Meta AI
Meta Platforms · meta.ai
Meta AI is a hosted assistant that runs only on Meta's infrastructure, using Meta's own closed models, and is tied to a Meta account. The owner can export chat data and disconnect individual connected apps. The agent cannot be restored or run elsewhere, and interactions are used by default for ad and content personalization with no documented opt-out in the US.
- Self-service export of Meta AI data in JSON or HTML
- Per-service disconnection of connected apps such as Google Workspace
- Saved memories are listed and can be deleted item by item
- No restore path outside Meta and no model choice; hosted-only on Meta's models
- AI interactions used for ads and content personalization by default, with no documented opt-out
- No documented action record, integrity data or owner-set approval gates
- Deletion does not guarantee removal of Meta's copies
All 26 findings
Meta AI as documented on 2026-09-30; iOS app version 292.0.0 per App Store listing; model Muse Spark (Muse Spark 1.1 per July 2026 newsroom post); Meta AI Terms last updated 2026-05-13; Meta Privacy Policy last updated 2026-07-23. Desk review only; no signup or use of the service.
Portable · Can you leave, take the whole agent with you, and keep it alive?
0%- P1Owner-usable round trip
Meta offers a data export (Settings > Data & privacy > Download your information) that may take up to 30 days. There is no documented import or restore of the agent on any runtime or host that Meta does not operate.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer an on-demand export with a matching importer or independent runtime that restores a working agent
Fail - P2Complete export
The export covers Meta AI app, meta.ai, Vibes and glasses data, excluding deleted content. Several classes of state stay with Meta: base instructions, model and logic, connector grants (Google Workspace connects through Meta's OAuth client), scheduled-task definitions, and the personalization signals Meta draws from other Meta products.
- Export a copy of your Meta AI and AI glasses device information
- Use Meta AI to help manage your business
› How it could pass
Suggestions. Any change that meets the test counts.
- Export instructions, memory, schedules, tasks and a way to re-link each connector without Meta's client
Fail - P3Runs without the provider
Meta AI is a hosted service that needs a Meta account and Meta's servers. Under the Terms, Meta may suspend or permanently disable access or delete the account.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide a runtime the owner can run indefinitely without Meta's servers, account or permission
Fail - P4Model independence
Meta AI runs on Meta's own Muse Spark model; the announcement offers Instant and Thinking modes but no choice of a third-party or local model.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner configure any model meeting a documented minimum, including a local open-weight model
Fail - P5Exit survives termination
The Terms allow Meta to permanently disable access or delete the account for breach. No post-termination export window or shutdown plan is documented, and state is not kept on the owner's device by default.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to a 30-day post-termination export window, including bans and shutdown
- Keep a current owner-held copy by default
Fail
Transparent · Can you see everything the agent is, and everything shaping it?
13%- T1Readable without the provider
Agent state lives on Meta's servers and can be read only through Meta's app or its export service. Base instructions and logic are not available to the owner in any form.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make all state, including instructions and logic, readable in documented formats without a Meta-operated service
Fail - T2What runs is what you see
Meta does not document any view of the system prompt or the assembled context. Material settings are not exposed either: the exact model version in use and provider-side behaviour switches, including personalization from other Meta products, cannot be determined.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner view the full assembled context for any call
- Expose the exact model version and all provider-controlled switches
Fail - T3No shadow data
The Terms say AIs 'will sometimes retain and use' shared information, and that deleting messages, threads or even the account 'may not delete our copy'; no bounded retention period for AI interactions was found. Interests inferred from AI chats feed ad personalization, and the owner cannot see them item by item.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish bounded retention for every data class
- Show the owner every item Meta holds, including inferred interests
Fail - T4No hidden steering
Meta-first defaults are disclosed but cannot be switched off: personalization from Meta products and search partners chosen by Meta. No binding commitment against sponsored or self-preferencing recommendations was found.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to no paid or self-preferencing influence
- Let the owner switch off Meta-preferred sources and personalization
Partial
Auditable · Can you reconstruct exactly what the agent did, and trust the record?
0%- A1Complete action record
Meta AI keeps a chat History and runs scheduled or recurring tasks, but no durable record of consequential actions is documented, with or without arguments and targets. Meta does not describe how the owner learns about unrecorded actions or recording failures.
› How it could pass
Suggestions. Any change that meets the test counts.
- Record every consequential action from every trigger path, with targets and arguments
- Alert the owner when recording fails
Fail - A2Tamper-evident, owner-checkable
No integrity data or tamper-evidence mechanism is documented for any Meta AI record.
› How it could pass
Suggestions. Any change that meets the test counts.
- Hash-chain or sign the action record, anchored with the owner, and publish an open verifier
Fail - A3Agent cannot rewrite its record
No protection is documented that separates the record from the agent. Search excerpts of Meta help content (not rendered when opened) indicate that prompts like 'Delete full history' make Meta AI delete stored history.
› How it could pass
Suggestions. Any change that meets the test counts.
