Meta Muse AI Agent Sparks Fight Over How Bots Deal With Business

From answering questions to doing the work

Meta launched Muse in the US on September 8. It is a personal AI agent that does not just answer questions. It carries out tasks for the user: sending email, managing calendars, booking travel and filling in forms.1 It is limited to users 18 and older, and it comes with a free tier plus two paid plans, Power at $20 a month and Maximum at $100.1 Meta calls it "the world's first personal AI agent built for everyone." That is a claim about a whole product category, not a feature update.12

Early adoption looks strong. One account says Muse pushed ChatGPT off the top of the US App Store within ten days.8 A launch timeline citing Sensor Tower puts US downloads above 2.5 million by September 23.1 By early October, Meta executive David Singleton said Muse had millions of US users.23

The consumer launch matters, but the bigger story for enterprises is what has happened since. Within a month, Muse ran into the world's largest online retailer. It moved into small-business software. And it pulled Meta into a coalition writing rules for how autonomous agents should deal with companies. That sequence is the clearest preview so far of where agentic frameworks are heading.

How the agent is built

Muse runs on Meta's Muse Spark 1.3 model.6 Each user gets a dedicated virtual machine in Meta's cloud, called Muse Secure VM, and a separate gatekeeper reviews what data can leave it.1317 That gatekeeper is a monitoring agent called Sentinel. It watches outbound activity, lets low-risk steps run on their own, and stops for user approval on high-risk actions such as sending email or making a purchase.6 Payments go through Stripe's Link, which can create a one-time card number so the agent never handles a user's real card details.16

In hands-on reviews, the pattern is that Muse works and that this is exactly what makes people uneasy. A TechRadar reviewer called it remarkably capable at digital errands but said it needs an unsettling amount of personal access to be useful.7 The Verge's tester saw the agent find quotes from junk-removal companies and book one with little effort. She also found that once her card was connected, approving purchases became "dangerously easy."9 CNN's test, as summarized elsewhere, praised Muse's planning but caught it recommending restaurants that had closed years earlier.8

The sharpest criticism concerns phone calls, the hardest part of real-world errands. Reuters reported, via Gizmodo, that Meta tested a "human concierge" that sent some tasks to human contractors when the AI voice failed. One user said his insurer kept hanging up once the bot said it was not human.10 A Meta Superintelligence Labs vice president reportedly called the contractor test "a miss" and said the feature had been rolled back. The same executive said human involvement pushed call success rates into the high 90s, compared with a lower rate for AI-only calls.10 My reading is that this shows where autonomy currently stops. Companies on the other end of the line still treat machine callers as unwelcome.

The Amazon wall

That friction became a public fight on September 20, when Amazon blocked Muse from shopping on Amazon.com. Muse users now see a popup saying that access by an unauthorized AI agent violates Amazon's Conditions of Use.31 Amazon made three complaints. It says Meta never told it Muse would access the store, the agent does not identify itself while browsing, and it appears to capture and store customer credentials.31 Meta's launch materials say Muse cannot see passwords or payment methods and that credentials sit in secure storage.32 One review of the dispute notes that both claims can be true at once. The agent may never "see" a login that is still being stored and used on the user's behalf.

The legal backdrop explains why Amazon used a popup rather than a lawsuit. On August 4, the Ninth Circuit threw out Amazon's preliminary injunction against Perplexity's Comet agent. The court found that when an agent follows a user's instructions, the user is the one accessing Amazon under federal anti-hacking law.31 That ruling left contract and terms-of-service claims open, and the Muse popup relies on exactly those terms.3138

Coverage splits on motive. Several outlets point to money: Amazon earned more than $68 billion in ad revenue last year, and an agent that skips sponsored listings threatens that.3134 Tech Times goes further. It argues that Amazon's own Buy for Me agent shopped third-party retailers without their consent and made merchants opt out, which is the reverse of the standard Amazon is now applying to Meta.33 Meanwhile, Shopify took the opposite approach and announced a Shop Pay integration so Muse can check out at Shopify-powered stores.33 The dispute is still unresolved, and as of mid-October nothing has surfaced that would let outsiders verify either side's technical claims.36 The early effects on sales are anecdotal but telling. One fintech co-CEO told Business Insider that Muse has steered his niche purchases away from Amazon.3

The enterprise turn: Muse for small business

On September 29, Meta pointed Muse at businesses. It added integrations with Asana, Box, Canva, Dropbox, Figma, HighLevel, Intuit QuickBooks, Klaviyo, Lovable, Shopify, Slack, Stripe and Zoom, along with Facebook and Instagram business accounts.6 That moves the agent from personal errands to running a storefront, checking the books and drafting marketing campaigns.6 Meta has also launched its Meta Business Agent globally. It handles customer inquiries, product suggestions and transactions on WhatsApp, Instagram and Messenger.23

For enterprise buyers, the main limit is the safety model itself. Because approvals happen one action at a time, the agent can only move as fast as its human approves. One analysis argues that this makes Muse a poor fit for work that has to continue while the owner is in a meeting, or that spans shared inboxes.6 That trade-off is common across agentic AI products this year: wide freedom for low-stakes steps and a hard stop before anything irreversible.12 Muse's competitors are taking different positions. A comparison lists OpenAI's Dots as aimed at work projects through ChatGPT, Slack and Teams, with rules that allow, require approval for, or block specific actions, while Muse targets everyday life admin.5

Personal Agent Protocol: rules for agents dealing with businesses

The most important development for enterprise architecture came on October 6. Sierra and Meta announced the Personal Agent Protocol, an open standard developed with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It covers how personal agents authenticate with businesses and what those businesses let them do.21 Sessions are built on OAuth. An agent can start as a guest and then sign in with read-only or write access. Each company decides whether agents reach it through its website, its APIs (using standards such as MCP and OpenAPI) or its own customer-service agent.21

The effort is led by Bret Taylor, Sierra's co-founder and OpenAI's chairman. He told CNBC it is "kind of chaos" until such a standard exists, because businesses cannot reliably tell an agent from a human.23 Singleton compared the goal to email, a standard everyone can use to communicate.23 Meta put its case to merchants bluntly: turning away a personal agent means turning away the customer behind it.27

The timing points at Amazon. The protocol arrived sixteen days after the block began, and Amazon's core complaint, that agents do not say who they are, is the problem it is meant to solve.27 Coverage differs on the details, though. Reports disagree on the partner list: CMSWire's version of Meta's list adds NiCE and Decagon and leaves out Instinct.27 Stripe and Shopify have also joined a rival Trusted Agent Protocol run by Visa.22 Decagon published its own consent protocol, PACT, the same day while saying it would join the Personal Agent Protocol working group.27 Payments are listed only as a future extension.22 No governing body or license has been named.27 OpenAI and Anthropic are not listed as participants.24

The takeaway

My reading is that Muse's real significance lies less in the consumer app than in what its launch forced into view. Agents that browse like humans get blocked. Agents that call like humans get hung up on. And businesses are no longer debating whether to deal with outside agents, only on whose terms. The protocol is a sound place to start, because a payment standard is useless if a merchant doesn't know who is asking.27 But until a v0.1 specification ships and companies such as Amazon either adopt it or explain why not, it remains a statement of intent.26 For enterprises, the practical step is the one analysts suggest: list which read, write and money-moving actions you would let an agent take, before agents start showing up uninvited.26