Meta Muse and Gemini Spark: What are personal AI agents and their risks

Personal AI agents from Meta, Google and others aim to handle tasks across apps, from emails to travel planning, but access to personal data raises privacy and security concerns

Personal AI agents are moving artificial intelligence beyond answering questions and generating content to performing tasks on behalf of users. From managing emails and organising travel to making purchases and coordinating activities across applications, these systems are designed to understand instructions, plan the steps involved, and execute them with limited human intervention.

 

Meta's Muse and Google's Gemini Spark are among the examples. OpenAI and Anthropic are also developing systems with similar capabilities. However, giving AI access to personal accounts, information and applications raises questions about privacy, security and how much control users should hand over to these systems.

What are personal AI agents

A personal AI agent is an AI-powered system that understands a user's objective, plans the steps needed to achieve it and uses connected applications or services to complete the task. It can also use personal information, such as preferences, schedules and previous instructions, to understand the user's requirements.

Unlike a conventional chatbot, which primarily generates responses within a conversation, an agent can interact with external services. It can access emails, search websites, update documents and perform tasks across applications. This also sets it apart from traditional voice assistants, which have generally relied on predefined commands and supported integrations.

 

While enterprise AI agents are designed for specific business functions, such as processing invoices or managing customer support, personal agents are intended to handle activities across an individual's digital life.

What can personal AI agents do

Personal AI agents can be used across several everyday activities, depending on their integrations and capabilities. From personal productivity tasks such as organising emails inbox to travel planning, shopping, and personal finance, personal AI agents are capable of handling multiple tasks from a single instruction.

 

For example, an agent asked to prepare for an upcoming business trip could check flight confirmation emails, identify gaps in the calendar, research transport options and prepare a schedule. The user would not have to move between each application to coordinate these tasks.

How are companies approaching personal AI agents

Meta Muse and Google Gemini Spark

Meta's personal AI agent, Muse, is powered by Muse Spark, the underlying AI model developed for agentic tasks. The agent is designed to work through a dedicated application and WhatsApp. It can use a browser, fill out forms, send emails and work towards longer-term goals.

 

Meta says Muse runs in a dedicated cloud environment called Muse Secure VM, with a separate Sentinel system controlling internet access and sensitive actions. Users can review its activities and change or revoke application permissions.

Google's Gemini Spark is designed to handle tasks in the background through Google's ecosystem, including Gmail, Drive, Docs, Sheets and Calendar. Users can assign tasks and set recurring schedules. For instance, it can collect travel booking details from emails and organise them in a Google Sheets itinerary.

 

Google says Spark can continue working through its cloud infrastructure even when the user's device is switched off. Users control its application access, while certain sensitive actions require approval.

Apple and Samsung

While Meta and Google are developing agents that can work across applications and handle tasks in the background, the like of Apple and Samsung are integrating agent-like capabilities into their device ecosystems

 

Apple's revamped Siri, powered by Apple Intelligence, is designed to understand personal context, recognise information displayed on the screen and carry out actions across applications.

 

Samsung is taking a similar approach through Galaxy AI and its upgraded Bixby assistant.

OpenAI, Anthropic and others

OpenAI and Anthropic are extending their AI assistants beyond conversations by giving them access to computers, files and external tools.

 

OpenAI's ChatGPT Work can use a cloud-based browser to navigate websites, fill forms and complete multi-step tasks across services. Its computer-use capabilities also allow it to interact with graphical interfaces.

 

Anthropic's Claude Cowork can work with files, folders and connected applications, helping users organise information, prepare documents and coordinate tasks. It also supports scheduled workflows.

 

Anthropic's Model Context Protocol (MCP) provides a standardised way for AI systems to connect with external tools and data sources. This allows developers to build integrations that can be used across different AI models and applications.

Security and privacy

Personal AI agents draws from personal context and worldly knowledge. Therefore, it may need access to emails, messages, contacts, documents, calendars and browsing activity to complete tasks. Bringing this information together raises questions about how it is stored, processed and protected. Users also need clarity on whether their information is retained, used to train AI models or shared with third-party service providers.

 

Another concern is access to account credentials. Agents need to authenticate themselves with external services to perform tasks. If the access tokens or credentials they use are compromised, attackers could potentially gain access to connected applications and personal information. Companies will need to ensure that these permissions can be restricted and revoked.

 

Prompt injection presents a separate security challenge. Malicious instructions hidden in emails, documents or websites could attempt to manipulate an agent into ignoring the user's original request.

 

Current personal AI agents include safeguards to keep users involved in sensitive tasks. Meta's Muse and Google's Gemini Spark, for instance, require user approval for certain actions, such as sending emails or making purchases. These approval mechanisms are intended to prevent agents from taking consequential actions without the user's knowledge.

 

However, deciding which actions require approval remains a challenge.