What users entrust to Meta when Muse acts on their behalf

Amazon’s reported decision to block Meta’s new personal AI agent from shopping on its site was not presented as a response to a security failure. It was about permission.

On 22 September, The Wall Street Journal reported that Amazon had blocked Muse from shopping on its site. According to the Journal, Amazon said the access had not been authorised in advance. The report did not establish that Muse was unsafe, and the technical method used to block it was not available in the reviewed material. But the episode exposed a basic limit on the promise of a personal agent: the user and the agent’s provider are not the only parties with a say. The services an agent visits can also refuse to participate.

That matters because Muse is designed to do much more than generate answers. Meta says it can open a browser, complete forms, send email, book travel, make purchases and continue a task after its app has closed. Every step away from conversation and towards action increases the importance of who holds the credentials, which permissions remain active and what happens when the agent encounters hostile or misleading content.

Meta announced Muse on 8 September 2026 and said it was rolling out in the United States on iOS, Android and the web, with access through the Muse app or WhatsApp. Ten days later, Axios reported that it had become the number one free iPhone app in the country. That ranking demonstrated rapid attention, but it did not reveal retention, active use or how many people connected sensitive accounts. Early adoption and durable trust are different measurements.

From answering to acting

A chatbot can produce a proposed itinerary or draft an email. An agent that books the trip or sends the message needs both information and authority. That coupling is central to Muse’s appeal and its risk surface. Useful personalisation requires private context, while useful action requires a route from the agent into external accounts and websites.

Meta says each user’s Muse operates inside a dedicated cloud virtual machine with its own browser. Connected service data and credentials are stored in that environment. Its published architecture separates the main agent runtime from credential storage and the workers that communicate with connected services.

A component called Sentinel is, according to Meta, the sole authority for connector actions and outbound network access. The main agent receives surrogate credentials rather than real ones. This distinction means it is imprecise to say users simply hand their passwords to the AI model. Meta’s design instead places those credentials in separate storage within infrastructure that Meta operates.

Meta’s account also describes controls intended to reduce exposure during sensitive interactions. The company says the email connector filters one-time codes, password-reset links and login links. The browser agent pauses when a user takes control or enters credentials. These are substantive design measures, although the reviewed material contained no independent audit establishing how effectively the complete launch system implements them.

Permission is not a single switch

According to Meta, Muse offers one-time, session, task, time-bounded and perpetual approvals. In principle, those options allow a person to grant narrow authority rather than unrestricted access. Meta also says some read-only, previously permitted or low-risk actions can proceed without a fresh prompt.

The resulting control model is more complicated than a simple choice to connect or disconnect an account. Permission to read information is different from permission to send, buy or change something. A one-time approval has a different exposure period from a perpetual one. The relevant question is not only whether Muse has access, but what kind of action it can take, for how long and whether another confirmation is required.

Approval prompts provide a checkpoint, not proof that an action is safe or correctly understood. Meta acknowledges that Muse can make mistakes, is not immune to attack and remains exposed to the wider industry’s unresolved prompt injection problem. The company’s isolation, network controls and approval system are therefore layers intended to constrain what can happen. They do not establish that manipulation or error is impossible.

Meta also says it opened a public bug bounty offering up to US$300,000 for valid reports. That creates a channel for outside researchers, but it does not replace an independent assessment of the system. None was available in the reviewed sources.

Several meanings of private

Meta presents Muse as private, but that description needs to be divided into separate questions. Data can be excluded from an advertising system yet still be accessible to the service provider. It can be withheld from one use while remaining available for model training. Operational restrictions on employee access are not the same as cryptographic prevention.

At launch, Meta said operational controls restricted personnel access to Muse environments. The standard architecture nevertheless did not cryptographically prevent the company from accessing virtual machine data when necessary to support, secure or operate the service. Meta said it planned a Confidential VM for later in 2026, which it said would cryptographically prevent the company from accessing data in a user’s environment. That was a promised future architecture at the evidence cutoff, not a protection available for assessment in the launch product.

Meta also says Muse conversations and virtual machine data are not shared with its advertising systems. At the same time, it notes that browsing and transactions conducted by Muse can indirectly affect the advertising a person sees. Those statements concern different data paths. The first addresses direct sharing with advertising systems; the second concerns the indirect advertising effects of actions taken through websites and Meta services.

Model improvement is another distinct use. Meta says sanitised conversation, tool-call and subagent trajectory data are used for training by default, with an in-product option to disable that use. Sanitisation and an opt-out are controls, but the reviewed sources did not include an independent privacy audit of that process.

The website has a vote too

The reported Amazon block adds a third layer of control. A user may authorise Muse to shop and Meta may provide the technical machinery, but an outside service can still decide that the agent is not welcome. The Journal attributed Amazon’s objection to a lack of advance authorisation, not to a demonstrated compromise or security failure.

This makes agent access partly a question of platform consent. A service controls the environment in which the agent is attempting to act, while the agent provider controls its own architecture and the user controls account permissions. Muse’s practical reach depends on all three aligning. Its capability cannot be inferred solely from a feature list.

For users evaluating that arrangement, the most informative questions are concrete. Does a connector provide read authority, write authority or both? Is approval granted once, for a particular task or indefinitely? Can model-training use be disabled? Does the provider retain operational access to the agent’s environment? Are consequential external actions presented for confirmation?

Starting with the narrowest available permission preserves more control than granting perpetual authority at the outset. The distinction is particularly important for connectors that expose private communications or permit external action. Yet the value of these controls still depends on whether people understand their scope. The reviewed research found no independent usability study showing how ordinary users interpret Muse’s approval choices.

Muse was announced for the United States, and no Australian availability date appeared in the material reviewed. Even so, the framework is not country-specific. Credential custody, provider access, training defaults, scoped permissions and website participation are properties by which any consumer agent can be judged.

An App Store lead can show that people are curious enough to install an agent. It cannot show how many will keep using it after examining what the agent must read, retain and control. The more useful measure of trust will emerge after the novelty fades: whether people can preserve meaningful authority over an agent that has been built to exercise authority for them.

Delegated authority sits at the intersection of user permissions, provider infrastructure and website participation. Place those trust boundaries in a broader technical context with The Hack Academy's online cybersecurity training programme, which offers self-paced learning in cloud security, networking and cybersecurity fundamentals, with practical exercises alongside theory.