- Write the action record from a component the agent cannot alter, giving it read-only access
Fail
Verifiable · Can you prove what it runs, who it is, and what changed?
17%- V1Obtainable source, matching build
The service, runtime and Muse Spark model are closed. Meta says it 'hopes' to open-source future versions of the model.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish source for all required components under modifiable terms, with verifiable builds
Fail - V2Owner-rooted identity
The agent's identity is the owner's Meta account and Meta AI profile in Accounts Center. Meta issues these and can disable them under the Terms.
› How it could pass
Suggestions. Any change that meets the test counts.
- Root agent identity in an owner-held key or domain that Meta cannot revoke
Fail - V3Change history and rollback
Per Meta help content seen only as search excerpts, a 'Memory updated' marker shows when a memory is saved, with a list of saved memories. No history of instructions, settings or model changes is documented, and there is no restore.
› How it could pass
Suggestions. Any change that meets the test counts.
- Keep an attributed change log of all agent state, including model and settings
- Offer one-step restore to a prior state
Partial
Modifiable · Can you change anything, and can only you change it?
20%- M1Instructions and logic
Base instructions are set by Meta on its servers. No documented means lets the owner replace or override them.
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose the base prompt and default workflows as owner-editable, persistent instructions
Fail - M2Memory
Saved memories are listed and can be deleted one by one or all at once (per Meta help excerpts), but editing is not documented. The Terms say AIs also personalize using information such as 'interests, location and profile' from Meta products, a store that is not itemised in Meta AI.
- Meta AIs Terms of Service
- About Meta AI Memory (WhatsApp; content truncated when opened, relied on search excerpt)
› How it could pass
Suggestions. Any change that meets the test counts.
- Make every memory item editable
- Itemise profile and interest data the agent uses across sessions
Partial - M3Tools
Connectors are a Meta-curated set (for example Google Workspace and Meta business assets) that can be connected and disconnected. No documented way lets an owner add an arbitrary tool without Meta review, or remove built-ins such as web search.
› How it could pass
Suggestions. Any change that meets the test counts.
- Accept owner-supplied tools through a documented interface without review
- Allow removal of every built-in tool
Partial - M4Owner has the final say
Meta applies protections such as content restrictions, including memory items that 'can't be saved' when deemed unsafe. No owner setting to change them is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Document each provider-imposed protection and let the owner change it with a warning
Fail - M5No unilateral change
Meta changes the model server-side without offering pinning or opt-in (Muse Spark, then Muse Spark 1.1). The Terms promise notice only for material changes to the Terms themselves.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner pin model and instruction versions
- Announce behaviour changes in advance and make them opt-in
Fail
Controllable · Is your word final?
8%- C1Boundaries
The only documented limit is connecting or disconnecting whole services. No limits are documented for instruction sources, contacts, spend or per-tool scope, or for enforcement against model output.
› How it could pass
Suggestions. Any change that meets the test counts.
- Add enforced per-recipient, per-domain and per-tool allow and deny lists
- Add spend limits wherever the agent can pay
Fail - C2Approval gates
No owner-configurable approval gates are documented for Meta AI. The July 2026 post describes steering tasks in real time, not gating action classes.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner choose which action classes need explicit approval, enforced on every path
Fail - C3Immediate halt
Meta AI runs scheduled and recurring tasks, but no global stop for in-flight, queued or scheduled work is documented. Per the C3 note, this is recorded as Unverified.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide and document one control that halts all activity, including scheduled tasks
Unverified - C4Data serves only the owner
Since 2025-12-16, Meta uses interactions with Meta AI to personalize ads and content in most regions, and the announcement offers no opt-out (only Ads Preferences). The Terms state that interactions may be reviewed by humans and shared with 'select partners, like search engines'.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make advertising, training and staff review opt-in in binding terms
- Require specific consent for data-term changes
Fail - C5Credential custody
Connected Google services are listed under Settings > Connected apps and can be disconnected individually. Revoking access to business assets is done by asking Meta AI in chat. Meta does not disclose where tokens are held, whether copies are deleted on revocation, or limits on its use of connected data.
› How it could pass
Suggestions. Any change that meets the test counts.
- Disclose credential custody and delete provider-side copies on revocation
- Offer a direct revoke control for every grant
Partial - C6Full deletion
Deleting chats removes them from History. The Terms state that deleting messages, threads 'or even your account may not delete our copy of your personal information'.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer one-step deletion reaching every provider-side copy and backup within a stated limit, with confirmation
Fail
How this assessment was produced
One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Meta AI (https://www.meta.ai).
During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.
- Model
- claude-opus-5-5
- Harness
- Claude Code 2.1.285
- Ran
- 2026-09-30 15:32:39 UTC · 48 turns
- Criteria hash
- a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
- Full transcript
- Download (JSONL, gzip) · every tool call, page read and reply
- Run protocol
- 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
- Human review
- pending
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/meta-ai.json.
Or grade it from scratch. See Check any score yourself.
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.