Meta Muse vs OpenAI Dots vs Siri AI: Comparing Trust in Personal AI Agents

Meta, Apple, and OpenAI have launched their own personal AI agents almost simultaneously — Muse, Siri AI, and dots. These agents don't just answer questions; they can read emails, connect to apps, and take actions on your behalf. For businesses, the real question isn't which agent is smartest — it's which one you'd trust with your company inbox.

This article compares the three products across four dimensions that determine trust, based on each company's publicly available documentation.

Where Does the Agent Run?

Meta's Muse runs in what it calls a Muse Secure VM — a dedicated computer allocated to each person within Meta's cloud. Alongside it is a separate agent called Sentinel, and anything Muse sends to the internet must pass through Sentinel's approval.

Each OpenAI dot has its own cloud computer and browser. Your laptop stays separate unless you actively connect it.

Siri AI runs on-device as much as possible, with remaining requests sent to Apple's Private Cloud Compute — Apple's own AI servers. Apple says these models were built in collaboration with Google's Gemini.

Two of the three products are designed to run in their respective company's cloud, while Siri AI keeps processing on the phone in your hand whenever possible.

Private Cloud Compute (PCC) is a dedicated server cluster Apple built to handle AI requests, with the core design goal of maintaining an end-to-end privacy commitment even when large-model inference happens in the cloud rather than on-device. Apple's public documentation emphasizes two points: first, data sent to PCC is not persistently stored — it is discarded once the request is processed; second, the servers run images built on-the-fly for a single request, and those images can be audited by independent security researchers. Apple itself cannot extract user data at the system level. This differs from the usual cloud service path of "persist first, then process," and it is Apple's core rationale for distinguishing its AI from Meta's and OpenAI's cloud-based approaches. Understanding this mechanism helps clarify the actual boundary of Siri AI on the privacy dimension: what it can protect is the data in general inference requests, but once a request is handed off to a third-party model or requires calling an external app, the scope of protection develops gaps.

Who Learns From Your Conversations?

This is where the three differ most. According to CNBC, Muse users who don't want their conversations used to train Meta's models must actively opt out. If they keep the default, Meta says it first strips "key personally identifiable information."

For dots, personal ChatGPT plans follow your "improve the model for everyone" setting. Business, Enterprise, and Edu workspaces are not used for training by default. OpenAI's privacy FAQ adds that even with the setting off, personnel may still review activity in limited cases such as safety.

Apple says that when Private Cloud Compute processes a request, personal data is not stored and cannot be accessed by Apple or anyone else.

For company data, default settings matter more than privacy pages, because most people never change defaults.

"Opt-out" vs. "opt-in" are two opposing default strategies in data governance, and they directly determine the burden of proof for users and businesses on compliance. Opt-out means the service collects and uses data by default, and users must actively turn off a switch to stop it; opt-in requires users to explicitly consent before data can be used. For enterprise procurement, this distinction matters far more than the wording of terms: under an opt-out structure, as long as employees don't go through settings one by one, company emails, customer names, and business terms can enter the model training pipeline — and during an audit, the company will struggle to prove it fulfilled its notification obligations. That's why many enterprise compliance frameworks (such as the data minimization principle under GDPR and record-keeping requirements in some industries) tend to require vendors to offer a default-off training option. This is also the technical reason the article repeatedly emphasizes "read the defaults" — the default value is effectively the actual configuration of data flow.

What Can You Take Back?

Muse lets you tell it to forget specific things it has learned.

dots currently does not support viewing or deleting individual memories. You can delete an entire dot, which removes its context, but the files and chat records it created remain in place.

Apple's launch page does not explain how to view what Siri AI remembers about your personal context.

If you can't see what an agent remembers, assume it remembers everything you've connected.

Who Approves Before Execution?

Muse confirms with you before sensitive actions such as sending emails or making purchases, and keeps an audit record of actions it has taken and plans to take.

dots first automatically reviews each risky action. The most sensitive actions, such as changing passwords or transferring money, require you to do them yourself.

Apple's page does not explain when Siri AI will seek your consent before acting in other apps.

An agent that can take actions should tell you in writing which actions it will never complete on its own.

