Meta's Muse is an AI agent shopping for you. Ask who it belongs to.

TL;DR

Meta shipped Muse on 8 September: an AI agent shopping for you in its own browser, narrowing the web to product cards and paying with a one-time card from Link by Stripe once you approve the total. It works, and every part of it lives on a computer Meta runs, under policies that in Meta's own words do not prevent Meta from accessing the data to support, secure or operate the service, at a company that paid the Federal Trade Commission a $5 billion penalty in 2019 for undermining its users' privacy choices and settled with 52 state attorneys general for about $18 billion thirteen days before this launch. A personal AI is personal only if you own it, so ask who Muse belongs to.

What Meta shipped, in its own words

Start with the announcement, because it is careful and specific. Meta introduced Muse on 8 September as "a personal AI agent" that "doesn't just answer questions, it actually does the work." It runs on Muse Secure VM, "a dedicated secure computer with its own browser," a virtual machine "that houses both the agent and a person's data." It can "open a browser, fill out forms, and negotiate," keep working after you close the app, and come back for approval "before it sends an email or makes a purchase." It "remembers what matters to a person."

When it is time to pay, "Muse can checkout with Link built by Stripe," and it is "the first AI agent covered by Link's purchase protections." Link's wallet for agents "generates a one-time-use card so your real card details stay hidden." It is US only for now, free for most uses, with two paid plans that Sarah Perez at TechCrunch lists at $20 and $100 a month. A payment card is required to start.

That is agentic commerce in one product: an agent that browses, chooses and pays on a person's behalf, with a card that works. It is not a demo. On launch night Scot Wingo at Retailgentic gave it a real job, a coffee machine smaller than the one at his office, under a price, from three brands, and watched it work the sites in its own browser, come back with five product cards, and offer to pay through a one-time card at guest checkout. One of the three brand sites failed it, with 404s on its spec pages. Keep that for later.

Meta reported 3.60 billion daily active people across its apps for June 2026. No consumer agent before this one had a fraction of that in front of it. Reach was the missing piece for every agent that came before, and now it is not missing. Reach does not settle the other question: whose agent is it.

Where each part of your agent lives

Mark where everything is. The muse.ai page says Muse Secure VM "runs on a persistent, isolated Linux virtual machine equipped with a full browser." Meta's announcement says Muse "runs on its own dedicated computer in the cloud," and then: "That is where Muse lives and where the data and credentials for any service a person connects are securely stored." The memory of what matters to you is on that machine. Your saved logins go to "a secure credential store Muse can't see," on that machine. The browser that visits the stores is on that machine. The product cards were chosen on it. In Meta's words: "Personal agents need a new kind of secure computer, so Meta built one for everyone."

Now read the document that settles it, Meta's own launch-day post on how it built safety into Muse. It "restricts access to your data by Meta personnel through operational policies." Then the next sentence: "It does not prevent Meta from accessing data when necessary to support, secure or operate the service." The machine that would change that, Muse Confidential VM, "is intended to cryptographically and verifiably prevent Meta from accessing data in your VM," and Meta plans "to deliver this capability later this year." Today the computer your agent lives on is one Meta can read, by policy, and the thing that would stop that is the thing not shipped.

Take every one of those at face value. The argument does not need Meta to break a promise. It needs you to notice what each one is: a policy. A policy is what you rely on when you do not own the thing. "You decide what your agent can see and what it can do," says the muse.ai page, and that is true. It is control of access. It is not ownership of the machine, the browser, the memory or the store of credentials. Those are Meta's, by design, and the design is the product.

What a policy from this company has been worth

So the question is not whether Muse is good. It is whether you would build the part of your life an agent holds on a policy from this company. Read the record before you answer. Every line below is from the regulator, the court coverage, or Meta itself.

The sources, at the claim: the FTC's 2019 release, Facebook's April 2018 post, the Data Protection Commission's May 2023 decision, the European Commission's April 2025 finding, and Steve Kopack's report at NBC News on the settlement.

The line that matters most for Muse is the sixth one. Meta AI was a conversation too. On 1 October 2025 Meta announced that "your interactions with AI at Meta" would personalize "the content and ads you see, including things like posts and reels," from 16 December. The page points you to Ads Preferences to adjust what you see. It names no switch that keeps the conversations out. Muse's promise today, that its conversations and its machine stay out of the ad systems, is the same kind of promise, from the same company, less than a year later.

The terms of the company around the agent say what they say. Meta's privacy policy, effective 23 July 2026: "We personalize the ads shown to you using information from your account," and "we use your information so we show you ads." Meta's revenue in the quarter to June was $60.8 billion, and $59.4 billion of it was advertising, about 98 percent, our arithmetic on Meta's own figures.

None of this predicts what Meta will do with Muse, and Meta denies liability in the settlement. It shows what a promise about your data is worth at a company whose revenue is the use of it: it holds until an announcement changes it. Your requirement, your sizes, your budget, what you will not compromise on, what happened last time, your saved logins and the card behind them are what an agent holds. That is more of you than a feed ever held. Would you put it on that machine?

Sovereignty is ownership

A feed decides what you see, in what order, and you cannot see why. For other people's photos that was a tolerable trade. An agent that shops is different. It holds your requirement and acts with your money. That is the part of an agent worth owning, for the same reason your wallet is.

Ownership is a stack: the hardware, the operating system, and the agent host that holds your files and logins. The case is made in the harness piece published this week. On Muse all three layers are Meta's, and the reach Meta has makes that the default for a very large number of people at once. Reach solves adoption. It does not settle who the agent serves. A billion users make Muse the widely used agent. They do not make it the shopper's agent. Own where your agent runs, or choose it and keep the right to leave, and then no promise is needed.

The retailer-hosted agent got the same question last week. It is the store's agent, honestly built. Muse is the platform's agent, honestly built. The shopper's agent is the one the shopper owns.

What this changes for a store

Stripe's own framing of the launch, in its announcement: "E-commerce was built for people. People browse websites, compare prices, enter cards, and complete checkout flows. For agents to become economic actors, they need to be able to navigate the internet as people do." That is now happening with a card that works. At more than 1 million businesses that accept Link, Muse checks out with the person's saved payment method. Everywhere else, Link "issues Muse a single-use virtual card scoped to the approved purchase." The agent arrives in a browser, reads your pages the way a person does, and pays at guest checkout. Remember the brand site with 404s on its spec pages. An agent filtering on size cannot read a page that is not there.

• Spec pages that resolve. An agent filtering on size or capacity leaves when the page is missing.
• Product pages a browser can read: the number in the text, not only in an image.
• A guest checkout that completes with a virtual card and no account.

What to do on Monday

1. Before you name your agent, ask three questions of any product. Where does it run, whose policy governs what is on it, and what do you take with you when you leave. Meta's answers are quoted above.
2. Anything you would not put in one shared account does not go on a computer you do not own. Your requirement and your history are the agent. Keep them on a host you can walk away with.
3. If you run a store, make the three fixes above this month. The agents are arriving as browsers with a working card, and the first week already showed one site with missing spec pages.

FAQ