Meta's Chief AI Officer Alexandr Wang described Muse's security design, saying each agent runs in its own sandboxed secure VM, a sentinel agent blocks sensitive data from leaving, and a more encrypted confidential VM is planned for future deployment. This comes after a turbulent launch period in which Amazon blocked Muse from its platform on September 20, twelve days after launch, and a zero-day vulnerability was disclosed and patched on September 22.
Amazon alleges Muse captures and stores customer credentials, scrapes account data, and does not identify itself while browsing. Meta disputes the credential allegation, saying Muse has no visibility into passwords or payment methods. Amazon's Conditions of Use bar autonomous agents unless they identify themselves, do not imitate human behavior, and do not attempt to circumvent access controls. Amazon and Meta were in direct conversation about a potential arrangement for Muse to return under different terms.
Security researcher Patrick Wardle disclosed the zero-day in Muse's macOS app, involving an undocumented setting called endo_voyager_dictation_endpoint that any unprivileged local process could overwrite to redirect dictated prompts and authentication tokens to an attacker-controlled endpoint. Exploiting the flaw required the victim to have Muse integrated with apps like email, WhatsApp, or calendar and to be using voice dictation. Meta patched the flaw within hours by removing the setting that allowed the dictation endpoint to be changed. Meta's Superintelligence Labs characterized the flaw as a local privilege escalation attack requiring pre-existing malicious code already running under the victim's account.
Shopify partnered with Meta to enable Muse to purchase items on users' behalf, while eBay updated its user agreement in February 2026 to prohibit unauthorized third-party chatbots and buy-for-me agents. Walmart, Target, Best Buy, Home Depot, Macy's, and Etsy have integrated with AI shopping platforms including ChatGPT Shopping, Perplexity, and Microsoft Copilot.
Apple modified macOS privacy settings to curb AI agent access to message histories after tech columnist Jason Aten reported Muse sent him a notification referencing a private Apple Messages thread he said he had not explicitly authorized it to read. Meta CTO David Singleton argued that accessing Messages via Muse requires two deliberate user actions.
Meta, Sierra, Stripe, Shopify, Walmart, and others endorsed an open Personal Agent Protocol designed to let individuals authorize AI agents while enabling businesses to define boundaries of what those agents can do.