first model from its revamped Superintelligence Labs division, and buzzy AI agent Muse, it’s now launching two new models it claims can go toe-to-toe with the industry’s best.

The new models, Muse Wonder and Muse Wonder Full, are available for Muse Code subscribers starting today. Wonder can also be accessed through the Meta Model API, Meta said.

Meta now lets you make your own Muse gadgets that feature the company’s new AI agent with code that the company open sourced. The company suggests projects like loading Muse on a color E Ink display to show reminders, adding it to an HDMI stick so you can display Muse on a big screen, or putting Muse on a small touchscreen device to make what looks kind of like a DIY Muse Charm.

“Muse gadgets are open source devices you build yourself,” Meta says. “Program an off-the-shelf ESP32 board or set up a Raspberry Pi with our SDKs, then connect Muse to your displays, buttons, sensors, actuators, and whatever else you’ve got lying on your workbench.” However, Meta cautions that you should “Proceed at your own risk!”

Tech YouTuber Matt Robb says that Muse gave out his home address to a total stranger this weekend, after authorizing the bot to handle his Facebook Marketplace account. That’s despite Meta placing great emphasis on the security features of Muse when it launched the personal AI agent earlier this month as it tries to catch up with competing AI providers like Anthropic and OpenAI.

“Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up,” Robb said on Threads, providing a screenshot of Muse’s admission. “[Muse] didn’t tell me any of this until after the guy had left (luckily I’m in an apartment with security),” he added in a follow up post.

Yesterday, with a little prodding, it was discovered that Meta’s Muse would expose its filesystem to curious users. The files offered a fascinating peek under the hood of an AI chatbot, and appeared to expose details we weren’t meant to see, not least because Muse itself told people, including us, it wasn’t supposed to reveal them.

But today Muse will eagerly offer up the contents of its file system when you ask for it. That appears to be because, as Meta’s Nat Friedman later said, this is the “intended behavior.”

A pair of developers say that with very little prompting, Meta’s Muse will share its entire filesystem with you. Peter James and Jonny L. Saunders have said they both independently coaxed Muse into zipping up and sharing the entire contents of its root filesystem, Ubuntu system files, app templates, and internal documentation. Saunders posted on Mastodon that it was “extremely easy” to replicate James’ results and that Muse had “Almost no prompt injection resistance.”

Meta denies that the incident represents a security breach. As noted in its announcement post, Meta’s Muse runs in persistent Linux virtual machines for each user. Meta spokesperson Daniel Roberts said, “Just like with the laptop in front of you, of course you can see the files. Exporting virtual machine data doesn’t give people any privileged access to Meta infrastructure or to other people’s data.” Unlike with the average laptop, however, the data potentially reveals some interesting things about how Meta’s new AI platform functions.

We seem to be entering into an AI agent renaissance. Meta’s new consumer-facing AI agent, Muse, topped the App Store charts soon after its release and has 600,000 daily active users in the US, by an Apptopia estimate. And AI agent platform Instinct, whose eponymous creator is fundraising at a $2.5 billion valuation, has been making the rounds in the tech industry. Under the hood, though, there are some obvious similarities to the platform that started it all: OpenClaw.

For the past week or so, some social media users have alleged that Muse is directly built on OpenClaw. The two platforms use the same names for core files (SOUL.md, memory, tools, etc.), and have a lot of similar lines in the doc that governs personality, tone, and more (“Be genuinely helpful, not performatively helpful”). They also have a similar design. One Redditor argued that “Muse is just a wrapper app built on top of” OpenClaw — alleging it probably also came with that platform’s significant security risks. “Only non-tech ppl are buying the hype.”

This is Optimizer, a weekly newsletter sent from Verge senior reviewer Victoria Song that dissects and discusses the latest gizmos and potions that swear they’re going to change your life. Opt in for Optimizer here.

Last night, I asked Blorbo — what I named my Muse AI agent — to help me set some health goals. I was underwhelmed. I’d asked for a workout regimen for a sub-30 minute 5K and regaining lost muscle. It generated an okay-ish but kind of mid weekly routine.

Meta’s handheld AI gadget, called the Muse Charm, will be able to recognize and interact with other nearby Charms when it launches later this year. That’s according to a report from Bloomberg, which includes more details about the device that the company teased during its Meta Connect keynote on Wednesday.

The Muse Charm houses the company’s buzzy Muse AI agent and comes with a built-in 5G modem, meaning you won’t need to connect to Wi-Fi to interact with the AI agent, according to Bloomberg. It will come with a two-inch OLED touchscreen, a new operating system, and a fingerprint sensor you can use to start interacting with Muse AI.

Meta is building a dedicated hardware device for its new Muse AI agent. The product, called Muse Charm, was briefly shown off by Meta CEO Mark Zuckerberg at the end of tonight’s Meta Connect presentation. It looks almost like a chunky smartwatch without the strap — just a big screen, plus a little lanyard for carrying the device around.

The Muse Charm has a fingerprint sensor on the top right corner that you can press to activate and begin speaking to the agent. There appears to be a small camera on the device as well, plus what looks like at least three holes for microphones on the front. Zuckerberg said you don’t have to unlock a phone or open an app to use the Charm, but he didn’t share how it’s actually connecting to Meta’s servers.

Just a couple of weeks after launching Muse, Meta announced that it’s “working on” bringing the agent to its smart glasses, including the new glasses it unveiled at Meta Connect. Users will be able to activate Muse from their glasses by saying its name and ask it to handle tasks like guiding a workout, logging meals, or helping them shop for products they’re looking at.

Muse is just one of several major updates coming to Meta’s glasses. They’re also getting some new accessibility features, like a Hearing Enhancement feature Meta says is “FDA-cleared software for adults with perceived mild to moderate hearing loss.” It will be available later this year with a Meta One subscription or as a $149 add-on for compatible glasses. Meta AI will also be able to give “more context-rich answers” when users ask the glasses what they’re looking at, potentially making Meta’s glasses more effective for helping blind and low-vision users interpret their surroundings. A new audio customization feature will also allow users to shift their smart glasses’ volume between their left and right ears, including sending all audio to one side.

Meta is quickly iterating on its new Muse AI agent, announcing a bunch of updates today that make the bot more capable and able to chat with you in more ways.

Muse agents are getting their own email addresses that they can use for accomplishing tasks. You’ll also be able to communicate with your Muse agent over the new email addresses, too. In addition, the recently launched Muse Mac app will be getting the ability to use your computer.

Modern life comes with an unending, auto-populating to-do list.

It never ceases to amaze me how I can be doing nothing at all, minding my own business, and suddenly something needs to be taken care of. You’re telling me a tree branch fell in the backyard and now I have to figure out what to do with it? The tree just assigned me homework? Oh, our trash collection company canceled our account out of nowhere and now I have to send email about it? Repeatedly? Totally unfair.

Meta has issued a patch for its Muse macOS app following the discovery of a zero-day vulnerability that could allow someone to take control of the AI agent. The bug found by security researcher Patrick Wardle utilized an undocumented Muse setting that enabled potential attackers running local code to redirect transcription processing from Meta’s servers to their own endpoint, Ars Technica reports, giving the attacker access to the Muse account.

Several design decisions reportedly enabled this flaw, including having Muse dictation occur in the cloud instead of on-device, and allowing any app to control all of Muse’s undocumented settings. Proof-of-concept attacks developed by Wardle to test the exploit enabled him to take pictures and write malicious files to disk via Muse, which did not alert the user in many cases.

Meta’s Muse AI agent has been blocked from shopping Amazon on behalf of its users, GeekWire reports. A popup message started appearing on Sunday for Muse users saying that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”

According to GeekWire, Meta didn’t notify Amazon that Muse would access its store. Amazon also expressed privacy and security concerns over Muse failing to identify itself when it browses, and seemingly capturing customer credentials.

Meta’s Muse is apparently an effective AI assistant, but one that’s a little creepy. Part of that is because of its new Mac app, which can access Messages, Calendar, and Notes. But for all its smarts, Muse doesn’t actually know how to describe itself. Jason Aten, a contributing editor at Inc Magazine, posted on Threads screenshots of an interaction he had with Muse in which the assistant asks him some questions about a conversation he was having in Messages.

The problem is that Aten says he didn’t give Muse access to his messages. When asked how it knew about the contents of his messages, Muse replied, “I saw the notification previews, not your message history. I haven’t been reading your texts.” Aten continued to push, asking how Muse was receiving message previews, it didn’t have a good answer. “Honest answer: I can’t give you the exact plumbing,” it said. “What I know is that the paired Mac app exposes notifications as one of its capabilities, and they arrive to me through the device sync.