The Human Behind the Machine: Meta’s Muse AI Raises a Bigger Question About Who Is Really Using Your Data
Meta is selling a vision of the future in which artificial intelligence does not merely answer questions—it acts on your behalf.
Its new personal AI agent, Muse, can send emails, shop online, book travel, browse websites and make phone calls to businesses. Meta describes it as a personal agent designed to take work off people's hands and operate with a degree of autonomy.
But a Reuters investigation has exposed an uncomfortable complication.
Behind at least some of Muse's supposedly autonomous phone calls, there have been humans.
Meta has been testing what it called a “human concierge” in which contractors can take over calls initiated through Muse. Internal company posts reviewed by Reuters showed that the feature was enabled for about half of Meta's employees during testing. Employees could opt out, but some raised concerns that sensitive information could unintentionally reach contractors handling the calls.
The story is bigger than Meta.
It goes to the heart of the emerging agentic-AI economy:
When an AI agent acts on your behalf, who is actually acting—and who gets to see what the AI knows about you?
Muse was supposed to eliminate the middleman
The promise of an AI agent is fundamentally different from the promise of a chatbot.
A chatbot waits for instructions and produces an answer.
An agent is supposed to take the instruction and execute it.
Meta's own description of Muse makes that distinction explicit. The company says users can give Muse a goal and allow it to develop a plan, browse the web, fill out forms, send emails, shop and even negotiate on their behalf.
The phone-calling feature takes that idea into the physical world.
A user could ask Muse to call a salon to arrange an appointment, contact a business to check whether an item is in stock, or call contractors to obtain quotes. Afterward, Muse can provide the user with a summary and transcript of the interaction.
That is an important technological step.
The AI is no longer merely generating language.
It is representing the user to another human being.
And that makes the identity of the person—or system—on the other end of the interaction extremely important.
Then Meta introduced the “human concierge”
According to internal posts reviewed by Reuters, Meta told employees that Muse could hand certain requests to a trained human agent who would place and handle the call.
The experiment was reportedly activated for approximately half of Meta's employees. Employees who did not want to participate could opt out.
The rationale appears straightforward.
AI calling does not always work.
Businesses may hang up when they realize they are talking to an AI. Some conversations are also more complicated than the model can reliably handle.
Human operators can therefore act as a fallback.
And according to an internal Meta executive cited in the reporting, tests suggested that human callers could push call success rates as high as 95%–98%, compared with lower success rates for AI-only calling.
From an engineering perspective, that makes sense.
From a privacy perspective, it creates an entirely different problem.
The privacy boundary just moved
Imagine telling Muse:
“Call this company and negotiate a lower price for me.”
You might reasonably assume that your interaction is between you and an AI system.
But if a human contractor receives the request and makes the call, the information chain becomes:
You → Muse → Meta's systems → human contractor → business.
That is an entirely different privacy architecture.
The contractor may potentially encounter information contained in the user's request or information needed to complete the task.
That could include names, phone numbers, addresses, appointments, purchasing intentions, travel plans or other personal details.
And this is precisely what concerned some Meta employees.
Internal posts showed employees warning that sensitive information could potentially be shared with call-center contractors without users expecting that to happen.
The problem therefore isn't simply:
“Meta used humans.”
The deeper issue is:
Did users understand when a human entered the loop?
Meta itself acknowledged a disclosure problem
This is perhaps the most revealing part of the story.
According to Reuters reporting carried by iTnews, a Meta vice president acknowledged internally that it had been a mistake to begin testing contractor-placed calls without proper disclosures and said the company had rolled the feature back for the time being.
Meta subsequently told Reuters that the testing was intended to gather feedback, improve the feature and develop appropriate privacy and security protections before any broader release.
The company said it would only roll out the capability when it was ready and with appropriate disclosures.
That distinction matters.
The reporting concerns an internal test, not evidence that every public Muse phone call was secretly handled by humans.
But the experiment exposes a fundamental problem that every AI-agent company will eventually have to confront:
What exactly does “autonomous” mean?
The economics of artificial intelligence may still contain a lot of human labor
There is a fascinating irony here.
The AI industry has spent years promising automation.
The narrative is familiar:
AI will eliminate repetitive tasks.
AI will reduce the need for human operators.
AI agents will work around the clock.
