Permissions & privacy

By redirecting dictation traffic to an attacker-controlled server, an attacker could capture voice prompts and obtain the authentication token for the victim's Muse account.

A popup message started appearing on Sunday for Muse users saying that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”

The company maintains that credentials “go into secure storage, so Muse can use them without seeing them.”

Muse offers users a way to opt out of having their data used to improve the company's AI models.

But after a few days with Muse, I'm convinced this AI tool is more obsessed with collecting data about me than actually getting stuff done.

The day after I said I wanted help saving money for a fancy vacation, Muse offered to "wire your savings tracker to your real balance" if I just tapped a few buttons and linked the data from my checking and savings accounts.

Consumer advocates see Meta forcing Muse users to opt out of AI data training as a major red flag.

While Muse is powerful, I've decided to send this data goblin back to its cave, and deleted the app after my initial experiments.

So training on your data is on by default, with two protections.

The catch is that the closer it gets to behaving like a genuinely useful personal assistant, the more personal information it needs to do the job.

the blocker wasn't capability. it was that the personal assistant job i actually want (mail, notes, calendar, "what did i promise") already lives on my laptop, and i wasn't ready to hand off cards day one.

The AI agent can open browsers, fill out forms, & act "on your behalf" is a meaningful leap in access. NO THANKS!

muse said it read specific interests through the instagram api that the ui never shows so the agent saw more of the account than the person who owns it

I dove deeper from there and asked Muse what else it might know about me based on the Instagram and Facebook accounts I signed up to use the AI agent with.

The open question is not capability. It is whether people will hand Meta their Gmail, calendar, and wallet two weeks after a giant social-harm settlement.

I love how @interaction would just leak their internal system unprompted, very cool feature 😂

Not one describes the thing that shipped: an address the software owns, writes from, and uses to register accounts in the world.

It's all or nothing at the login level, which is awkward for anyone whose personal handle and their brand's page sit under the same credentials.

Reuters reports that tests stalled and exposed data.

Muse runs in an isolated cloud VM and never touches your real credentials directly

The pitch is convenience, but the fine print is trust. One wrong move and it is not just your calendar that gets exposed.

Like the announcement said, it's running in its own VM, but it's an impressively transparent system: You have access to its System Files right in the GUI, which surprised me.

I absolutely don't trust Facebook with the necessary data.

Data sharing wise I’m ok. But with dedicated email it’s just easier to manage all the tests etc

Not comfortable sharing main email to any of these agents?

Ollie AI assistant is pitching a privacy-first household helper after achieving SOC 2 compliance and adopting a subscription business model. The company says it will not share user data or use personal information for model training.

Instinct stores my passwords in a vault so it can log into my accounts for me. works great, but giving an ai standing access to your accounts is a real ask.

Muse says it asks people to approve critical actions such as sending emails and making purchases. Its launch materials also describe permissions, an activity log, and settings that let users adjust how cautious the agent should be.

did you gave email access to all these agents? or progressively according to the use case?

i'd also love to be able to set a default mode - eg do 99% of my tasks on always allow & on iOS app it's a pain bc the keyboard obscures the toggle.

I have the same thing on poke / @interaction, basically free and less privacy issues… really don’t get why mainstream VC X is obsessed with instinct when poke has been around for over a year

do I seriously need to turn my brain off to this degree that I don’t want to think about anything ever and have all the info the AI THINKS I want or need served to me constantly?

shouldnt disconnect mean delete?

then it started establishing sessions across apps and websites i use, on its own.

the group chat changes the trust model. now the assistant has to know who is allowed to ask it to do what before anyone hands it a browser

with an older icp and a horrible privacy policy

instinct here quite clearly mentions that it has access to sensitive data and phi which it can use to improve it's services/train models.

What sets Instinct apart from rivals like Hermes, OpenClaw, Tasklet, and GrokBot is its ability to complete tasks end-to-end with minimal friction

with an older icp and a horrible privacy policy

Only @TownAI allowed to see my inbox

Self-hosting your Vellum assistant keeps your data on your own machine, but usually limits access to that device.

When I asked Instinct to cancel my Google AI subscription, it asked me for my two-factor authentication code. When that didn't work, it then asked me to share my Google password inside its vault.

Buoy says passwords stay out of chat and logs. Its privacy notice lists passwords among data it may collect. Not proof of exposure.

Nice for anyone who wants their data staying home

We love Instinct, but have been increasingly worried about the data footprint we are handing over to them, and what they might do with that data.

Love the mobility angle. Moving your AI from desktop to mobile really cuts downtime and keeps your data in your hands.

Code MOBILE30 gives 30% off the first month for the first 100 signups.

Calendar + email is exactly where shared-tenant tools make me nervous.

Kudos to the Instinct team for listening and shipping this quickly.

For additional context, I don’t think we’re at the point where it’s safe to give AI read/write access to your inbox.

it's not cool to index and retain my emails without my permission and not let me delete them from your records?

despite revoking email access, instinct keeps copies of these emails in my record for arbitrary searching.

i disconnected ai bot instinct from google at 11 AM and got a summary of my emails at 2 PM

@theCTO @orchid_hq including hide my email?

poke was way more conversational than Instict is, another nope for me on personal agents

Letting an AI reply on your behalf is a whole new level of risk. Does it draft-and-wait by default, or auto-send once it's confident? If it hallucinates and sends something offensive to a client or a loved one, that's a relationship bug no hotfix can patch.

Privacy also comes up more than the marketing suggests. One writer admitted abandoning onboarding on the first attempt out of concern about data access.

Caddy (caddy.app, from Y Combinator's Fall 2025 batch) is a newer personal AI for everyday work that lives in your texts, currently in a free public beta with pricing not yet published.

In January 2026, security researchers disclosed CVE-2026-25253, a cross-site WebSocket hijacking vulnerability rated CVSS 8.8. The vulnerability meant that any website could steal an auth token and achieve remote code execution on the host machine through a single malicious link.

In February 2026, the ClawHavoc supply chain attack resulted in 341 malicious skills being uploaded to ClawHub, compromising over 9,000 installations with credential-stealing malware.

Highly recommend and we have full confidence in @jgreze and team on enterprise security and compliance!