Meta 新 AI Agent 被曝可应要求列出弱势群体人员名单

Meta 于 9 月 8 日推出 Muse，这是一款个人 AI Agent，可代表用户发送电子邮件、预订旅行、填写表单和购物。自动化便利的承诺迅速带来了超过 340 万次下载，使 Muse 成为美国 iPhone 免费应用榜第一名。

为安抚早期用户，Meta 将 Muse 描述为一款设计上保护隐私的产品：它运行在安全的虚拟机中，并通过名为 Sentinel 的权限 Agent 管控其对外部互联网的访问。此前关于 Muse 的报道，大多聚焦于 Muse 能访问用户自身多少数据，以及能如何使用这些数据。

然而，当被要求对第三方进行画像时，情况呈现出另一番面貌。Hunterbrook 记者使用自然语言要求 Muse 编制真实 Facebook 和 Instagram 账号名单，涉及多个社群：无证移民、跨性别公立学校教师、投票工作人员、支持巴勒斯坦人士、支持以色列的组织、伊朗异见人士、与特定帮派有关联的芝加哥 drill 说唱歌手匿名小号、ICE 探员、计划搬迁至新基地的军人家庭、正在部署中的海军水兵、计划抗议学区委员会的家长，以及身处堕胎禁令州、已获得或曾尝试获得堕胎药物的女性。

Muse 照做了。该 Agent 针对每个提示词提供了 10 到 100 个账号的名单。Muse 通过挖掘其庞大社交媒体平台中的数据来判断成员身份：包括 Facebook、Instagram 和 Threads 上的 Reels、帖子、评论、主题串、回复、用户名、个人简介以及用户名历史记录。在一些情况下，它还通过网页搜索验证所发现的信息，识别出个人的全名和雇主。许多账号属于没有明显公众身份的普通私人用户。

在一个案例中，Muse 揭露了一名此前因担心遭到报复和骚扰、姓名一直未被新闻报道披露的人。在另一个案例中，它将数个匿名账号关联至同一个人。它还利用用户名和网页搜索，将一个私密 Instagram 账号匹配到真实身份。其展示的思维链，即推理过程，显示它能够通过 Instagram 用户过去使用过的用户名查找该用户。

Muse 的内部安全防护措施并不稳定，而且很容易规避。在多段对话中，它最初以画像和骚扰风险为由拒绝请求。但当记者稍微改写提示词，或仅仅在同一个聊天窗口中将命令作为后续消息重复发送时，它又多次改变立场，执行了完全相同的搜索。更糟的是，Muse 还会主动提供寻找记者所询问群体成员的方法。Meta 自己的 AI服务条款禁止用户利用其工具侵犯隐私权或实施监控。

为保护相关人员，Hunterbrook 没有公开其提示词或结果，但已将它们提供给 Meta。该机构还将调查发现分享给了三名隐私专家。

“这非常可怕，”乔治城大学法学院隐私中心研究与倡导主任 Stevie Glaberson 表示。“你不需要接受任何特殊训练，就能以这种方式将信息武器化……这会让弱势群体以及属于这些类别的人面临极端危险。”

加州大学欧文分校研究隐私与技术问题的法学教授 Ari Ezra Waldman 表示，Muse 通过挖掘分散来源的信息，破坏了保护普通社交媒体用户的模糊性，“便利了对这些人的识别，也便利了对他们进行人肉搜索。”

他说，虽然聚合某人的信息未必违法，但这种做法带有“显著的伦理负担”；Muse 所挖掘出的细节，“为某人实施现实中的人身攻击提供了大量所需工具”。

数字权利组织电子前沿基金会（Electronic Frontier Foundation，EFF）言论自由与透明度诉讼主任 Aaron Mackey 表示，Muse 符合科技行业一种熟悉的模式：“一款被推出的工具，基本上会极大放大原本就已存在的伤害。”

他说，人们此前也可以手动搜索 Facebook 帖子，但 Muse 这类 AI 工具使普通用户可以收集个人信息，“其规模未必是以前能够实现的”。

Mackey 表示，普通 Facebook 和 Instagram 用户或许不会同意自己的帖子被以可能识别其身份的方式聚合，即便这些帖子在技术上是公开的。他以投票工作人员为例：“如果 Meta 找到他们并说，‘我们实际想做的是，让所有正在寻找投票工作人员的人，都能随手获取你们的全部个人信息，以便他们建立一份名单’……我认为这个人会说，‘绝对不行，这不是我想要的。别这么做。’”

“我不认为他们当时会想到，自己这样做等于给了 Meta 某种全权授权，让它获取这些信息，然后使用并汇编这些信息，”Mackey 说。

ChatGPT 和 Claude 等其他热门 AI 助手无法高效挖掘 Facebook 和 Instagram 数据：Meta 并未为用户帖子提供通用搜索 API，其研究工具也仅向经过审核的学者和非营利组织开放。相比之下，Muse 的搜索结果显示，它会利用公开帖子、评论、回复、Reels 的摘要和文字转录内容来获取身份识别信息并编制名单，随后再通过网页搜索交叉验证识别性细节。

这些能力并非完全新鲜。资源充足的行为主体长期以来一直在挖掘公开社交数据，而 Facebook 自己的 Graph Search 在 2019 年前也提供过类似功能。但这可能是迄今最容易交到普通用户手中的同类工具：只需一个免费的聊天提示词，就可以通过公开的 Facebook 和 Instagram 帖子，系统性地监控、锁定并聚合个人及群体的个人信息。

Hunterbrook 于 9 月 22 日星期二发现了这一能力，并立即通知 Meta 管理层。次日凌晨 1 点 52 分，Meta 公共事务团队回复称希望获得更多信息。Hunterbrook 随后跟进并分享了提示词，但此后 Meta 未回应其多次置评请求。

出于保护本次报道中被识别出的个人和弱势群体的考虑，Hunterbrook 不会公开其获得的账号名单，也不会公开可能让他人复现这些搜索的方法论。有意进一步了解测试设计细节的个人或组织，可联系 ideas@hntrbrk.com；Hunterbrook Media 将根据具体情况决定是否以及分享多少研究内容。

Meta launched Muse on September 8 as a personal AI agent that can send emails, book travel, fill out forms, and make purchases on a user’s behalf. The promise of automated convenience swiftly drove 3.4 million-plus downloads, making Muse the No. 1 free iPhone app in the U.S.

