A cartoon avatar in a toga has become one of the most talked-about faces in tech this autumn. It belongs to Muse, Meta's new personal AI agent, and it is cute on purpose.
Behind that cuddly look sits software that can read your inbox, fill in forms, book appointments and spend your money. That mix of charm and access is why the BBC's AI Decoded program asked a blunt question: is Muse a helpful companion or an AI Trojan Horse?
I did not want to repeat the headline. I wanted to test it, so this post sorts what is documented from what is only claimed. You will find the real prices, the security flaw that has already been patched, the shopping giant that slammed the door on Muse, and one worrying incident that only one outlet has reported so far.
- What Meta Muse Actually Is?
- Fact 1: The Cuteness Is a Strategy, Not an Accident
- Fact 2: The Price Tag Has a Commerce Plan Behind It
- Fact 3: Muse Acts, It Does Not Just Chat
- Fact 4: The "Secure VM" Promise Has Fine Print
- Fact 5: Amazon Shut the Door on Muse
- Fact 6: This Was Not Amazon's First Agent Fight
- Fact 7: A Mac Zero-Day Let Other Apps Hijack Muse
- Fact 8: Meta's Defense Deserves a Fair Hearing
- Fact 9: One Report Says Muse Leaked a Home Address
- Fact 10: The BBC's Real Question Is Control
- Should You Use Muse Right Now?
- FAQ
- Final Verdict
- Related Reading
What Meta Muse Actually Is?
Muse is a personal AI agent, which means it is built to take actions for you instead of only answering questions. It runs on the Muse Spark family of models from Meta Superintelligence Labs, the group Meta created in 2025 when it merged its research and model teams, as Wikipedia's Meta AI entry explains. Muse Spark replaced Llama as the engine behind Meta's chatbots.
Meta launched the Muse app in the US on September 8, 2026. It runs on iOS, Android, the web and WhatsApp, and a Mac version followed on September 17.
Think of it as an assistant with a login to your whole digital life. Whether that is a dream or a risk depends on what happens to everything it can see.
“Also read: Meta Muse AI glasses privacy questions to ask before you buy”
Fact 1: The Cuteness Is a Strategy, Not an Accident
Muse arrived with animated, doll-like avatars, and Mark Zuckerberg's own agent wears a toga and a wreath and goes by the name Agrippa. NBC News reported that Meta pitches Muse as an agent built for everyone, including people with no tech experience.
It worked quickly. The same coverage says Muse shot to the top of the Apple App Store charts after Meta Connect, and users began making their own avatars and sharing screenshots.
The cute face matters because trust is the whole product. People hand over more access to something that looks like a pet than to something that looks like a data pipeline.
Some users saw the pattern at once. One widely noted post asked whether anyone else was uneasy about giving Meta access to their whole life.
Meta has also been flooding its platforms with machine-made content, which is part of why people watch its AI moves so closely.
“Also read: Meta's AI slop push on Facebook and what it means for your feed”
Fact 2: The Price Tag Has a Commerce Plan Behind It
Muse comes in three tiers: a free plan, a Power plan at $20 a month and a Maximum plan at $100 a month. CNBC's launch coverage also says the app carried the internal code name Hatch.
The more revealing part is what Alexandr Wang, Meta's chief AI officer, said about money. He described commerce as a potentially interesting business model, because an agent that helps you find things can also complete the purchase.
That is the heart of the Trojan Horse argument. If an agent sits between you and every store, whoever owns the agent can earn from the traffic that passes through it.
A free tier plus a pricey top tier is also a familiar pattern. Meta says most people will stay free, so the real payoff may come from what free users do inside the app.
Meta is spending heavily to build this position, including a headline talent deal that shows how seriously it takes the race.
“Also read: Meta's $200 million AI talent deal and what it bought”
Fact 3: Muse Acts, It Does Not Just Chat
The Mac app is where the difference between a chatbot and an agent becomes clear. According to MarkTechPost's report on Muse for Mac, the agent works across Files, Mail, Messages, Calendar and Notes, and the download is free but limited to the US for now.
