Malaysia has about 16.7 million Instagram users, and for four days this week every one of them with a public account was fair game. A stranger could tag that account inside Meta's new AI image generator, pull the photos, remix them into something else, and the person in those pictures would never be told.
Meta withdrew the feature on Friday. The setting that decides what else can be done with your content is still sitting in your app, switched on by default, and most Malaysians have never opened it.
Editor
Kai T chevron_right
Table of Contents
What Meta built, then took back
Meta launched Muse Image on Tuesday, an AI image generator built by its Meta Superintelligence Labs unit, according to TechCrunch. One capability drew the fire: users could generate images by @-mentioning a public Instagram account and drawing on that account's photos. Only private accounts and accounts belonging to under-18s were excluded automatically, and nobody was notified when their pictures were used.
By Friday Meta had reversed course, saying in a blog post that it had heard the feedback the feature "missed the mark", so it was no longer available. Puck News founding partner Dylan Byers first reported the decision, and noted it followed scrutiny from users and talent agencies including CAA.
Why this landed harder in Malaysia
Instagram is not a niche here. DataReportal's April 2026 snapshot puts Malaysia at 16.7 million Instagram users, roughly 46.9 per cent of the population, with the 25 to 34 bracket the largest single cohort at 6.3 million.
The obvious defence, set your account to private, was useless for the people most exposed. Malaysia's Instagram economy runs on public accounts: the freelance photographer, the home baker taking orders through DMs, the thrift seller, the neighbourhood cafe, the creator whose reach is the product. Going private is not a privacy setting for them, it is closing the shop. Muse Image drew its raw material from precisely the group that cannot afford to be invisible, and many of them post their own faces daily because the face is the brand.
Malaysia has levers now, but none made Meta ask first
The rules here changed recently, and this is an early test of them. Since 1 January 2026, platforms with eight million or more Malaysian users are deemed registered as Applications Service Provider (Class) licensees under section 46A of the Communications and Multimedia Act 1998. Meta clears that bar several times over, so it now holds a Malaysian licence that can carry conditions. The Online Safety Act 2025 came into force the same day, covering content that causes harassment, distress, fear or alarm, though as Aliran has argued it does not explicitly criminalise the malicious creation of deepfakes. In early July the Dewan Rakyat passed the Cybercrimes Bill 2026, which Business Today reports covers digitally manipulated intimate images.
Now notice what none of that actually did. Meta shipped the feature, Malaysians were exposed by default, and what got it withdrawn was pressure from users and Hollywood talent agents, not a regulator. Every instrument above is reactive: each gives the state something to do after harmful content already exists. None obliged Meta to ask a Malaysian creator for permission before her face could be fed into a model. The amended Personal Data Protection Act, in force since June 2025, comes closest, and local compliance guidance is consistent that consent for AI processing must be purpose-specific rather than a blanket permission buried in a terms update.
The setting worth checking tonight
The @-mention feature is gone, but the control that governed it remains, and it covers more than that one tool. In the Instagram app, open your profile, tap the three lines in the top right, go to "Sharing and reuse", and find "Allow people to create with and reuse your content". Toggle it off for both posts and reels.
The wariness is not irrational. A Pew Research Center survey found 35 per cent of respondents are more concerned than excited about the growing use of AI. This is also not the first time Meta's AI has become a liability on Instagram: we covered how attackers tricked Meta's AI support assistant into handing over Instagram accounts, and European regulators are separately pressing Meta over addictive design.
Meta says it heard the feedback this time. The safer assumption for a Malaysian creator is that the next feature will also ship first and get corrected later, and that the toggle you set tonight is the only consent anyone is actually going to check.
Image(s) courtesy of Shutter Speed and Rifki Kurniawan on Unsplash.