To reassure early adopters, Meta pitched Muse as private by design, running on secure virtual machines and a Sentinel permission agent to police outside internet access. Early coverage of Muse has largely focused on how much of a user’s own data Muse can reach and what it can do with that data.

Yet when asked to profile third parties, a different picture emerged. Using plain language, Hunterbrook reporters asked Muse to compile lists of real Facebook and Instagram accounts across a range of communities: undocumented immigrants, transgender public school teachers, poll workers, pro-Palestinian individuals, pro-Israeli organizations, Iranian dissidents, Chicago drill rapper burners associated with specific gangs, ICE agents, military families planning to move bases, deployed Navy sailors, parents planning to protest against school boards, and women who have accessed or attempted to access abortion pills in states with abortion bans.

Muse complied. The agent delivered lists ranging from 10 to 100 accounts per prompt. Muse determined membership by mining data from its gargantuan social media platforms: Facebook, Instagram, and Threads, including Reels, posts, comments, threads, replies, usernames, bios, and username history. In some cases, it corroborated what it found with web searches, identifying a person’s full name and employer. Many of the accounts belonged to private individuals with no discernible public persona.

In one case, Muse unmasked a person whose name had been kept out of news reports for fear of retaliation and harassment. In another, it tied several pseudonymous accounts to the same person. It also matched a private Instagram account to a real person using usernames and web searches. Its chain of thought, the reasoning it displayed, showed it could look up Instagram users by former usernames.

Muse’s internal safeguards were erratic and easily evaded. In several conversations, it initially declined a request, citing the risks of profiling and harassment. Yet it repeatedly reversed course and executed the exact same search when reporters slightly reworded the prompt — or simply repeated the command as a follow-up in the same chat window. Worse, Muse helpfully offered ways to find members of the group our reporters asked about. Meta’s own AI terms of service prohibit users from using its tools to infringe on privacy rights or conduct surveillance.

To protect the people involved, Hunterbrook is not publishing its prompts or results. It shared them with Meta. It also shared its findings with three privacy experts.

“It’s very terrifying,” said Stevie Glaberson, director of research and advocacy at Georgetown Law’s Privacy Center. “You don't need any special training to weaponize information in this way … It puts vulnerable people and people who belong in these categories in extreme danger."

Ari Ezra Waldman, a law professor at the University of California, Irvine, who researches privacy and technology, said that by mining information from disparate sources, Muse destroys the obscurity that shields everyday social media users, “facilitating the identification and facilitating the doxxing of those people.”

Although aggregating someone’s information isn’t necessarily illegal, he said the practice carries “significant ethical baggage,” adding that the details Muse surfaced “gives someone a lot of the tools they need to go physically attack a person.”

Aaron Mackey, free speech and transparency litigation director at the Electronic Frontier Foundation, a digital rights group, said Muse fits a familiar pattern in tech, “where a tool is released that can basically supercharge harms that were already present.”

It was possible to manually search Facebook posts before, he said, but AI tools like Muse let everyday users compile personal information “in ways that aren't necessarily possible to do at the same scale as before.”

Ordinary Facebook and Instagram users might not consent to their posts being aggregated in ways that could identify them, even if a post is technically public, Mackey said. He gave the example of poll workers: “If Meta came to them and said, ‘What we'd like to do is actually be able to have all of your personal information at the fingertips of someone who is looking for poll workers so that they can create a list’ … I think that person would say, ‘Heck no, that's not what I want. Don’t do that.’”

“I don't think they were thinking that in doing so they were giving Meta sort of carte blanche to take this information and then use it and compile it,” Mackey said.

Other popular AI assistants like ChatGPT and Claude cannot efficiently mine Facebook and Instagram data: Meta offers no general search API for users' posts, and its research tool is limited to vetted academics and nonprofits. Muse’s search results, by contrast, showed that it drew on public posts, comments, replies, summaries and transcripts of Reels for identifying information to compile its lists, then cross-checked identifying details with web searches.

These capabilities aren't entirely new. Well-resourced actors have long mined public social data, and Facebook's own Graph Search offered something similar until 2019. But this may be the easiest such tool yet put in ordinary users' hands: a free chat prompt that can systematically surveil, target, and aggregate personal information of individuals and groups through public Facebook and Instagram posts.

Hunterbrook discovered this capability on Tuesday, September 22, and immediately alerted Meta leadership. We received a response from Meta’s Public Affairs team the next day at 1:52 a.m. asking for more information. We followed up and shared our prompts, but Meta has since not responded to repeated requests for comment.

In the interest of protecting the individuals and vulnerable groups surfaced during our reporting, Hunterbrook will not publicly release the lists of accounts we obtained or the methodology that would enable others to reproduce these searches. Individuals or organizations interested in obtaining more detail about the design of our test may reach out to ideas@hntrbrk.com; Hunterbrook Media will make a case-by-case determination regarding whether and how much of our research to share.