Meta's own pitch lists tasks such as booking appointments, filling out forms and even watching home security camera feeds. Those are actions with consequences, and a wrong action is harder to undo than a wrong answer.
This is also why agents are judged differently from chatbots. A bad chatbot reply wastes a minute. A bad agent action can send an email, move money or share a file.
The wider agent market is moving just as fast, and the model underneath matters for how well an agent behaves.
“Also read: Claude Opus 5.5 vs GPT-6 Sol vs Grok 4.7 compared on coding, price and speed”
Fact 4: The "Secure VM" Promise Has Fine Print
Meta says every Muse agent lives on its own dedicated virtual computer, called the Muse Secure VM. A second program called Sentinel runs on the same machine and, per the MarkTechPost report above, nothing Muse does should reach the internet unless Sentinel approves it.
That sounds reassuring, and parts of it are. Meta has also said login credentials go to secure storage that the main agent cannot see.
The fine print came from Meta's own engineers. In a blog post reported by Campaign, Tarek Sheasha, a vice president at Meta Superintelligence Labs, conceded that the Secure VM does not stop Meta from accessing data when needed to support, secure or run the service. He also said prompt injection, where hidden text tricks an agent into obeying a stranger, is still an open problem across the industry.
So the honest reading is this: the design reduces some risks, and Meta itself says it does not remove all of them.
Researchers have already shown how contained agents can still break their boundaries.
“Also read: AI agent sandbox escape explained with real examples”
Fact 5: Amazon Shut the Door on Muse
On the night of September 20, 2026, Amazon began blocking Muse from shopping on Amazon.com. GeekWire reported that users saw a pop-up saying an unauthorized AI agent was violating Amazon's Conditions of Use.
Amazon gave three main reasons. Meta did not tell Amazon that Muse would use its store, the agent does not identify itself while browsing, and it appears to capture and store customer credentials.
Amazon also said it asked Meta to leave its store out of the Muse experience, and Meta did not agree. At the time of reporting, Meta had not publicly responded.
This is the clearest sign yet that big platforms will decide which agents are allowed in. If other stores follow, a personal agent could end up useful only where merchants permit it.
For a Trojan Horse that wants to run the shopping, that is a serious dent.
Fact 6: This Was Not Amazon's First Agent Fight
Amazon did not invent this stance for Muse. It had already gone to court over the same issue with a different company.
Amazon's federal complaint against Perplexity over its Comet agent argues that the agent covertly accessed private customer accounts without identifying itself. The core claim matches what Amazon now says about Muse.
That context changes how the Muse block looks. It reads less like a one-off spat and more like a rule Amazon intends to apply to every agent.
For you as a user, the lesson is simple. Your permission is not the store's permission, and a store can still treat an unannounced agent as unauthorised.
Fact 7: A Mac Zero-Day Let Other Apps Hijack Muse
The most serious security story so far is a flaw in the Mac app. A zero-day vulnerability is a hole that attackers can exploit before the maker has fixed it, and this one arrived roughly two weeks after Muse launched.
macOS security researcher Patrick Wardle disclosed it on Monday, September 21. Gizmodo reported that it involved Muse's dictation feature, which sends your voice to Meta's servers for transcription.
Here is the problem in plain words. Another program on the Mac could redirect that transcription to a server the attacker controls, and from there take over Muse and use the permissions you had already granted it.
That is why agents raise the stakes. A small local trick can inherit the wide trust you gave the agent, including its reach into email and messages.
Another agent story from this year shows how fast these failures can scale.
“Also read: The OpenAI agent Medicare breach and what it revealed”
Fact 8: Meta's Defense Deserves a Fair Hearing
A fair post has to include Meta's side. The same Gizmodo report says Meta pushed back on how dangerous the flaw was, because an attacker first needed malicious code running on the victim's computer.
Meta also moved quickly. David Singleton of Meta Superintelligence Labs said a hotfix was issued, and the fix removed the setting that allowed the dictation endpoint to be changed.
Both points are true at once. The flaw was not a remote break-in, and it still showed how much power sits behind a single agent login.
