Meta’s Muse AI agent: a hilarious security disaster

0:04Hi, I'm David Gerard and this is Pivot to AI coming to you Monday to Friday. Today, Facebook's agentic privacy and security disaster. Earlier this month, Meta released Muse, its new AI agent as a service. You can download the app front end free. At first, it's very popular. What you get is an agent running on your own small virtual computer at Meta. It's like having an open claw agent, but

0:39Facebook sets it all up for you. Muse does everything. It'll go through your email. It'll book appointments. It'll even make phone calls for you using AGI, a guy instead calls are made by humans in a call center. The trouble with sending real-world tasks to a chatbot is that hallucinations are how a chatbot works. So, an agent will routinely do completely wrong

1:09things that you don't want. That's tolerable when it's open claw users because every open claw user is a completely fried AI gambling addict. With Muse, ordinary people get to share this particular joy. Quote, "So, Muse handled my Facebook Marketplace today. Just found out it told people my address and agreed a lowball price, and then they showed up without it even telling me until late

1:39tonight that it messed up." Unquote. That is, Muse will happily give out your home address to strangers without checking with you. No doubt Meta will put in a prompt about that. The Muse chatbot is also an insufferable sycophant. You're absolutely right. Wow. But some people love Muse. Eli Tan New York Times was blown away by Muse. He was particularly impressed how it helped him cancel forgotten subscriptions. He was very big on that

2:15one. You can dump a copy of the entire Muse virtual machine for yourself. Just prompt it. Meta says this is actually intentional. The estimable Johnny from NeuroMatch has, of course, gone digging. Every task that our New York Times guy was amazed by is hardcoded. The subscription thing is the first one in the Muse task list. Muse has a self-improvement prompt that builds a dossier on all your friends and

2:51every Facebook group you're in. Quote. Muse is instructed to read unmetered gathered deliberately from primary sources when doing its hourly social graph surveillance. Muse itself confirms this draws from any connected account including Gmail threads, Messenger conversations, Instagram profiles, Facebook timelines. The skills confirm all these are near at hand. Unquote. I'm sure Meta's delighted to get all

3:27that data complete with social graphs. But Muse uses it mostly so it can help you go shopping, the highest human activity. Muse has a hidden feature to forward requests to Anthropic instead of using Meta's own Spark chatbot. This looks very like a way for Meta to train Spark on Claude's responses. Johnny says about the Muse code base, "Quote, that is 100% Claude authored, by

4:01the way. Unmistakable. Unquote." You have a Muse Linux box and you can read the whole thing and mess with it. So, Johnny set up his Muse to run a BitTorrent client. And you can even use Muse as a Monero crypto miner, which is the standard parasitical use case whenever anyone gives out free virtual machines.

4:28All of this on Meta's bill. Johnny explains where systems like this end up. "Quote, so here you are provisioning a persistent permissive computing environment run by something with an infinitely large attack surface for your customer base that consists of 99.9% of people who have never paid you a dime, so pretty much for free. Congratulations. The only form that this kind of product can take is a botnet

4:59factory. Unquote." Meta's got a gadget coming for Muse as well in December, the Muse charm. You wear around your neck as a surveillance device for your friends, so Meta says AI can train on your remaining friends. The one good point about Muse is that it's messing up venture capital funding for crappy little AI agent startups. Meta's moat is that it can just blow unlimited money on its botnet as a service and you cannot. Sorry, lads. It was

5:34always going to be just the big boys. Thanks for tuning in to Pirate AI. This Friday, we have an interview with Kat Jones from Action to Protect Rural Scotland, who are quite successfully fighting data centers here. But what I would say, my main thing is it's so important to get your head around the planning process and really help local communities with that really detailed advice on how to oppose

6:04things at the coalface. The rough cut should be up tomorrow for supporters. You can become a supporter and keep pivot to AI coming out daily by sending your $5 to the Patreon link in the show notes. Or if you prefer YouTube, just click the join button below the video. Wednesday is the supporter name read. If you want to be in that, then comment on the Patreon post or YouTube supporters can email me

6:35directly. Thank you all. I could not do this without you. I'll see you tomorrow and bye for now.

6:54[music]