Meta's Muse Wants Your Email, Payments and Health Data. Do These Six Checks First
Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.
Meta has released Muse, a personal AI agent that asks for access to your email, calendars, payments and health data, and uses it to do things for you — selling a car, booking travel, that sort of task. It arrives alongside competitors like OpenClaw and Instinct, and it comes with promises of privacy controls attached to an unusually wide request.
Whether Muse itself succeeds depends on whether people decide to trust Meta with that scope. That is a reasonable question and not the one I want to answer here. The more useful question is the one that applies to every agent in this category, including the ones you will be offered next month: what exactly are you granting, and what does it keep working after you stop watching?
Editor’s take: The part that usually gets missed: budget twice the time for internal coordination and training, not for the tool. The tool is the easy part.
Editor's Take
The question worth asking before granting an agent access is not "do I trust this company" but "what is the blast radius if this is wrong." Email, payments and health data are not one risk bucket — they are three, with very different recovery stories. A leaked calendar is annoying; a payment permission is reversible only with effort; health data never comes back. Grant in that order of caution, not all at once.
An Agent Is Not an App
This is the distinction most people miss, and it is the whole risk model.
An app asks for permission and then runs when you open it. Its access is bounded by your attention. If it does something you did not expect, you are usually looking at the screen when it happens.
An agent is different in two ways. It holds standing access — the grant persists across sessions rather than being requested each time. And it acts on your behalf, which means the output is not just data leaving your device but things happening in the world: an email sent, a booking made, a payment authorised.
Combine those and a compromise changes category. A leaked copy of your calendar is bad. An agent that can read your calendar, write your email and move money is closer to someone holding your phone, unlocked, for as long as the token lasts.
Six Checks Before You Grant Anything
1. Separate read from write
"Access your email" can mean reading it to summarise your day, or it can mean sending mail as you. These are not the same permission and they are not the same risk. If a grant screen does not distinguish them, assume the broader one and look for a setting that narrows it. Read access is already a lot; send-as-you is the permission that turns a mistake into an incident.
2. Look at scope, not just category
Full-mailbox access and access to one label are both "email access." The same applies to calendars: every calendar versus one you create for the agent. If the tool supports scoping, use it. If it does not, that is information about how the vendor thinks about your data.
3. Find out where the data goes and whether it trains
Two separate questions that get collapsed into one: is processing local or in the vendor's cloud, and does your content become training data? The second one matters more than people expect, because "we do not train on your data" and "we do not train on your data by default, but you can opt in" are very different sentences that look similar on a settings page.
4. Check the revocation path before you need it
Before granting, find out: where do I turn this off, and does turning it off delete what it already collected? Those are frequently two different processes, and the second one is often buried. An agent you cannot cleanly revoke is a commitment, not a feature.
5. Decide what it may do with third parties
An agent that can negotiate or transact is acting toward other people in your name. That is a much larger grant than one that only organises information you already have. If payment authority is involved, look for a per-action confirmation and a spend ceiling rather than a blanket authorisation.
6. Demand an audit trail
You should be able to see what the agent did, when, and on whose instruction. Without a log, you cannot detect a wrong action, and you cannot reconstruct one after the fact. If there is no activity history, treat every action the agent takes as unverifiable.
The Bit That Worries Me Most
An agent holding your email and calendar is not only a privacy question. It is also the best phishing pretext ever assembled.
Everything a convincing lure needs — who you talk to, what you are working on, when you are away, what you bought — is exactly the data these agents are being given. If that store is reachable by an attacker, the messages they can produce will be better than anything in circulation today.
We covered the other end of this problem in the BigBear phishing operation, where 474 Microsoft 365 sessions were taken with multi-factor authentication fully satisfied. Put the two together and the pattern is clear: attackers are moving from stealing passwords to borrowing legitimate access. An agent account is the most concentrated form of legitimate access most people will ever hold.
If You Run a Business
An employee granting an agent access to a work mailbox is, in effect, granting a third party access to company data. That is not always wrong — it is frequently genuinely useful — but it should be a decision with an owner, not something that happens during a product tour.
The minimum version: know which agents have tokens against your tenant, log what they do, and make sure offboarding revokes them. Offboarding that closes the account but leaves the agent's OAuth token alive is a gap that is easy to create and hard to notice.
Before you grant anything: know what is already out there. An agent that knows your email, your contacts and your calendar becomes far more dangerous in the hands of someone who already has your address, phone number and date of birth from a broker.
Our identity theft protection comparison covers monitoring for the aftermath, and our phishing identification guide covers the tells to look for when a message is too well-informed to be a stranger.
The Honest Read
I am not going to tell you not to use these tools. Some of them will save real time, and refusing them on principle is not a strategy.
What I will say is that the permission screen is the wrong place to start thinking about this. By the time it appears, the decision has been framed as "allow access to continue," and the interesting questions — what persists, what it can do without you, what happens when you revoke — have already been settled somewhere else, usually in a settings page nobody opens.
Read those first. The agent can wait thirty seconds.