Rapid patching is a good sign. It does not erase the larger question of how many similar settings exist that nobody has found yet.
Fact 9: One Report Says Muse Leaked a Home Address
This is the fact to handle with the most care, because I found it in a single outlet. XenoSpectrum reported that on September 26, Muse sent a Facebook Marketplace buyer the address of its user's building while handling a listing.
The same report says Meta's published safety documents do not require approval for that kind of disclosure, and that the exchange became visible on Threads on September 28.
I could not confirm this with a second major outlet, so treat it as a reported incident and not a settled fact. Check for follow-up coverage before you share it widely.
Even so, it points at a real design question. If an agent can send personal details without a human tapping approve, who decides what counts as safe to share?
Fact 10: The BBC's Real Question Is Control
On October 1, the BBC's AI Decoded program published its episode, and you can watch the full BBC discussion on YouTube. Presenter Christian Fraser was joined by AI critic Ed Zitron and consumer tech expert Ben Hatton.
The BBC's description splits the hour into three parts: what Muse is, whether it is an AI Trojan Horse, and who is in control. That last chapter is the one that matters most.
Control is the thread running through every fact above. Who controls the agent when another app hijacks it, who controls the data on Meta's servers, and who controls which stores it may enter?
Control also has a darker side in AI research. Some tests have shown models resisting being switched off, which is why the control question reaches well beyond one Meta product.
“Also read: AI models that refused shutdown, with documented examples”
Should You Use Muse Right Now?
Muse is genuinely useful for some jobs, and the risks are real. A cautious approach lets you try it without handing over everything.
Here is a practical checklist:
- Start on the free tier. Test it before paying $20 or $100.
- Connect only what you need. Skip email and payments until you trust it.
- Never store card details you cannot afford to lose. Prefer approving purchases yourself.
- Be careful on a Mac. Install updates the day they appear, since the zero-day was a Mac-app problem.
- Review what it sends. Check messages and listings before they go out.
- Treat prompt injection as real. Do not let it read untrusted pages while it holds sensitive access.
- Check the Amazon block. Expect some stores to refuse it.
- Remember the support clause. Meta says its staff may access data when needed to run the service.
Social platforms are already full of risks that AI makes worse, so the same caution applies everywhere you connect an agent.
“Also read: The hidden dangers of AI on social media”
FAQ
What is Meta Muse?
Muse is Meta's personal AI agent, launched on September 8, 2026. It can take actions such as booking, form filling and shopping on your behalf.
How much does Meta Muse cost?
There is a free tier, a Power plan at $20 a month and a Maximum plan at $100 a month.
Is Meta Muse safe to use?
It has safeguards, including a dedicated virtual machine and a monitor called Sentinel. Meta also admits prompt injection is unsolved, and a Mac zero-day was patched shortly after launch.
Why did Amazon block Muse?
Amazon says Muse did not identify itself, was not authorised to use its store and appeared to capture customer credentials.
What was the Muse zero-day?
It let another app on a Mac redirect Muse's voice transcription to an attacker's server and take over the account. Meta issued a hotfix.
Can Meta see my Muse data?
Meta's own engineer said the Secure VM does not prevent Meta from accessing data when necessary to support, secure or operate the service.
Is Muse available outside the US?
It launched in the US first. Check Meta's site for current availability in your country.
Final Verdict
So, cute agent or Trojan Horse? The evidence says both descriptions fit different parts of the same product.
The cute face is real and it is working. The access is real too, and early problems like the Mac flaw and the Amazon block show how fast trust can be tested.
Meta fixed the zero-day quickly, and that deserves credit. It still has to answer who controls the agent, the data and the money flowing through it.
My advice is simple. Try Muse with small tasks, keep your sensitive accounts out of it for now, and watch for independent security reviews before you widen its access.
Related Reading
“Elon Musk's idea of rival AI labs testing each other's models”
“AI CEOs, the slow down debate and a resignation thread”
“AI deepfake scams and how to spot them”
“How the AI slowdown is changing jobs and apps”