Human-in-the-loop (HITL) refers to a mechanism in which a human confirms or vetoes an operation before an automated system executes it with irreversible consequences. In AI agent scenarios, it is usually implemented by risk tier: low-risk operations (reading, drafting) are automatically allowed; medium-risk operations (sending emails, creating orders) require one confirmation; and high-risk operations (transfers, changing passwords, deleting data) require the user to complete them personally in a trusted interface, with the agent unable to do it on their behalf. Paired with this is the audit log, which leaves a traceable record of what the agent "has executed" and "plans to execute," making it easier to assign responsibility and conduct compliance reviews afterward. To judge whether an agent is mature, the key is not whether it can do things, but whether it clearly lists in writing the set of actions it will never execute on its own — the existence of that boundary determines whether a business can clearly define responsibility when something goes wrong.

Which Agent Fits Which Scenario?

The answer isn't about brand — it's about data.

• Company email, customers, and files: use only enterprise plans where training is off by default and someone on the team controls the account. Among the three, only OpenAI currently clearly states that dots meets this condition on Business and Enterprise plans.
• Personal context on your phone: Siri AI's local-device design is the most cautious of the three, though it is still in testing.
• Other scenarios: read the defaults, turn off training if you don't want it, and connect only one app at a time.

Also check the region where you operate. Muse is only available in the United States, dots is available in "eligible markets," and Siri AI was not available in the EU or China on iPhone, iPad, or Apple Watch at launch.

Personal Agent Protocol: What You Need to Know

Soon, these agents won't just work for your team — they'll show up in front of your business on behalf of your customers, checking orders, booking appointments, or requesting refunds.

Personal Agent Protocol, announced on October 6 by Sierra and Meta together with companies such as Shopify, Stripe, and Walmart, is a draft standard for exactly this moment. It lets businesses decide what a customer's agent can do, from blocking it entirely to allowing it to act with customer approval. Customers log in on the business's own page and choose whether their agent can view the account, make changes, or both.

The protocol is still at version 0.1, and OpenAI and Apple are not among the founding members. But the direction is clear: businesses need to prepare something on their own systems for these agents to interact with. This is exactly what we continue to build in our custom AI agent and help desk work: an agent connected to your own systems, following your rules, and knowing when to hand decisions to a human.

In my experience, trust in these tools rarely comes from launch videos — it comes from reading the defaults.

Personal Agent Protocol is a draft standard at version 0.1, announced on October 6 by Sierra and Meta together with companies such as Shopify, Stripe, and Walmart, with the goal of establishing a permission negotiation mechanism between "customer agents" and "enterprise systems." Its basic model is: customers complete login and authorization on the business's own page, and the business then decides whether that agent can view the account, initiate changes, both, or even be denied access entirely; every action by the agent takes place within the rules set by the business. This is similar to extending OAuth's scope concept to the level of "agent behavior," but it adds behavior-level granular control. Note that the protocol is still early, and OpenAI and Apple are not listed as founding members, so in the short term the degree of access will vary noticeably across different agents. For businesses, the practical move is to sort out in advance which interfaces in their own systems need to be opened to external agents and at what permission granularity, rather than waiting for the standard to be finalized.

One-line Summary

Meta Muse, OpenAI dots, and Apple Siri AI differ markedly in where they run, training defaults, memory control, and action approval — businesses should choose agents by data sensitivity, not brand.

Paragraph Summary

Based on the three companies' public documentation, this article compares Meta Muse, OpenAI dots, and Apple Siri AI across four dimensions. On where they run, Muse and dots are designed to run in their company's cloud, while Siri AI processes locally as much as possible and relies on Private Cloud Compute. The biggest difference is in data training: Muse requires users to actively opt out, OpenAI Business and Enterprise plans are off by default for training, and Apple says cloud data is not stored. On memory management, Muse supports selective forgetting, dots cannot delete individual memories, and Siri AI has not disclosed its approach. On action approval, Muse asks before sensitive actions and keeps audit records, while dots automatically reviews and requires users to personally complete the most sensitive actions. The article also introduces version 0.1 of the Personal Agent Protocol, which lets businesses control customer agents' access. The core conclusion: choose an agent based on data type and default settings, not brand.