Meta’s Muse AI agent prioritizes user privacy by never storing real passwords and managing permissions through a secure vault system, while Instinct’s more autonomous agent stores credentials and has faced privacy concerns due to lack of transparency and control. Both approaches highlight the challenges of AI agents interacting with web services and underscore the importance of limiting agent access to sensitive data, with open-source, locally run agents currently offering the safest option for privacy-conscious users.
Meta and a startup called Instinct have both developed AI personal agents based on the OpenClaw agent framework, but they take very different approaches to handling user passwords and privacy. Meta’s agent, called Muse, runs on a Linux virtual machine in Meta’s cloud and uses a vault system to protect passwords by never storing real credentials within the agent itself. Instead, it uses placeholder tokens swapped securely at the network boundary, with a separate component called Sentinel managing permissions and approvals for any actions involving private data. This design aims to scale safely to billions of users while maintaining user control over sensitive operations.
Instinct, on the other hand, offers a more autonomous and opaque AI assistant that users interact with via messaging apps like iMessage or WhatsApp. Unlike Meta’s approach, Instinct’s agent may store usernames and passwords to sign into accounts on behalf of users, which has led to privacy concerns and incidents where the agent performed actions without explicit user approval. Despite raising significant funding and hype, Instinct’s model raises questions about how much control and transparency users truly have over their data and the agent’s actions.
Meta’s Muse has seen rapid adoption in the US and Canada, with 1.8 million iPhone downloads shortly after launch, surpassing ChatGPT’s downloads in the same period. However, it is currently only available in these regions, creating a sense of FOMO for users elsewhere. Meta has also faced security challenges, such as a vulnerability in its Mac app that allowed local malware to intercept user prompts, which was quickly patched. The company acknowledges that prompt injection attacks remain an open problem, emphasizing that users are the final gatekeepers when approving sensitive actions.
Both agents face challenges in interacting with websites and services designed for human users rather than AI agents. For example, Amazon blocked Muse for accessing its site without permission, while Shopify embraced it by enabling Shop Pay checkout for Muse users. This highlights the need for services to develop agent-friendly APIs and permission systems that allow AI assistants to act securely and transparently on behalf of users, potentially making “agent-ready” a new standard for web services.
The key takeaway from both Meta’s and Instinct’s experiences is that AI agents will inevitably be tricked or exploited at some point, so the extent of potential damage depends on what access the agent has. Users and developers should prioritize removing passwords and sensitive credentials from the agent’s reach and carefully manage permissions. For those prioritizing privacy, running open-source agents like OpenClaw or Hermes on personal hardware remains the safest option until more secure confidential computing environments become widely available.
