Your AI is keeping notes on everyone you know

In September, Meta launched Muse, a personal AI agent that can read your email and calendar, shop, book and manage tasks on your behalf. Early reviewers found it genuinely useful. One described it as the first agent that felt built for ordinary people rather than power users. That matters, because it means this kind of assistant is about to go mainstream.

The weeks since launch have also shown what it takes to make an agent that helpful. The answer is a lot of personal context, gathered continuously.

A page for every person in your life

Reporting by Wired and Time described how Muse keeps a running profile for the people a user interacts with: family, partners, friends and colleagues. According to that reporting, these profiles are refreshed frequently and include details like where people live, what they do and how close they are to the user. The people being described never signed up for any of it.

Meta's position is that an agent needs context about you and the people you deal with to be useful. That is a fair point. An assistant that cannot tell your plumber from your spouse is not much of an assistant. The question is who decides how much context is enough, and who gets a say.

Forgetting is harder than it looks

PCWorld reported that Meta's own help text warns Muse may still remember information it learned from content you delete. And Muse's App Store privacy label lists 31 of Apple's 35 data types, according to an analysis by Surfshark, more than any other major assistant it compared.

None of this makes Muse unusual. It makes it early. Every company building a personal agent faces the same pull: the more the agent knows, the better it works. Without a counterweight, the easiest path is to collect everything and sort it out later.

What to take from it

• Assume an agent remembers what it reads, including what you tell it about other people.
• Check whether "delete" in an AI product means erased or just hidden.
• Connect accounts one at a time, starting with read-only access where it is offered.
• Treat the details of friends and family as theirs, not yours to hand over.

Helpful AI is coming either way. People deserve that help without giving up their privacy.

Before you give an agent the keys

A chatbot answers questions. An agent does things: it reads your inbox, fills in forms, books the table and pays the bill. To do that it needs access, and access is usually granted in one big click. Here are six questions worth asking before you click.

1. What exactly am I connecting?

"Connect your email" often means every message you have ever sent or received, not just this week's receipts. Read the permission screen. If it asks for more than the job needs, that is worth noticing.

2. Can it read, or can it also act?

Reading your calendar and changing it are very different powers. Where a product lets you choose read-only access, start there and upgrade later if you need to.

3. How long does the access last?

Most connections stay open until you remember to close them. Make a note of what you connected and check back in a month.

4. What will it remember?

Many assistants now keep long-term memory. Look for a way to see what it has stored about you, and test whether deleting something really removes it.

5. Who else is in my data?

Your inbox and contacts are full of other people. When an agent reads them, it learns about your friends, clients and family too. They did not agree to that.

6. Can I leave?

If you switch assistants next year, what comes with you and what stays behind? The more an assistant learns, the harder it becomes to walk away.

None of this means avoiding agents. They can save real time. It means treating access like a key you hand to someone: on purpose, for a reason, and with a plan to get it back.

Locked is not the same as private

When technology companies talk about privacy, they usually talk about encryption. Your data is locked, they say, so nobody else can read it. That is valuable, and every serious product should do it. But it answers only one question.

Two different questions

Encryption answers who can read your data. It does not answer what gets collected, what gets inferred, or where it goes next. A perfectly encrypted profile is still a profile. If an assistant has built a detailed picture of your health, money and relationships, locking that picture does not change the fact that it exists.

The inference problem

You do not have to tell an AI something for it to know it. A year of ordinary conversations can reveal a great deal: a health worry, a tight month, a relationship in trouble. None of it stated, all of it reasonably guessed. Encryption protects those guesses from outsiders. It does nothing to stop them being made.

What privacy should mean

Locks matter. But real privacy takes more than a lock, and it has to be designed in from the start.