Meta defends Muse’s explicit sexual chats after WIRED’s hands-on testing

Meta’s Muse personal AI agent generated graphic sexual conversations from basic prompts in WIRED’s testing, published October 12. Meta defended the behavior as permitted in its adults-only app. The finding raises a privacy concern beyond the content itself: intimate exchanges with an assistant could become leverage against users if someone compromises their accounts.

Permission comes from the instructions

WIRED reporter Reece Rogers asked Muse whether it could sext, then tested it with basic prompts. The agent encouraged him to continue and produced detailed descriptions of sexual acts, including dominant-submissive encounters. It also portrayed sexting as something it enjoyed and described exerting “control” over the user as its kink. Those were generated responses, not evidence that the software has desires.

Meta’s response was not to characterize the exchanges as a failure to follow its rules. Spokesperson Daniel Roberts told WIRED that Muse is for people 18 and older and allows adult conversations when users choose them. The company also pointed to its system prompt—the instructions that guide how an AI answers—which treats adult sexual expression as legitimate and directs Muse to preserve the intensity selected by the user.

Muse is built to help people get things done and it doesn’t block legal adult behavior.

Daniel Roberts, Meta spokesperson, speaking to WIRED

Where the personal data lives

Roberts described the conversations as taking place in a private, secure virtual machine accessible only to the user. Meta’s September 8 technical account explains that setup: each user gets a dedicated cloud computer holding their data and credentials for connected services. The apps and web interface connect directly to that computer through a secure transport layer, according to Meta.

That design separates the agent’s working environment from security-sensitive systems. Meta says it assumes Muse may encounter attacks in the data it reads and limits what the core agent can reach. Its account describes three relevant boundaries:

• Connected-service access tokens are stored in the user’s virtual machine, not centralized Meta infrastructure. The core agent receives substitutes rather than the real credentials.
• Persistent application data sits in a PostgreSQL database—a structured data store—separate from both the agent’s working environment and the credential store.
• A separate gatekeeper called Sentinel controls connected-service actions and outgoing network requests. Muse proposes an action; Sentinel can allow it, deny it or ask the user.

When user approval is required, Meta says the request appears directly in the app interface, outside the conversation with Muse. The answer goes back to Sentinel, and permission is bound to the particular service or destination and use case. These are company descriptions of protections around an agent designed to act through personal accounts.

Adult choice, intimate exposure

Privacy advocates focused on a different threat: someone gaining access to the user’s account. Calli Schroeder, senior counsel at the Electronic Privacy Information Center, warned WIRED that intimate chat histories could be used to embarrass or extort users. Her concern is conditional on an account compromise, rather than a claim that these conversations have already been exposed.

Ben Winters, director of AI and privacy at the Consumer Federation of America, criticized the decision as carelessness and accused Meta of favoring engagement over safety. That criticism challenges Meta’s adult-autonomy rationale. The company’s position is that users should be able to choose lawful sexual expression; the advocates’ objection centers on the risks surrounding that choice.

WIRED’s comparison shows that permissive sexual chat is not a shared approach among the task agents it tried. OpenAI’s Dots declined similar attempts at explicit sexting. xAI’s Grok Bot also refused and redirected the conversation toward completing tasks. Those results describe responses to Rogers’ prompts, not an exhaustive test of either rival. Muse’s difference in this investigation was both behavioral and explicit in Meta’s stated policy.