AI will become your digital employee.
But Muse's human-concierge experiment demonstrates another possibility:
AI may create new layers of invisible human labor.
The customer sees an AI.
Behind the AI could be a human reviewer.
Behind the agent could be a human operator.
Behind an automated decision could be a human escalation team.
Behind a supposedly autonomous system could be an army of contractors handling edge cases.
This is not necessarily deceptive or inherently bad.
Human oversight can make AI systems safer.
The problem arises when the human layer is hidden from the person whose information is being processed.
Meta has already encountered this problem before
There is an interesting historical precedent.
Before Muse, Facebook experimented with a digital assistant called M.
The project was presented as an AI-powered assistant, but humans reportedly performed a substantial portion of the work behind the scenes.
The Muse experiment therefore isn't appearing from nowhere.
It reflects an old technological problem:
Machines can appear autonomous long before they are actually capable of operating autonomously at scale.
The difference today is that AI agents have far greater access to personal data and digital infrastructure.
Muse isn't simply answering a question.
Meta says it can work with email, calendars, browsers, third-party services, shopping systems and other connected tools.
That makes the consequences of a hidden human layer much more significant.
And Meta has been making very strong privacy promises
This is where the controversy becomes particularly interesting.
Meta has built Muse around a dedicated Secure Virtual Machine.
According to Meta, each user gets a dedicated computer in the cloud where Muse operates and where connected data and credentials are stored. Meta says Muse's access to the internet is controlled by a separate security agent called Sentinel, while sensitive credentials are stored separately.
Meta also says users control which applications Muse can access and can disconnect services.
The company says Muse does not share users' conversations or VM data with Meta's advertising systems. It also says users can opt out of having their interactions used to train Meta's AI models.
These are substantial architectural safeguards.
But they solve a different problem.
They help protect data inside the technical system.
They do not automatically answer the question:
What happens when a human is deliberately introduced into the workflow?
Security is not the same thing as privacy
This distinction is becoming increasingly important in the agentic-AI era.
Imagine a perfectly isolated AI computer.
It has encryption.
It has access controls.
It has monitoring.
It has a security agent.
Its credentials are protected.
Then the AI sends a task to a human contractor.
The technical infrastructure might still be extremely secure.
But the information has crossed a human boundary.
That is why future AI privacy policies will have to explain more than:
“Your data is encrypted.”
Users will increasingly need to know:
- Can humans access my agent's activity?
- When can they access it?
- What information can they see?
- Are contractors involved?
- Where are those contractors located?
- Are calls recorded?
- Are transcripts retained?
- Are contractors permitted to copy information?
- Is human intervention disclosed in real time?
- Can users opt out?
These questions will become particularly important as AI agents begin handling increasingly sensitive tasks.
Muse isn't just a chatbot. That's why this matters
Meta's own description of Muse makes clear how ambitious the product is.
The company describes it as a system capable of working in the background, coordinating tasks and using connected services.
That means users are being asked to grant an AI something approaching delegated authority.
And delegated authority requires trust.
If I tell an AI to draft an email, I'm giving it permission to generate words.
If I tell it to send the email, I'm giving it authority to communicate.
If I tell it to negotiate a contract, I'm giving it commercial authority.
If I tell it to call my bank, I'm giving it access to sensitive financial interactions.
If I tell it to book a medical appointment, I'm potentially exposing health-related information.
The more capable agents become, the more valuable they become.
But the more valuable they become, the more dangerous unexpected access can become.
The agentic-AI privacy problem is only beginning
Muse is arriving at exactly the moment when the industry is moving toward autonomous agents.
The central AI race is increasingly shifting from:
Who can generate the best answer?
to:
Who can build the best system for taking action?
That shift changes everything.
A hallucinated answer is one kind of problem.
An agent hallucinating while sending an email is another.
An agent making a wrong purchase is another.
An agent giving a malicious website access to sensitive credentials is another.
And an agent quietly handing a task to a human contractor introduces another category entirely.
The problem becomes one of delegation.
Who is accountable when the agent fails?
Suppose Muse calls a company.
The business misunderstands the request.
A contractor intervenes.
The contractor gives the wrong information.
The company makes a decision based on that information.
Who is responsible?
The user?
Meta?
The AI model?
The contractor?
The contractor's employer?
The business receiving the call?
