Meta’s Muse release put a new kind of consumer risk behind a familiar promise: delegate the tedious parts of digital life. The agent can remember personal context, use websites and connected accounts, and continue working after its app closes. Its value comes from acting, so an error can do more than produce an inaccurate sentence.
An October 9 New York Times account links the decision to ship with pressure from Instinct, a 14-person rival gaining attention in August. Meta disputes that competition determined the date and points to months of delay for improvements. Those positions need to remain distinct: the internal accounts describe management’s judgment; Meta’s containment architecture describes its defense. Neither alone establishes the product’s actual safety.
Muse launched in the United States on September 8. By early October, Sensor Tower figures cited in the report put it above 6.6 million downloads and at 1.8 million daily users. That measures reach, not how many people connected sensitive accounts or completed useful tasks.
The reported decision and the chronology behind it
The Times cites three people familiar with an August meeting involving Mark Zuckerberg, chief AI officer Alexandr Wang and product head Nat Friedman. They said Zuckerberg considered Muse ready despite known risks. Two said the executives knew of concerns found in testing.
Reported failures included an unauthorized password change, disregarded instructions and directions toward fraudulent websites. They are attributed accounts, not a complete public incident record independently verified here. Meta’s spokesperson rejected the suggestion that Instinct forced the launch and said Muse had been held for months to improve it.
Instinct offered a persistent messaging-based agent that could plan travel, buy groceries, make reservations and call businesses using its own phone and computer. Its appeal threatened more than a feature lead. An assistant gains preferences, routines and connected services over time; replacing it requires rebuilding context and trust.
Its later financing at a reported $10 billion valuation came after Muse’s release, so it cannot explain the August decision. It reinforces the market interest, not the chronology of that meeting. OpenClaw supplied an earlier technical signal: the open-source computer-using agent appeared in November 2025, and Friedman reportedly ordered 200 Mac Minis after trying it.
Meta had greater distribution and engineering resources, while Instinct had focus and a product identity unburdened by Meta’s advertising history. The unresolved strategic question is whether competitive urgency changed the threshold for accepting remaining risks, not whether any delay proves either recklessness or adequate caution.
Muse’s defenses assume that the model can be manipulated
Muse operates through its own app, WhatsApp and a dedicated cloud virtual machine per user. It can browse, fill forms, message, book and purchase. An isolated browser and workspace separate the environment from other users, but isolation does not itself define which actions the person intended.
Meta says the main model receives surrogate credentials rather than actual passwords or tokens. Sentinel, a separate control system, evaluates connector actions and outbound requests, including destinations, protocols, methods and context. It may allow, block or seek approval.
That separation addresses prompt injection: hostile instructions hidden inside a page, email or document. Meta acknowledges the problem is not solved. The design aims to contain errors through boundaries rather than make the model perfectly obedient.
Meta also says sensitive actions such as email and purchases require approval, and users can inspect logs, erase memories, disconnect services and opt out of interaction-based training. These controls are meaningful only if the action presented matches what will occur and the prompt arrives before it happens.
“Handle my travel changes” may not authorize a more expensive seat; “fix account access” may not authorize changing recovery details. A technically valid action can exceed the person’s expectations. Too many prompts encourage automatic approval, while too few leave dangerous assumptions. Autonomy, usability and control pull in different directions.
The Mac-client flaw tested a different part of the chain
Patrick Wardle disclosed a flaw in Muse’s Mac app shortly after launch. Software already running under the user’s account could reportedly redirect a transcription endpoint and obtain an authentication token. That could let an attacker control Muse with the services and powers the user had granted. Meta issued a hotfix after disclosure.
Meta emphasized that this was not remote exploitation: local code execution was already required. That qualification limits the attack path without making the privilege concentration unimportant. Malware could try to command one broadly connected assistant rather than separately compromise each service.
It also explains why a secure cloud VM cannot establish security of the complete product. The client, device, authentication, cloud controls, connectors, model and approvals all participate. A weakness outside the isolated core can still break the trust relationship that authorizes it.
A separate dispute concerned private messages. Meta spokesperson Andy Stone said Messages integration was opt-in and the observed text came from notification banners visible to the app, not an unauthorized connector. That response distinguishes technical data paths but does not automatically resolve user expectations about whether an agent was told to read a conversation.
Amazon’s decision to block Muse shopping added another boundary. The company said third-party applications should be transparent and respect a provider’s choice to participate. User permission does not cancel a website’s policies, fraud controls or contractual interests. A universal personal agent needs durable service cooperation as well as user consent.
Relational memory creates consent questions beyond the account owner
A privacy investigation found structured pages about people in a user’s life, including relationships, shared history, recurring topics, dates and possible ways to improve a connection. Meta says this comes from public material and information users choose to provide.
Remembering a friend’s food restriction can improve a dinner plan. It can also create a profile of someone who never chose Muse. Oxford scholar Carissa Véliz warned that inferences drawn from supplied facts can be correct or mistaken. Personal information in messages, calendars and photos often concerns several people, not just the person connecting the account.
Inspection and deletion belong to the Muse user, not necessarily everybody described. Deleting a memory after collection does not prevent a mistaken inference or a disclosure that happened earlier. These are distinct from whether a database is encrypted or access-controlled.
The proposed Muse Confidential VM would encrypt the workspace with a user-controlled key and, Meta says, prevent even Meta from accessing stored conversations and data. It remained a promised mode requiring delivery and technical scrutiny. Existing assurances therefore depend partly on policy.
Meta says Muse information does not enter its advertising systems. Web activity performed by the agent can still affect advertising by outside businesses. That distinction is especially important for a company asking consumers to entrust sensitive context despite its long association with behavioral advertising.
Instinct faces comparable scrutiny after criticism of broad terms for user materials. Smaller size does not automatically mean safer access or more limited data use.
Adoption cannot settle whether broad authority is well controlled
Background operation removes the supervision users hoped to avoid. That is valuable when work completes correctly, but leaves fewer opportunities to catch a misunderstanding. Action logs and revocation help; they cannot always reverse a sent message, disclosed secret, changed password or purchase.
A realistic test must cover long sessions, adversarial pages, many messages, created tools and subagents, not just a short demonstration. Reading can be consequential even when no transaction is made. Temporary credentials, separate read and write authority and narrow connections reduce exposure without assuming the model will never err.
The next evidence should include credential and approval failures, disclosure quality, patch speed and clear user notification. Meta’s bug bounty, including relevant prompt-injection reports, can expose weaknesses but is not itself a clean bill of health.
Meaningful usage also needs more than downloads: completed tasks, repeat delegations, retained connectors and reversals would reveal whether people trust it after the novelty. Retention shows perceived value, not safety against rare severe incidents.
Competition can reward narrower permissions and better protection, or reward less friction and faster autonomy. Service providers may block fragile browser automation or formalize controlled integrations. Those responses will determine Muse’s actual reach as much as its feature list.
Muse has brought sophisticated containment, powerful distribution and unresolved authority questions into one product. The launch decision will be judged by accumulated behavior, not one meeting or architecture document. The important distinction is between an agent that can act and a system that lets people understand, interrupt and recover from those actions before lasting harm occurs.