Meta’s Muse: the most polished consumer agent yet, after a rough first three weeks

A free tier took Muse to #1 on both app stores. The model is mid-pack, and launch brought an Amazon block, a privacy dispute and a patched Mac flaw.

01What Meta launched

Muse launched in the US on Sep 8 on iOS, Android and muse.ai (TechCrunch also lists WhatsApp), with AI glasses “coming”. It takes long-running tasks, keeps working after you close the app, and asks for approval before it sends email or spends money. vendor

• What it does: books travel and reservations, fills forms in its own browser, negotiates bills, sells items, and checks out through Link (Stripe). It remembers preferences and makes unprompted suggestions. vendor
• The model: Muse Spark, version 1.3 per TechCrunch. press
• Since launch: a Mac app (Sep 17), more than 1,500 developer connector applications in under a week, and Muse for Small Business (Sep 29), with integrations such as Shopify, Slack and QuickBooks. vendor press
• Announced Sep 23, dates “soon” or unspecified: Realtime Avatar video chat, macOS app control, an email address for the agent, and retail partners including Best Buy, Walmart and Wayfair. press

Watch the launch video on X (@Muse), where an order waits for approval of a $47.80 total, or Mark Zuckerberg’s live demo (via @RealNickMugalli).

02The security pitch

Meta’s answer to the trust question is architecture: each user gets the Muse Secure VM, a dedicated cloud computer, and a separate Sentinel agent must approve anything Muse sends to the internet. vendor

• Credential vault: Muse can’t see passwords or payment methods; purchases use one-time card numbers via Link, which Meta calls the “first AI agent covered by Link’s purchase protections”. vendor
• Data use: an activity trail of every action, an opt-out from training, and no sharing of conversations or VM data with Meta’s ad systems. vendor
• Promised, not shipped: a Confidential VM, end-to-end encrypted with a key the user holds. vendor

TechCrunch framed the trust question around Meta’s record, including a $5 billion FTC penalty in 2019. press

03The model underneath

The picture: decent, fast and very verbose, well behind the top tier. Muse’s edge is the product, not raw intelligence. Artificial Analysis tests the API model; the app may run a Muse-specific configuration.

04What people are doing with it

Meta’s Alexandr Wang started the #musemoneychallenge on Sep 12 (“can your muse make you $1000?”), and builders answered. vendor

• Claire Vo (Lenny’s Newsletter), Sep 16: the best-designed consumer agent she has tested. A one-shot personalized morning newsletter PDF, deleting a family calendar event and buying IMAX tickets worked; browser shopping for a specific pair of New Balance sneakers failed, and complex shopping was inconsistent. independent
• @joulee (Julie Zhuo): the first consumer agent that might change habits. community

Adoption was fast: millions of downloads in about two weeks. Appfigures counts about 2.3 million; Sensor Tower and Apptopia figures cited in secondary reports are 3.4 million and 4.3 million. independent

05Amazon said no

By Sep 20, Muse users trying to shop on Amazon got an error calling it an “unauthorized AI agent”. Amazon confirmed it asked Meta to stop: Meta gave no advance notice, Muse doesn’t identify itself as an agent, and Amazon has concerns about how it handles customer credentials. press

There is a commercial angle too: agent shopping skips the browsing where Amazon sells ads. The two companies are also partners. press @Bencera summed up the standoff: “Either Amazon is building a Muse / Or Meta is building an Amazon.” community

06The Messages dispute

On Sep 19, Inc. columnist Jason Aten wrote that he explicitly declined access to his messages when installing Muse on an iPhone and a Mac mini. Muse later suggested that a chat with his podcast co-host would make a good column. Asked how it knew, Muse said it only saw notification banners relayed from the Mac. Aten says the Mac app had in fact synced his local Messages database, to row 187,462, while Full Disk Access showed as not enabled. press

Meta’s side: David Singleton, head of Meta Superintelligence Labs, said Messages access is opt-in and that Muse’s wrong explanation was “on us”, according to Decrypt. His reply to Aten implied the setting had been allowed. press

What’s unresolved: how the setting got enabled when Aten says he declined it. Meta hasn’t answered that, per Decrypt. This is one user’s account, in an opinion column; later AppleInsider and 9to5Mac pieces cover the same case.

07A patched Mac flaw, and humans on the phone

Security researcher Patrick Wardle disclosed a zero-day in the Muse Mac app on Sep 21. A hidden developer setting let malicious code already running on the Mac redirect Muse’s dictation to an attacker’s server, exposing the audio and an authentication token. Only the Mac app was affected. Meta removed the setting in a hot-fix shortly after midnight on Sep 22. Singleton called it “a local privilege escalation attack, not a remote exploit”. Wardle’s counterpoint: that precondition can be met by tricking a victim into pasting a malicious command. press

Separately, 404 Media reported on Sep 22 that, per internal messages, Meta “added a human agent layer” for Muse’s phone calls to businesses, and employee testers weren’t told a human placed the call until afterwards. Meta said this was internal testing ahead of public release. press

08Price, and how it stacks up

Meta says Muse is “free for most of what people need”. vendor TechCrunch lists the paid tiers: Power at $20 a month and Maximum at $100. press Task-level pricing isn’t published, it’s US-only for now, and retail sites can block it.

Dots pricing is OpenAI’s vendor; Grok Bot pricing is as VentureBeat reports it press.

09Handle with care

10Sources

• vendor Meta: Introducing Muse · @Muse launch video · @AIatMeta: Muse for Mac · Sep 23 event demo
• vendor @alexandr_wang: #musemoneychallenge · @dps on the Muse Secure VM · OpenAI: Introducing dots
• independent Artificial Analysis: Muse Spark 1.3 · launch article · Claire Vo, Lenny’s Newsletter · Appfigures
• press TechCrunch: launch · Amazon block · Sep 23 updates · small business
• press Inc. (Jason Aten) · Decrypt · Gizmodo · 404 Media · GeekWire · VentureBeat
• community @KORGAONKAR · @mvanhorn · @joulee · @Bencera