This is why agentic AI is going to create a new class of legal and regulatory questions.
The traditional software model assumes that software is a tool.
Agentic systems increasingly behave like representatives.
That means questions of authorization, liability, identity and accountability become much more important.
There is another uncomfortable question: what does the AI actually know about you?
Meta says Muse can remember information about users and use it to make personalized suggestions. Its launch material describes examples such as remembering dietary restrictions and using information from previous interactions to assist with future tasks.
That personalization is precisely what makes an AI agent useful.
But it also creates a huge information reservoir.
An agent that knows:
where you travel,
what you buy,
who you communicate with,
what appointments you have,
what you are planning,
what products you want,
and what you have told it privately
could potentially know more about an individual than any single traditional application.
Now introduce human operators into that ecosystem.
The privacy question becomes considerably more serious.
This isn't uniquely a Meta problem
It would be easy to turn this into a story about one company.
That would miss the larger development.
Every major AI company building autonomous agents will encounter the same fundamental tension.
Agents need to operate in the real world.
The real world is messy.
Websites break.
APIs fail.
Businesses refuse automated calls.
People don't understand machine-generated speech.
AI models encounter situations they weren't trained for.
And when automation fails, someone has to intervene.
That someone may be another AI.
Or it may be a human.
The industry therefore needs to decide whether human-in-the-loop systems are a safety feature, a temporary development tool, or a hidden labor layer behind autonomous AI.
The African and Nigerian dimension
There is also a bigger issue for countries outside Silicon Valley.
African users increasingly consume AI products developed by American and Chinese companies.
As agents become capable of acting on behalf of users, these systems could eventually interact with:
- Nigerian banks;
- telecommunications companies;
- airlines;
- hospitals;
- government services;
- e-commerce platforms;
- universities;
- insurance companies.
The data generated through those interactions may cross borders.
The people operating the systems may be located in different countries.
The cloud infrastructure may exist somewhere else.
And the companies controlling the underlying AI may be headquartered thousands of kilometres away.
This makes digital sovereignty increasingly inseparable from AI adoption.
The question for countries like Nigeria isn't simply whether their citizens can access the latest AI.
It is:
Who ultimately has access to the information those AI systems collect while acting for them?
The future may need a new kind of AI disclosure
Imagine ordering a service through an AI agent.
Instead of simply saying:
“Muse is calling.”
The system could tell you:
AI-only call.
Or:
Human-assisted call.
Or:
A human may intervene if the AI cannot complete the task.
That kind of disclosure would fundamentally change the user's understanding of the transaction.
The same principle could apply to AI customer-service agents.
A user should know whether they are communicating with:
a human,
an AI,
or a hybrid system.
That distinction is becoming increasingly difficult to ignore.
The most important lesson from Muse
The biggest lesson from Meta's experiment isn't that AI has failed.
In fact, the experiment demonstrates something more interesting.
AI agents are already powerful enough to perform real-world tasks, but not yet reliable enough to handle every situation autonomously.
So companies are experimenting with hybrids.
AI does the work when it can.
Humans intervene when necessary.
That may actually be the model that dominates the next stage of AI development.
But if so, transparency becomes essential.
Because there is a huge difference between:
“AI did this for me.”
and
“AI initiated this, but a human contractor completed it.”
The technology may look identical from the user's screen.
The privacy implications are not.
The real AI revolution is not intelligence. It is access.
Muse represents something bigger than another AI assistant.
It represents the transition from AI that talks to AI that acts.
And once AI begins acting on our behalf, the central question changes.
It is no longer enough to ask:
How intelligent is the model?
We need to ask:
What can it access?
Who can access what it sees?
Who can intervene?
Who is accountable?
When does a human enter the loop?
And does the user know?
Meta's human-concierge experiment has not demonstrated that Muse is secretly operated by humans in general. The reporting concerns an internal test that Meta says was designed to improve the calling feature before any broader rollout, and Meta says appropriate disclosures would accompany a future release.
But the episode exposes a much larger truth about the AI industry:
The more autonomous AI becomes, the more important transparency about the humans behind the machine becomes.
The future of AI agents will therefore not be determined only by how intelligent they become.
It will also be determined by whether people can trust the boundaries around them.
And perhaps the most important question of all is the simplest:
Comments
Post a Comment