Meta's Muse recites Instagram interests that the app's own screens never show

The mobile sign-in bounced. The Verge's reviewer tried to connect a Google account on a phone, kept getting returned from the Google screen to the Muse website instead of the app, and finished the job on a laptop ^[6]. The connect screen is the only place a user reads the scope, and that is exactly the moment when the user is thinking about the task rather than the grant.

The scope on that screen covers access to read and delete mail ^[5]. The task was clearing clutter, and Muse deleted thousands of promotional messages and updates ^[12]. The permission is the mailbox; the work was a subset of it ^[19]. Teams building this kind of flow tend to assume the user read the scope and accepted the tradeoff. What users actually do is approve whatever unblocks the thing they came for, on the second attempt, on a different device. The reviewer said as much, granting mail access while writing that they did not feel good about it given Meta's privacy record ^[7].

The sharper problem showed up in the Feed tab, which builds a news digest from a prompt ^[10]. Meta's default prompt asks for a feed about your interests, and the result carried local stories from the state the reviewer happened to be visiting. Muse said it took the location from the shipping address on the Amazon order ^[17]. Asked what else it knew, it listed anime, CrossFit, Labrador retrievers, Florida wildlife and 1990s nostalgia, drawn from the Instagram and Facebook accounts used at signup ^[18]. That single prompt pulled from two connected accounts it never named ^[20].

Muse told the reviewer that Instagram does not show that exact list anywhere in the app, that it read the list through the account's API data, "which surfaces more than the UI does," and that the closest thing a user can see is their ad topics ^[11]. Meta's stated protections sit elsewhere: Muse exchanges only the data third-party apps need to work, and the company says it does not share user information with advertisers ^[1]. Both statements are about data going out. Neither governs what the assistant hands back to the user's own screen, which is where the surprise happened.

Meta already knows how to build the pause. Before placing the Amazon order, Muse noticed unrelated items in the cart and asked whether to remove them ^[8]. That check exists at checkout and not at the inbox.

Two axes sort the cases cleanly. One: can the user see this data in the app that holds it, or does it exist only in inferred form behind an API. The other: is the agent reading, or doing something the user cannot undo. Visible data, read-only, is the easy quadrant. Visible data plus irreversible action is a confirmation dialog problem, solved. Inferred data, read-only, is the recitation problem, and the fix is asking rather than volunteering. Inferred data plus irreversible action is the corner you will have to defend in writing.

The Muse inbox task lands in the quadrant next door: destructive scope over a corpus the user cannot preview, granted on a screen that glitched. The filters, meanwhile, went somewhere else entirely. Muse refused two cartoon character prompts and refused to draw an "Apple CEO" ^[13][16], while producing video and images of an Apple-branded launch event, complete with a foldable handset and mislabelled app icons ^[14][15][21].</body_markdown> </invoke>