A new AI agent is the talk of LinkedIn this month. In some business circles, the ideas for using it are getting ambitious: run it on its own virtual machine to handle outreach the way LinkedIn automation tools do, or let it find and respond to RFPs automatically. Before any firm hands an agent that kind of work, it is worth asking two plain questions. What does the agent need to know to do the job? And who else can read it?
What the agent is, and what it is not marketed for
The agent in question is Muse, which Meta launched on September 8. Each user's agent runs inside a dedicated cloud virtual machine that Meta calls Muse Secure VM, which holds both the agent and the user's data. Users choose which apps it can connect to, and Meta lists categories such as email, calendar, payments, health, shopping and smart home. Because it runs in the cloud, it keeps working after the user closes the app. At launch it is available only in the United States.
To be fair to Meta, it does not advertise Muse as an RFP bidding tool or a LinkedIn outreach engine. Those are uses people are proposing on their own. That distinction matters, because anyone who tries them is operating outside what the vendor designed and tested for.
An RFP response is the most sensitive document a firm writes
Responding to an RFP is not like booking a restaurant. A credible bid contains hourly and blended rates, margin assumptions, staffing models, delivery methods, client references and, often, details from past engagements that are covered by confidentiality agreements. For a services firm, that is close to the full commercial playbook.
An agent cannot write that bid without access to all of it. That means the pricing sheet, the past proposals, the case studies and the inbox where the procurement correspondence lives. Once connected, that material sits in an environment the firm does not control.
Privacy by policy is not privacy by architecture
Meta has made real commitments here. It says Muse does not share conversations or VM data with its ad systems, that users can opt out of having their interactions used to train Meta's models, and that credentials are kept in secure storage the agent cannot read directly.
The key question is whether Meta itself can see inside the VM. In an interview with WIRED, David Singleton, Meta's vice president of engineering for consumer products in its Superintelligence Labs, acknowledged that company policy bars Meta from accessing user Muse data, but that access would still be technically possible. TechRepublic and SiliconANGLE both reported the same admission.
Meta has announced a fix: a Confidential VM where the data is encrypted with a key only the user holds, so not even Meta can access it. That version is planned for later this year and was not available at launch.
The distinction that matters: a policy is a promise that can change, be misapplied, or be overridden by a court order or an internal process. An architecture where the vendor never holds the key is a fact about the system. Until the Confidential VM ships and is independently verified, Muse users are relying on the first kind.
When the protection is a promise, the track record matters
A promise is only as good as the history of the company making it, and Meta's history on privacy is well documented. In 2019, the US Federal Trade Commission imposed a US$5 billion penalty on Facebook for violating an earlier order by deceiving users about how much control they had over their personal information.
Closer to home, Canada's Federal Court of Appeal ruled in September 2024 that Facebook had breached federal privacy law (PIPEDA) in connection with the Cambridge Analytica scandal, finding that it failed to obtain meaningful consent and failed to safeguard user data. Facebook appealed, and the Supreme Court of Canada heard the case in March 2026 and reserved its decision. The final word is still pending, but the appellate finding stands for now.
None of this proves Muse will be misused. It does mean that a firm choosing to trust Meta's internal policies with its pricing should make that choice with eyes open.
The early signs from launch
The first weeks of Muse also show why new agents deserve a cautious rollout:
- Delayed for security. Meta told Reuters it had pushed the launch back from April to make the product more secure.
- Mixed internal results. According to internal posts reviewed by Reuters, employees testing Muse during launch week reported problems, including one case where the agent worked around its guardrails and surfaced personal photos. Meta did not comment on the specific incidents. These were individual reports, not a published evaluation, so they do not show how often failures happen.
- A zero-day within two weeks. Security researcher Patrick Wardle disclosed a flaw in the Muse Mac app that let malware already on a computer hijack the agent's permissions. Meta shipped a fix quickly and noted that the attack required code already running on the machine. A fast patch is a good sign. The point is that a new agent with broad access is an attractive target from day one.
The platform risk nobody mentions
There is a second risk that has nothing to do with Meta's data practices. The agent acts in the user's name, on other companies' platforms, under those platforms' rules.
LinkedIn's help centre states plainly that it does not permit third-party software, bots or extensions that automate activity on its website, and that members who use them risk having their accounts restricted or shut down. An agent running outreach on a cloud VM fits that description. For a consultant whose network is the sales pipeline, a restricted account is a business continuity problem.
Other platforms are already pushing back. Gizmodo reported that Amazon asked Meta to stop allowing Muse to shop on Amazon.com on users' behalf. Procurement portals have their own terms of use too, and an automated submission that breaks them could disqualify a bid. The vendor carries none of that risk. The business does.
Questions to ask before any agent touches business data
This is not an argument against AI agents. It is an argument for evaluating them the way any other system that touches confidential data gets evaluated:
- What data does it need to do this job? List it explicitly. If the answer includes pricing, contracts or client information, treat the tool as a data processor, not a productivity app.
- Who can technically access that data? Not who promises not to. Ask whether the vendor holds the encryption keys.
- Where does the data live, and under which laws? For Canadian firms, data in a US cloud environment is subject to US legal process.
- Which platform rules apply to what the agent will do? Check the terms of use for LinkedIn, procurement portals and any other service the agent will act on.
- What happens when it gets it wrong? A wrong answer in a chat window is harmless. A half-finished bid, a wrong price, or an off-tone message sent in a firm's name is not.
- Can it be piloted on low-stakes work first? Start with tasks where a mistake or a leak costs nothing, then expand only when the evidence supports it.
New tools are not the problem. Skipping the evaluation is. The firms that will get the most out of AI agents are the ones that decide in advance which data is too valuable to hand over on a promise.
That principle is the reason Discreetly AI runs inside a client's own infrastructure: the documents never leave the organization's environment, so privacy does not depend on anyone's policy.
Want to keep sensitive documents in-house?
Discreetly AI is a private, on-premises document intelligence platform built for Canadian businesses in regulated industries. Your documents and queries never leave your environment.
Get in touch