Skip to content
Agents of Humanity
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
AssistanthostedProprietary

Meta AI

Meta Platforms · meta.ai

Meta AI is a hosted assistant that runs only on Meta's infrastructure, using Meta's own closed models, and is tied to a Meta account. The owner can export chat data and disconnect individual connected apps. The agent cannot be restored or run elsewhere, and interactions are used by default for ad and content personalization with no documented opt-out in the US.

Strengths
  • Self-service export of Meta AI data in JSON or HTML
  • Per-service disconnection of connected apps such as Google Workspace
  • Saved memories are listed and can be deleted item by item
Gaps
  • No restore path outside Meta and no model choice; hosted-only on Meta's models
  • AI interactions used for ads and content personalization by default, with no documented opt-out
  • No documented action record, integrity data or owner-set approval gates
  • Deletion does not guarantee removal of Meta's copies
Evidence

All 26 findings

Meta AI as documented on 2026-09-30; iOS app version 292.0.0 per App Store listing; model Muse Spark (Muse Spark 1.1 per July 2026 newsroom post); Meta AI Terms last updated 2026-05-13; Meta Privacy Policy last updated 2026-07-23. Desk review only; no signup or use of the service.

Portable · Can you leave, take the whole agent with you, and keep it alive?

0%
  • P1
    Owner-usable round trip

    Meta offers a data export (Settings > Data & privacy > Download your information) that may take up to 30 days. There is no documented import or restore of the agent on any runtime or host that Meta does not operate.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer an on-demand export with a matching importer or independent runtime that restores a working agent
    Fail
  • P2
    Complete export

    The export covers Meta AI app, meta.ai, Vibes and glasses data, excluding deleted content. Several classes of state stay with Meta: base instructions, model and logic, connector grants (Google Workspace connects through Meta's OAuth client), scheduled-task definitions, and the personalization signals Meta draws from other Meta products.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Export instructions, memory, schedules, tasks and a way to re-link each connector without Meta's client
    Fail
  • P3
    Runs without the provider

    Meta AI is a hosted service that needs a Meta account and Meta's servers. Under the Terms, Meta may suspend or permanently disable access or delete the account.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide a runtime the owner can run indefinitely without Meta's servers, account or permission
    Fail
  • P4
    Model independence

    Meta AI runs on Meta's own Muse Spark model; the announcement offers Instant and Thinking modes but no choice of a third-party or local model.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner configure any model meeting a documented minimum, including a local open-weight model
    Fail
  • P5
    Exit survives termination

    The Terms allow Meta to permanently disable access or delete the account for breach. No post-termination export window or shutdown plan is documented, and state is not kept on the owner's device by default.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to a 30-day post-termination export window, including bans and shutdown
    • Keep a current owner-held copy by default
    Fail

Transparent · Can you see everything the agent is, and everything shaping it?

13%
  • T1
    Readable without the provider

    Agent state lives on Meta's servers and can be read only through Meta's app or its export service. Base instructions and logic are not available to the owner in any form.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make all state, including instructions and logic, readable in documented formats without a Meta-operated service
    Fail
  • T2
    What runs is what you see

    Meta does not document any view of the system prompt or the assembled context. Material settings are not exposed either: the exact model version in use and provider-side behaviour switches, including personalization from other Meta products, cannot be determined.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the full assembled context for any call
    • Expose the exact model version and all provider-controlled switches
    Fail
  • T3
    No shadow data

    The Terms say AIs 'will sometimes retain and use' shared information, and that deleting messages, threads or even the account 'may not delete our copy'; no bounded retention period for AI interactions was found. Interests inferred from AI chats feed ad personalization, and the owner cannot see them item by item.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish bounded retention for every data class
    • Show the owner every item Meta holds, including inferred interests
    Fail
  • T4
    No hidden steering

    Meta-first defaults are disclosed but cannot be switched off: personalization from Meta products and search partners chosen by Meta. No binding commitment against sponsored or self-preferencing recommendations was found.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to no paid or self-preferencing influence
    • Let the owner switch off Meta-preferred sources and personalization
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

0%
  • A1
    Complete action record

    Meta AI keeps a chat History and runs scheduled or recurring tasks, but no durable record of consequential actions is documented, with or without arguments and targets. Meta does not describe how the owner learns about unrecorded actions or recording failures.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Record every consequential action from every trigger path, with targets and arguments
    • Alert the owner when recording fails
    Fail
  • A2
    Tamper-evident, owner-checkable

    No integrity data or tamper-evidence mechanism is documented for any Meta AI record.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign the action record, anchored with the owner, and publish an open verifier
    Fail
  • A3
    Agent cannot rewrite its record

    No protection is documented that separates the record from the agent. Search excerpts of Meta help content (not rendered when opened) indicate that prompts like 'Delete full history' make Meta AI delete stored history.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Write the action record from a component the agent cannot alter, giving it read-only access
    Fail

Verifiable · Can you prove what it runs, who it is, and what changed?

