Meta’s new AI agent can shop, send emails, make phone calls and book travel on your behalf. This week Meta made it bigger. It also had its first real tests on security, privacy and permission.
Photo credit: Meta
Meta Is Building an AI That Acts, Not Just Answers
For the last few years, AI tools have mostly done one thing: talk. You ask a question, and you get an answer.
Meta wants to change that. Its new AI, called Muse, is built to do things for you.
Here is the simple difference:
- A chatbot gives you information. “Here are three flights to Delhi.”
- An AI agent takes action. It books the flight.
This week, at its yearly Connect event, Meta showed how big it wants that idea to become. In the same week, Muse was blocked by Amazon, hit by a security flaw, and caught up in a report about hidden human workers.
Together, those stories raise a question that goes far beyond one app: when an AI starts acting on your behalf, who is really in control?
What Exactly Is Meta Muse?
Meta launched Muse in the United States on September 8, for adults only.
It is a personal AI agent. You give it a task in plain language, and it tries to finish the job. It can send emails, shop online, book travel, fill in forms and make phone calls to businesses. It can keep working even after you close the app.
Muse runs on Meta’s own AI model, called Muse Spark. You can use it through the Muse app, through WhatsApp, on the web, and on Mac computers. There is a free version, plus paid plans at $20 and $100 a month.
People have rushed to try it. Muse passed 2.5 million downloads in its first two weeks and topped U.S. app charts, according to Sensor Tower data cited by Reuters.
Meta Just Made Muse Bigger
At Connect 2026 on September 23, Meta announced a big expansion, according to Meta’s own summary:
- Muse is coming to Meta’s AI glasses in the coming months. You’ll be able to wake it by saying its name, and it will be able to act on what you are looking at.
- More shopping partners: Walmart, Best Buy, Sephora, Wayfair, Gap, Ulta and others, plus Shop Pay and PayPal for payments.
- Travel and groceries: Expedia is “coming soon,” and Instacart is being added.
- Work tools: Notion, GitHub, Box and Granola.
- Its own email address: Muse will get one, to get things done or as another way for you to reach it.
- Muse Charm: a small pocket device built just for talking to Muse. Meta has not yet given a price or date.
Put together, the plan is clear. Meta is not putting Muse inside one app. It is trying to put an AI agent between you and the rest of the digital world.
The AI Agent Can Spend Your Money
Muse doesn’t just find products. It can check out and pay.
Meta says it built this carefully. Payments go through services like Stripe’s Link, which creates a one-time card number for each purchase, so your real card number is never shared. Meta says Muse asks for your approval before sensitive actions like buying something or sending an email.
That sounds reassuring. But it leads to harder questions.
What if Muse buys the wrong thing? What if it misunderstands you and books the wrong date? Who is responsible then: you, Meta, or the shop?
A human assistant who makes a mistake can explain what happened. An AI agent can move fast, across many websites, and it is not always easy to see what it did or why.
Amazon Has Already Drawn a Line
On Sunday night, September 21, Amazon started blocking Muse from its website, a spokesperson told Bloomberg.
Anyone who tries to shop on Amazon through Muse now sees a pop-up message: “Continued access by an unauthorized AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”
Amazon’s complaint has several parts, according to GeekWire. It says Meta never got permission, that Muse doesn’t identify itself as a bot while browsing, and that it can move through customer accounts and appears to store login details. Meta has said Muse “has no visibility into people’s passwords or payment methods,” and that saved logins are kept in secure storage the AI itself cannot see.
It would be easy to turn this into a fight between two giant companies. The real issue is bigger:
When an AI agent becomes the customer, who decides whether it’s allowed in: you, or the shop?
You may be happy to let Muse shop for you. But the shop may not want an AI it can’t see or control moving through its website. That question will come up again and again as these agents spread.
Then Came the Security Questions
In the same week, security researcher Patrick Wardle found a flaw in Muse’s Mac app.
In simple terms, the flaw could let harmful software already sitting on a Mac hijack Muse’s voice feature and steal the codes that keep a user logged in. Meta fixed it within a day of it being disclosed, just before its Connect event.
How serious was it? That is still disputed.
- Meta’s position: the flaw could only be used by software already running on the computer. In other words, an attacker would need to have broken in first.
- Wardle’s position: a common trick that fools people into running harmful commands could get attackers that first foothold, which makes the risk more real than it sounds.
It is important not to exaggerate here. This was not an open door that let anyone on the internet take over Muse. And it was fixed quickly.
But Wardle’s wider warning deserves attention: “At the very least, they should be thinking about security from the very start, and they are just not,” he said, according to Techdirt. An AI agent with permission to use your email, apps and payments is a very attractive target for criminals.
When Muse Calls Humans
One of Muse’s features lets it phone businesses for you, to book a haircut, check if a shop has something in stock, or get price quotes.
There was a problem: some businesses hang up when they realise an AI is calling. One Meta employee said of his insurance company: “they keep hanging up on Muse when they hear it is AI.”
So Meta tried a fix. On September 22, Reuters reported, based on internal company posts, that Meta had been testing a “human concierge”: for some calls, a human contractor quietly placed the call instead of the AI.
It is important to be clear about who was affected. This was an internal test, switched on for about half of Meta’s own employees, with the option to opt out.
Still, some staff were uneasy. “We are one bug away from unnecessary information being leaked to human callers,” one employee wrote. Another said a transcript showed a contractor had made a racist remark during a call. A Meta vice president admitted it “was a miss” to start the test without proper disclosure, and said the feature had been “rolled back” for now.
A Meta spokesperson said employee feedback had been “overwhelmingly positive,” and that the company “will only roll it out when it’s ready and with the proper disclosures.”
This story shows something important. An AI agent may start the job, but humans can quietly end up doing part of it. And users may not know when that happens.
Meta Says Users Remain in Control
Meta’s side deserves a fair hearing. The company says Muse was built with safety at its core:
- You choose which apps and accounts Muse can connect to, and you can disconnect them at any time.
- Sensitive actions, like payments and sending emails, need your approval.
- Each user’s Muse runs in its own separate, secure computer space in the cloud.
- Passwords are stored separately, where Muse can use them without seeing them.
- Muse doesn’t share data with Meta’s advertising systems, the company says.
These are Meta’s own claims. Some, like payment protections, are built with outside partners. Others have not yet been tested independently. The past two weeks show why that testing matters: the security flaw and the human-caller test both came to light from outside researchers and a news investigation, not from Meta.
Why This Matters Beyond Meta
Muse is part of a bigger change in how people use the internet:
Search → Chat → Agent
- With search, you asked: “Where can I buy this?”
- With chat, you asked: “Which one should I buy?”
- With an agent, you say: “Buy it for me.”
It’s the same with travel. Instead of “Find me a flight,” you say “Book the best flight within my budget.”
That shift changes the relationship between people, websites and AI. Websites were built for humans to visit. Now software is visiting for us. Shops, banks and airlines will have to decide whether to welcome these agents, block them, or charge them. Amazon has already made its choice. Others will follow.
The Real Test for Muse
Muse’s success won’t depend on how clever it sounds. It will depend on three simple questions:
- Can it act reliably? An agent that buys the wrong sofa hasn’t saved you time. It has created a problem.
- Can users understand what it is doing? Including when a human, not the AI, is on the phone.
- Can companies trust it? Enough to let it into their websites and systems.
Meta’s biggest experiment with Muse may not be about whether AI can answer questions. It may be about whether people, and the internet itself, are ready to let AI act on their behalf.
By The Lion Capital Editorial Team | September 2026