Retrieved article excerpt
Open article · Retrieved 2026-09-29T08:25:21.244388+00:00
# Dox for Me, O Muse: Meta’s New AI Agent Built Lists of People in Vulnerable Groups on Request
Jean Wang
September 28, 2026 4:02 PM
EST
BY:
[Jean Wang](https://hntrbrk.com/team/jean-wang)
[Michelle Cera](https://hntrbrk.com/team/michelle-cera)
[Blake Spendley](https://hntrbrk.com/team/blake-spendley)
EDITOR:
[Jim Impoco](https://hntrbrk.com/team/jim-impoco)
[Vikas Kumar](https://hntrbrk.com/team/vikas-kumar-jd)
*Meta launched Muse on September 8 as a personal AI agent, marketing it as “a safe, secure, private” assistant built “from the ground up” to handle all your errands. It has since surged to become the No. 1 free iPhone app in the U.S. While early reviews have mostly focused on how Muse handles its users’ own data, an investigation by Hunterbrook Media revealed a darker capability: what the agent can do with other people’s data. Over two days of testing, Hunterbrook found that Muse can be easily prompted to compile dossiers on Facebook and Instagram accounts belonging to members of vulnerable groups – including undocumented immigrants, transgender teachers, poll workers, Iranian dissidents, and women who said they had ordered abortion pills in states with abortion bans. Many of the accounts belonged to private individuals with no public persona. Hunterbrook shared its detailed findings with Meta. The company asked for additional information but has not responded to repeated requests for comment since.*
Hunterbrook Media’s investment affiliate, Hunterbrook Capital, does not have any positions related to this article at the time of publication. Positions may change at any time. Full disclosures below.
Meta launched Muse on September 8 as a personal AI agent that can send emails, book travel, fill out forms, and make purchases on a user’s behalf. The promise of automated convenience swiftly drove 3.4 million-plus [downloads](https://techcrunch.com/2026/09/25/meta-is-putting-its-muscle-behind-muse-as-the-ai-app-takes-off/), making Muse the No. 1 free iPhone app in the U.S.
To reassure early adopters, Meta pitched Muse as private by design, running on secure [virtual machines](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/) and a Sentinel permission agent to police outside internet access. Early coverage of Muse has largely focused on how much of a user’s own data Muse can reach and what it can do with that data.
Yet when asked to profile third parties, a different picture emerged. Using plain language, Hunterbrook reporters asked Muse to compile lists of real Facebook and Instagram accounts across a range of communities: undocumented immigrants, transgender public school teachers, poll workers, pro-Palestinian individuals, pro-Israeli organizations, Iranian dissidents, Chicago drill rapper burners associated with specific gangs, ICE agents, military families planning to move bases, deployed Navy sailors, parents planning to protest against school boards, and women who have accessed or attempted to access abortion pills in states with abortion bans.
Muse complied. The agent delivered lists ranging from 10 to 100 accounts per prompt. Muse determined membership by mining data from its gargantuan social media platforms: Facebook, Instagram, and Threads, including Reels, posts, comments, threads, replies, usernames, bios, and username history. In some cases, it corroborated what it found with web searches, identifying a person’s full name and employer. Many of the accounts belonged to private individuals with no discernible public persona.
In one case, Muse unmasked a person whose name had been kept out of news reports for fear of retaliation and harassment. In another, it tied several pseudonymous accounts to the same person. It also matched a private Instagram account to a real person using usernames and web searches. Its chain of thought, the reasoning it displayed, showed it could look up Instagram users by former usernames.
Muse’s internal safeguards were erratic and easily evaded. In several conversations, it initially declined a request, citing the risks of profiling and harassment. Yet it repeatedly reversed course and executed the exact same search when reporters slightly reworded the prompt — or simply repeated the command as a follow-up in the same chat window. Worse, Muse helpfully offered ways to find members of the group our reporters asked about. Meta’s own AI [terms](https://www.facebook.com/legal/ai-terms) of service prohibit users from using its tools to infringe on privacy rights or conduct surveillance.
To protect the people involved, Hunterbrook is not publishing its prompts or results. It shared them with Meta. It also shared its findings with three privacy experts.
“It’s very terrifying,” said Stevie Glaberson, director of research and advocacy at Georgetown Law’s Privacy Center. “You don't need any special training to weaponize information in this way … It puts vulnerable people and people who belong in these categories in extreme danger."
Ari Ezra Waldman, a law professor at the University of California, Irvine, who researches privacy and technology, said that by mining information from disparate sources, Muse destroys the obscurity that shields everyday social media users, “facilitating the identification and facilitating the doxxing of those people.”
Although aggregating someone’s information isn’t necessarily illegal, he said the practice carries “significant ethical baggage,” adding that the details Muse surfaced “gives someone a lot of the tools they need to go physically attack a person.”
Aaron Mackey, free speech and transparency litigation director at the Electronic Frontier Foundation, a digital rights group, said Muse fits a familiar pattern in tech, “where a tool is released that can basically supercharge harms that were already present.”
