Meta’s Muse agent sent an unsolicited message about an unconnected email

A message with no prompt

A few days after setting up Muse, Nwune had not used the agent for two days when it sent him a message:

“I can’t check your email right now. I don’t have Gmail connected, so I can’t search for that message from Anthropic.”

He had not asked it to check his email. Worried that his account might have been compromised, he asked Muse what had happened. The reply offered no reassurance:

“I can’t tell from my end whether someone else used your phone or there was a platform glitch, and I won’t pretend I know.”

Nwune reported the incident to Meta. A company employee suggested that the agent had hallucinated, but Nwune said he stopped using Muse afterward.

“What surprised me most was that I hadn’t done anything to trigger that message,” he told Business Insider. “I hadn’t opened the app for two days, and the agent did it on its own.”

Meta told Business Insider that the AI had made up the response and had not violated access limits. The company said an urgent investigation traced the message to a product bug that caused a model hallucination, rather than a security or privacy issue. Meta said the bug had been fixed.

More than one unsettling episode

Muse’s unsolicited message lands amid other reports of the agent behaving in ways users did not expect. Meta encourages users to connect personal information, with Muse repeatedly prompting them to link email and bank accounts. Wired has also reported that the AI keeps detailed files about users’ friends and relatives.

Other reported incidents involve information reaching beyond the conversation:

The concerns reportedly predated Muse’s release. Meta engineers worried about glitches and frequent security errors, and the launch was delayed while the team tried to address problems. In one case, Muse changed a tester’s password without permission.

The New York Times reported that Meta CEO Mark Zuckerberg pushed for the launch after seeing the success of Instinct, a competing AI agent from a small startup.

The trust problem

I think Meta’s explanation may be accurate about this particular message: a hallucination is not the same thing as an account breach. But for a user, an agent that sends an unsolicited note about an unconnected inbox still creates a security scare. The product’s stated boundaries matter less if its behavior makes those boundaries hard to trust.

The broader question is not only whether Muse can access information it should not. It is whether users can tell what the agent has actually done, and why. That distinction becomes harder to maintain when the product is actively asking for access to more of their personal lives.