17%
  • V1
    Obtainable source, matching build

    The service, runtime and Muse Spark model are closed. Meta says it 'hopes' to open-source future versions of the model.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish source for all required components under modifiable terms, with verifiable builds
    Fail
  • V2
    Owner-rooted identity

    The agent's identity is the owner's Meta account and Meta AI profile in Accounts Center. Meta issues these and can disable them under the Terms.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root agent identity in an owner-held key or domain that Meta cannot revoke
    Fail
  • V3
    Change history and rollback

    Per Meta help content seen only as search excerpts, a 'Memory updated' marker shows when a memory is saved, with a list of saved memories. No history of instructions, settings or model changes is documented, and there is no restore.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep an attributed change log of all agent state, including model and settings
    • Offer one-step restore to a prior state
    Partial

Modifiable · Can you change anything, and can only you change it?

20%
  • M1
    Instructions and logic

    Base instructions are set by Meta on its servers. No documented means lets the owner replace or override them.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose the base prompt and default workflows as owner-editable, persistent instructions
    Fail
  • M2
    Memory

    Saved memories are listed and can be deleted one by one or all at once (per Meta help excerpts), but editing is not documented. The Terms say AIs also personalize using information such as 'interests, location and profile' from Meta products, a store that is not itemised in Meta AI.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make every memory item editable
    • Itemise profile and interest data the agent uses across sessions
    Partial
  • M3
    Tools

    Connectors are a Meta-curated set (for example Google Workspace and Meta business assets) that can be connected and disconnected. No documented way lets an owner add an arbitrary tool without Meta review, or remove built-ins such as web search.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Accept owner-supplied tools through a documented interface without review
    • Allow removal of every built-in tool
    Partial
  • M4
    Owner has the final say

    Meta applies protections such as content restrictions, including memory items that 'can't be saved' when deemed unsafe. No owner setting to change them is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document each provider-imposed protection and let the owner change it with a warning
    Fail
  • M5
    No unilateral change

    Meta changes the model server-side without offering pinning or opt-in (Muse Spark, then Muse Spark 1.1). The Terms promise notice only for material changes to the Terms themselves.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner pin model and instruction versions
    • Announce behaviour changes in advance and make them opt-in
    Fail

Controllable · Is your word final?

8%
  • C1
    Boundaries

    The only documented limit is connecting or disconnecting whole services. No limits are documented for instruction sources, contacts, spend or per-tool scope, or for enforcement against model output.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Add enforced per-recipient, per-domain and per-tool allow and deny lists
    • Add spend limits wherever the agent can pay
    Fail
  • C2
    Approval gates

    No owner-configurable approval gates are documented for Meta AI. The July 2026 post describes steering tasks in real time, not gating action classes.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner choose which action classes need explicit approval, enforced on every path
    Fail
  • C3
    Immediate halt

    Meta AI runs scheduled and recurring tasks, but no global stop for in-flight, queued or scheduled work is documented. Per the C3 note, this is recorded as Unverified.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide and document one control that halts all activity, including scheduled tasks
    Unverified
  • C4
    Data serves only the owner

    Since 2025-12-16, Meta uses interactions with Meta AI to personalize ads and content in most regions, and the announcement offers no opt-out (only Ads Preferences). The Terms state that interactions may be reviewed by humans and shared with 'select partners, like search engines'.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make advertising, training and staff review opt-in in binding terms
    • Require specific consent for data-term changes
    Fail
  • C5
    Credential custody

    Connected Google services are listed under Settings > Connected apps and can be disconnected individually. Revoking access to business assets is done by asking Meta AI in chat. Meta does not disclose where tokens are held, whether copies are deleted on revocation, or limits on its use of connected data.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Disclose credential custody and delete provider-side copies on revocation
    • Offer a direct revoke control for every grant
    Partial
  • C6
    Full deletion

    Deleting chats removes them from History. The Terms state that deleting messages, threads 'or even your account may not delete our copy of your personal information'.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer one-step deletion reaching every provider-side copy and backup within a stated limit, with confirmation
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Meta AI (https://www.meta.ai).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 15:32:39 UTC · 48 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/meta-ai.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding