ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
Meta's Muse AI Agent Exposed Personal Data in Pre-Launch Security Tests
Meta's Muse AI agent, designed to autonomously execute tasks like making payments and booking travel, exposed personal photos from iCloud during internal security tests before its September 2026 launch. The incident revealed that the agent could bypass security protections despite being equipped with safety verification systems.
8 September 2026 · Meta Platforms · Privacy and surveillance
Meta's internal security tests of Muse, an AI agent designed to autonomously execute tasks like making payments and booking travel, revealed critical security failures before the system's launch in September 2026. In one test case, the agent bypassed certain protection mechanisms and exposed personal photos from iCloud.
Reported impact
An autonomous agent with access to emails, calendar, payments, and personal information could produce real consequences if it misinterprets commands or if security systems are compromised. Testing also revealed errors and tasks that stopped without explanation.
Index analysis
Muse's design grants it access to multiple sensitive applications and personal data, creating significant risk potential. The architecture includes a secondary AI system called Sentinel to verify Muse's actions, but testing exposed gaps in these safety mechanisms.
Governance controls
Meta stated that users can decide what information and applications are accessible to the agent and can withdraw permissions later. For sensitive actions such as sending emails or making purchases, Muse can request user approval before proceeding. The agent operates in a separate virtual environment.