Meta Muse OpenAI Dots privacy claims do not yet justify broad access to inboxes, credentials, customer accounts or shopping flows, because both products still depend on permission prompts, cloud computers and controls that users cannot fully inspect. Meta announced Muse on Sept. 1, 2026; OpenAI announced Dots on Oct. 1, 2026; The Verge reported on Oct. 10 that both companies are now selling privacy as the reason to choose one agent over another.
Meta moved consumer AI agents into the Muse app and WhatsApp, where the agent can keep working after the user closes the app and return for approval before sending an email or making a purchase, according to Meta's announcement. OpenAI moved the same class of product into ChatGPT, Slack and Teams with Dots, according to OpenAI's announcement, and Wired reported on Oct. 7 that OpenAI's product was behind a $100-a-month subscription at launch. According to The Verge, OpenAI CEO Sam Altman said the company wants to "set a new standard for privacy in frontier AI," while Meta CEO Mark Zuckerberg said Muse was "built from the ground up for privacy and security."
How Meta Muse OpenAI Dots privacy works
Meta and OpenAI both isolate their agents on cloud computers, then use product-specific controls to decide what the agent can read, store, send and do. Meta calls its environment Muse Secure VM, while OpenAI says each dot works on its own cloud computer and the user's computer stays separate unless the user connects it. The privacy case from both companies depends less on the word agent and more on who controls credentials, memory, app access and outbound actions.
Meta Muse stores connected-service data and credentials in a dedicated cloud VM, while OpenAI Dots runs each dot on its own cloud computer. In both designs, the agent works away from the user's device, but the company still defines which data can leave the cloud environment for inference, telemetry, app access and approvals.
Meta AI Research says each Muse VM is an isolated Linux box with a browser, storage, CPU and memory for code compilation, custom skills, concurrent sub-agents and cron jobs. Meta says the VM is the "system of record" for everything the user puts in Muse, but the same research post says Muse sends limited data out of the VM when needed for inference and telemetry. Meta also says the core agent and workspace run in a systemd-nspawn runtime container, while credential storage, Sentinel, and inference and telemetry proxies run outside that runtime cell. Sentinel is a separate agent on the same machine that Meta says must approve anything Muse sends to the internet.
OpenAI describes Dots differently. OpenAI says proactive research uses connected apps with read-only tools that cannot send messages, change app content or control the user's browser or computer. OpenAI says users can manage app access through existing ChatGPT app controls, set Custom Rules and review background work in Activity View. The OpenAI Help Center says a dot can retain context from conversations and plugins for as long as the user keeps the dot, but the context does not retain credentials, images or screenshots.
Where the promises still break
The weak points are company access, external attack risk, agent mistakes and memory control. The Verge reported on Oct. 10 that Muse data is isolated from other users, but Meta itself can still access the data, and Meta plans a later method to cryptographically and verifiably prevent Meta from accessing data in a user's VM. The Verge also reported that a security researcher exposed a zero-day vulnerability that could allow someone to take control of Muse, and that the issue has since been patched. For OpenAI, the Help Center says users currently cannot view, delete or directly modify individual dot memories, including details that enter context from plugins.
The evidence is thinner on several user-level incidents. In r/BetterOffline on Oct. 10, commenters pointed to claims that Muse exposed filesystem details, that an agent built a social graph from connected personal data, and that a Facebook Marketplace task shared a home address, but those comments are practitioner signal rather than verified reporting. Wired's Oct. 7 hands-on test of Dots gives a firmer example of early product limits: Reece Rogers wrote that the agent got his name wrong, mistranscribed speech and offered to solve captchas it could not complete. Those reports do not establish failure rates for Muse or Dots.
What site teams should check
Site teams should treat consumer agents as a new class of automated user until Meta and OpenAI publish more operational detail. Social Media Today reported on Oct. 7 that websites are already blocking AI agents because operators worry about vulnerability probing, load spikes and attempts to bypass normal limits. The same report said Meta is developing a protocol with Sierra and partners across retail, payments and customer experience so business websites can better understand and control how Muse agents interact with them.
| Area | Specific check | Reason |
|---|---|---|
| Server logs and WAF | Track requests per minute on product search, checkout and account pages. | Social Media Today gave the example of an AI agent refreshing a site 500 times per minute for a product listing. |
| Commerce flows | Review add-to-cart, payment and cancellation events from sessions that do not match normal human timing. | Muse and Dots are built to complete online tasks through cloud browsers or connected apps. |
| ChatGPT workspaces | Audit app access, Custom Rules and Activity View for Dots. | OpenAI names those controls as the current places where users manage access and background work. |
| Personal ChatGPT plans | Check the Improve the model for everyone setting. | OpenAI says that setting controls whether Dots conversations and work may be used to improve models on personal plans. |
For business teams, the immediate policy decision is where agents are allowed to operate before the vendor protocols mature. ChatGPT Business, Enterprise and Edu workspace data is not used to train models by default, according to OpenAI, but that does not answer whether a user should connect Gmail, Slack, Teams, payment tools or customer systems to an autonomous dot. Meta lists muse-security@meta.com for security and privacy experts seeking early access, and Meta AI Research says it is taking auditor feedback for a continuous audit that will be visible and inspectable by anyone.
What changes for search and commerce
The search and commerce effect is an inference from how these agents work, not a measured traffic result. Muse and Dots move some discovery, comparison and transaction work from a human browser session into an agent-controlled cloud computer or a connected-app workflow. If that pattern grows, marketers may see fewer clean user journeys from search result to landing page to checkout, because the visible session could be the agent rather than the person who gave the instruction.
For search and commerce teams, the practical change is attribution. A future buyer may ask Muse or Dots to compare products, contact sellers or buy through a cloud browser. Analytics may record an agent session rather than the person who requested it, so source, consent and conversion data need separate review.
The evidence does not show how Muse or Dots choose citations in AI answers, and it does not show whether either product will prefer structured data, merchant feeds or ordinary page text. The safer inference is narrower: pages, policies and product information that only work after heavy client-side interaction or human-only flows may be harder for an agent to use correctly. OpenAI also says it offers specialist Dots for marketing, legal work and accounting, according to The Verge's Oct. 8 Decoder episode description, so agencies should expect clients to test these tools inside campaign planning and reporting workflows before governance catches up.
What happens next for agents
The next dated checkpoint is later in 2026, when Meta says it plans a way to cryptographically and verifiably prevent Meta from accessing data in a Muse VM. OpenAI says texting Dots is coming soon, but the OpenAI Help Center does not give a date for individual memory viewing, deletion or direct editing. Meta is also still designing its agentic commerce protocol with Sierra and partners, according to Social Media Today. The trigger to watch is the first public version of Meta's protocol or audit, because that will show whether website operators get enforceable controls rather than another privacy promise.