Is OpenAI Dots more private than Meta Muse?

What did OpenAI promise about Dots privacy at DevDay?

At this year's DevDay, Sam Altman introduced Dots, OpenAI's always-on personal agent, and said the company wants to "set a new standard for privacy in frontier AI." The line was also a dig at Meta's Muse, and OpenAI spent much of the day hinting that Muse fails to keep user data safe. The controls shown on stage looked reassuring. You could set your own purchase caps, and enterprise customers were offered zero-data-retention options. The message to buyers was clear: Muse has had a rough few months. A keynote pledge describes what a company intends. It isn't a feature list. For you, the question isn't which company promised more. It's what each agent can reach, what it keeps, and how hard it is to make it forget.

Muse's record is why the dig landed. Meta launched it a couple of months earlier as a safer alternative to OpenClaw, the open-source agent it was openly modeled on, and Mark Zuckerberg said it was "built from the ground up for privacy and security." Since then it has had a zero-day vulnerability and an incident where a user's home address went into a marketplace listing he hadn't fully approved. There's also a disputed report that it quoted a reporter's private messages it was never given access to. Researchers who examined its internal instructions found it keeps an ongoing profile of the people in your life, including people who never signed up. Adoption barely slowed. Muse passed 600,000 daily active users in the US within weeks.

Dots has a cleaner record, but that needs context. It has had fewer scandals partly because it has far fewer users. It sits behind a $100-a-month subscription, so the user base is small and there's less to go wrong in public. Fewer headlines don't prove better design. If you want to know what the model behind it changes, here's what GPT-6 Astra means for your Dot. This article skips the keynote scorecard and gives you a five-question checklist instead. You can use it on Dots, on Muse, or on whatever agent gets pitched to you next month. The answers won't be on the marketing pages. Look in the help docs, the settings screens, and what happens when you try to delete something.

What should an AI agent privacy checklist include?

A useful AI agent privacy checklist asks five questions: what can it read, what does it store, does it train on your data, can it act without asking, and how do you delete it? Every privacy claim an agent maker makes fits under one of them, and each can be checked against real settings rather than slogans. The order matters too. Access comes first because an agent can't leak, remember or misuse data it never touched. If an agent fails the first question, good answers to the other four only limit the damage. That's why the checklist starts with reach and ends with deletion. Deletion is the last line of defense, not the first, and a strong delete button doesn't make up for an agent that reads too much.

Start with reading. Find out exactly which accounts the agent can open: email, calendar, files, messages, browser, the whole computer. Then check whether it reads only when you ask, or whether it goes through your data in the background without being asked. Storage comes next. A memory that keeps facts you told it, like "My accountant is Dana and she prefers email," is very different from a memory that quietly builds a file on every person you've ever messaged. Also ask whether those memories sync with other products from the same company. An agent that shares memory with a chatbot you've used for two years starts with far more about you than you might expect.

The last three questions are about control. On training, find the setting that decides whether your conversations help improve the model, and check its default for your plan, not just for enterprise customers. On acting, look for the actions that always need your sign-off, such as payments, password changes, deleting files and messages sent in your name. Find out whether a single "allow always" checkbox can override those safeguards. On deletion, check whether you can remove one specific memory or only wipe the entire agent, and what's left afterwards. Files, chat logs and data copied into other products often outlive a reset. If the help center can't answer any of these questions clearly, take that as your answer.

How do Dots and Muse compare on that checklist?

Dots edges out Muse on the checklist, but mainly on acting and training, not on reading or storing. Both agents are designed to reach widely. Dots can read the apps and plugins you connect, and it can research that connected-app data on its own, without a prompt, using tools OpenAI describes as read-only. Muse reaches your connected accounts too, and in at least one reported case it referred to messages on a Mac that its user hadn't granted it. On storage, both keep a lot. A Dot keeps context from conversations and plugins for as long as the Dot exists, and shares memory with ChatGPT in both directions. Muse keeps what researchers describe as a page for every person in your life.

Training and actions are where the two split. On personal plans, Dots follows ChatGPT's "Improve the model for everyone" setting, so you can switch it off. Business and enterprise workspaces aren't used for training by default. OpenAI also says human review can still happen in limited safety cases. Muse has been reported to train on your data by default, with names and identifiers stripped first. For actions, Dots makes you take over for password changes and money transfers, and it may ask for approval each time it wants to delete data or install software. Meta says Muse asks before sending email or making a purchase. Even so, the address incident happened after a user ticked "allow always" during setup.

Deletion is where both disappoint. In a Dot, you can't view, edit or delete individual memories. The only way to clear what it learned is to reset the entire Dot, and even then the files, coding threads and ChatGPT conversations it created stay put. Disconnecting an app stops new access but doesn't remove what the Dot already absorbed. Muse lets you disconnect apps and permanently delete your data, but reports suggest information linked to a deleted conversation can stick around. My verdict is that Dots is the better-behaved agent, but neither keeps its footprint small. Each needs broad standing access to be useful, and that's the real privacy cost you're agreeing to.

Which is the most private AI agent in 2026?

The most private AI agent in 2026 is the one with the least standing access to your life, not the one with the boldest privacy pledge. That's my contrarian take on the whole Dots-versus-Muse argument. Both companies are competing over who handles enormous access more responsibly, but the bigger decision is how much access you hand over in the first place. An agent that can read every inbox and message thread will always carry more risk than one that sees a narrow slice, however good its sandboxing is. If privacy is your top priority, you can choose a different design altogether. For example, assistants that run on your own computer trade some convenience for keeping data local.

If you're already using one of the big two, a few changes today will shrink your exposure. In Dots, turn off "Improve the model for everyone" if you're on a personal plan, and leave local computer access off. Connect apps with the narrowest permissions available, ideally read-only and through a dedicated account rather than your main inbox. Remember that turning off ChatGPT's memory stops future sharing but doesn't erase what your Dot already received. In Muse, skip every "allow always" option during setup, disconnect apps you don't need, and check its training settings. Some reviewers suggest waiting for Meta's promised confidential-computing version before trusting Muse with anything sensitive.

Here's the question nobody on a keynote stage will ask you: do you actually need an always-on agent going through your inbox? For most small business owners and busy professionals, the honest answer is no. Your real admin is narrower. It's chasing a supplier, remembering the Monday call with the accountant, reading a contract before you sign, and keeping a group chat on schedule. That work mostly happens in WhatsApp already. An agent that lives where the work happens, and only sees what you put in front of it, can handle most of it without access to your email, files or browser. Smaller scope means fewer things that can go wrong.

How does a WhatsApp assistant like Sonic answer the same questions?

Agent Sonic only sees what you send it in the chat. That's the short answer to the checklist's first and most important question. Sonic is a contact you message in WhatsApp, and there's nothing to install. It doesn't go through your inbox, your other conversations or your computer. If you text "Remind me to call the accountant every Monday at 9," it knows about the accountant and Monday. If you forward a PDF and ask "Any nasty clauses in this lease?", it reads that PDF. If you add it to a group, it sees that group so it can post recaps and reminders. Google Calendar, Sheets and Docs only come into it when you choose to connect them for a task.

On acting without asking, Sonic is strict by design. Its outreach tasks message people for you, like "Ask Dana when the invoice will be ready and let me know." Before anything goes out, Sonic shows you the exact first message for each person. You reply "yes" to send, "no" to drop it, or ask for changes like "shorter, no emoji." It writes from its own WhatsApp number, always introduces itself as your assistant, and never pretends to be you. If someone says stop, they're never messaged again by anyone using Sonic. Outreach is Pro-only and in Beta. It runs one task at a time with up to 3 people a day, so it can't turn into spam. The step-by-step guide to outreach tasks covers the rest.

On storage, Sonic does keep a persistent memory of what you tell it. That's the point: "Remember that Tom prefers calls after 4" should still be true next week. Still, use the checklist on us too. Ask how long data is kept and how deletion works before you hand over anything sensitive, just as you'd ask OpenAI or Meta. A good vendor will give you a clear answer. If you want an assistant that handles reminders, follow-ups and documents without needing access to your whole digital life, Sonic is an AI assistant you just text in WhatsApp. To try it, leave your details and get Sonic's number, and onboarding starts right in the chat.

Frequently asked questions