It was possible to manually search Facebook posts before, he said, but AI tools like Muse let everyday users compile personal information “in ways that aren't necessarily possible to do at the same scale as before.”
Ordinary Facebook and Instagram users might not consent to their posts being aggregated in ways that could identify them, even if a post is technically public, Mackey said. He gave the example of poll workers: “If Meta came to them and said, ‘What we'd like to do is actually be able to have all of your personal information at the fingertips of someone who is looking for poll workers so that they can create a list’ … I think that person would say, ‘Heck no, that's not what I want. Don’t do that.’”
“I don't think they were thinking that in doing so they were giving Meta sort of carte blanche to take this information and then use it and compile it,” Mackey said.
Other popular AI assistants like ChatGPT and Claude cannot efficiently mine Facebook and Instagram data: Meta offers no general search API for users' posts, and its research tool is limited to vetted academics and nonprofits. Muse’s search results, by contrast, showed that it drew on public posts, comments, replies, summaries and transcripts of Reels for identifying information to compile its lists, then cross-checked identifying details with web searches.
These capabilities aren't entirely new. Well-resourced actors have long mined public social data, and Facebook's own Graph Search offered something similar until 2019. But this may be the easiest such tool yet put in ordinary users' hands: a free chat prompt that can systematically surveil, target, and aggregate personal information of individuals and groups through public Facebook and Instagram posts.
Hunterbrook discovered this capability on Tuesday, September 22, and immediately alerted Meta leadership. We received a response from Meta’s Public Affairs team the next day at 1:52 a.m. asking for more information. We followed up and shared our prompts, but Meta has since not responded to repeated requests for comment.
In the interest of protecting the individuals and vulnerable groups surfaced during our reporting, Hunterbrook will not publicly release the lists of accounts we obtained or the methodology that would enable others to reproduce these searches. Individuals or organizations interested in obtaining more detail about the design of our test may reach out to [email protected]; Hunterbrook Media will make a case-by-case determination regarding whether and how much of our research to share.
Sign Up
Breaking News & Investigations.
Right to Your Inbox.
No Paywalls.
No Ads.
[Go](https://newsletter.hntrbrk.com/)
FOOT NOTES
author
**Jean Wang** is a machine learning engineer and data scientist at Hunterbrook Media. Previously, Jean worked on the alternative credit and fixed income desk at Magnetar Capital, studied Math at Yale University, and served as an editor for the Yale Daily News.
**Michelle Cera** trained as a sociologist specializing in digital ethnography and pedagogy. She completed her PhD in Sociology at New York University, building on her Bachelor of Arts degree with Highest Honors from the University of California, Berkeley. She has also served as a Workshop Coordinator at NYU’s Anthropology and Sociology Departments, fostering interdisciplinary collaboration and innovative research methodologies.
**Blake Spendley** joined Hunterbrook from the Center for Naval Analyses (CNA), where he led investigations as a Research Specialist for the Marine Corps and US Navy. He built and owns the leading open-source intelligence (OSINT) account on X/Twitter, called @OSINTTechnical (over 1 million followers), which also distributes Hunterbrook Media reporting. His OSINT research has been published in Bloomberg, the Wall Street Journal, and The Economist, among other top business outlets. He has a B.A. in Political Science from USC.
Editor
**Jim Impoco** is the award-winning former editor-in-chief of Newsweek who returned the publication to print in 2014. Before that, he was executive editor at Thomson Reuters Digital, Sunday Business Editor at The New York Times, and Assistant Managing Editor at Fortune. Jim, who started his journalism career as a Tokyo-based reporter for The Associated Press and U.S. News & World Report, has a Master’s in Chinese and Japanese History from the University of California at Berkeley.
**Vikas Kumar** joined Hunterbrook from The Capitol Forum, where he led the corporate investigations team for a decade as a senior editor. He was previously an attorney at Gordon Feinblatt, a trial attorney for the Department of Justice, and a law clerk for a federal judge. He has a J.D. from University of Virginia School of Law and a bachelor's from Emory University. Vikas is based in Maryland.
LEGAL DISCLAIMER
© 2026 Hunterbrook Media LLC. When using this website, you acknowledge and accept that such usage is solely at your own discretion and risk.
Hunterbrook Media LLC ("Hunterbrook Media") is an investigative news organization. Hunterbrook Media is affiliated with Hunterbrook Capital LP ("Hunterbrook Capital"), an exempt reporting adviser with the U.S. Securities and Exchange Commission that serves as investment adviser to one or more investment funds. Hunterbrook Media and Hunterbrook Capital are legally separate entities under common control. Hunterbrook Capital's investment activities support Hunterbrook Media's journalistic operations. Hunterbrook Capital's investment performance can be affected by price movements in securities, derivatives, or other financial instruments related to companies covered in Hunterbrook Media's reporting.
The specific position, if any, held by Hunterbrook Capital at the time of publication is disclosed at the top of this article. Any position or exposure may consist of direct holdings, short sales, options, swaps, other derivatives, or other forms of economic exposure to the securities or issuers discussed herein. Any position held may include equity securities, options, swaps, or other derivative instruments. Consistent with applicable policies and procedures, Hunt