On September 8, Meta released Muse, a personal AI agent app that crossed 900,000 downloads within six days and hit No. 1 among free apps on the US App Store. Roughly two weeks after launch, outside estimates put downloads at around 2.8 million. It knocked ChatGPT off the top of the charts. The numbers read like a hit, but behind them Amazon blocked Muse from making automated purchases, and an internal employee trial that had human agents step into AI-placed calls was pulled over disclosure problems. This piece isn't about a single product called Muse. It's about reading the direction of the market that this commotion reveals.
Going by Meta's official announcement, Muse isn't a conversation partner but a delegate. It sends emails, books trips, opens a browser to fill out forms, and even haggles on your behalf. Even when you close the app, the work keeps running in the background. It plugs into the domains of your digital life — email, calendar, payments, health, shopping, smart home — and carries out multi-step goals with minimal supervision.
Three things in the architecture are worth watching.
First, a dedicated execution environment. Each user gets an isolated, personal virtual computer in the cloud (the Muse Secure VM), with its own browser inside it. Meta explains that it "runs on a dedicated computer in the cloud, isolated so that no one else's agent can reach it." Passwords and payment details are stored in isolation, and before any sensitive action a separate watchdog agent (Sentinel) requires the user's approval.
Second, payments are baked in from the start. Stripe's payment service Link is integrated, and Muse is the first AI agent to fall under Link's buyer protection policy. According to TechCrunch's reporting, beyond Stripe, connectors have been added for Shopify, Walmart, Best Buy, Sephora, Gap, Wayfair, GitHub, Notion, and others, and developer connector applications topped 1,500 within a week of going public. Meta has also announced partnerships with Expedia and Instacart, but those integrations are billed as coming rather than live — Meta's Connect 2026 announcement lists Expedia as forthcoming, and Instacart says its Muse integration is arriving "soon."
Third, pricing is metered by tokens. Per CNBC's reporting, above a free tier there's a $20/month plan (500 million tokens per week) and a $100/month plan (3 billion tokens per week). Over the long run Meta talks about monetizing through transaction fees rather than subscriptions — a picture in which it takes a cut on every item the agent buys for you.
The two flare-ups over the first two weeks actually illustrate the nature of this market better than the download chart does.
A collision with platforms. According to multiple reports, Amazon blocked Muse from making automated purchases on its site, citing security and terms-of-service violations. This is no surprise. When an agent roams a storefront on your behalf, from the store's point of view there's no one left to see the ads and no one left to receive the recommendations. There's traffic, but no "person." The web's revenue model is built on the assumption of human eyeballs, and agents break that assumption. Over the next few years, every site will land on its own answer to "do we welcome agents as customers or block them as intruders" — and those answers will together map out the agent market.
A collision with trust. According to Open Data Science's reporting, Meta ran an internal trial with its own employees in which some of the calls Muse placed were handed off to human contractors — and when internal voices flagged that disclosure had been inadequate, the company pulled the experiment. It was never a feature shipped to regular users, but the very possibility that "a human might sit in on a call you handed to an AI" shows how delicate trust design is. Separately, the standing complaints in privacy criticism include that the option to use conversations for model training is on by default, that the memory feature can't be fully turned off, and that the app repeatedly nudges users to connect their email and bank accounts.
The common currency of both collisions is trust. Agents demand far deeper permissions than chatbots — mail, payments, documents — and the deeper the permissions, the higher the cost of a single mishap. The fact that Meta placed isolation-and-approval machinery like the Secure VM and Sentinel front and center in its announcement is itself evidence that the real barrier to entry in this market isn't model performance but trust design.
Look at Muse alone and it's product news; line it up against this year's trends and a direction emerges. That OpenAI and Anthropic are building the same class of agent is by now close to an industry-wide given.
1. From conversing to acting on your behalf. In the chatbot era the success metric was "was the answer right?" In the agent era it's "did the job get done?" Was the reservation made, was the refund filed, did the email go out. This shift changes product design from the roots. A wrong answer can just be asked again, but a wrong action has to be undone. That's why mechanisms like pre-execution approval, isolated environments, and action logs move to the center of the product.
2. The revenue model shifts from subscriptions to fees. Muse's token-metered subscription is a transitional model, and Meta itself is talking about transaction fees. Once the agent becomes the gateway to consumption, it takes the seat that search advertising used to occupy — between demand and supply. I'd argue that's exactly why Meta, an advertising company, drew a line about keeping its ad system separate from Muse data while still charging into this market at full force.
3. The distribution war has already begun. Muse's early download curve wasn't made by product strength alone. When a company with billions of users pushes an app, the curve comes out looking like that. In the personal agent market, the gap between the companies that hold distribution (smartphones, messengers, glasses, the OS) and those that only have a model will widen even further than it did in the chatbot era. Muse reaching into Meta's smart glasses and Mac desktop control is another step in expanding those distribution touchpoints.
4. Trust infrastructure becomes standardized. Isolated VM, an approval gatekeeper, buyer protection, action logs. The parts Meta listed in its announcement will soon become the industry's checklist. Just as browsers came to accept HTTPS as the standard, agents will come to accept "execution isolation + prior approval + after-the-fact auditing" as the standard. Put the other way around, an agent that demands deep permissions without these parts won't earn trust in the market.
ONTLE dispatches an AI project manager to organizations that work, not a personal assistant, so we don't share a customer base with Muse. And yet the design problems are strikingly the same: making an AI granted deep permissions finish its work without mistakes; deciding what to get approval for before acting and what to leave to its own discretion; verifying deliverables before they go out. Our putting a double-verification gate in the publishing pipeline and hard-wiring termination conditions and approval points into the execution loop, and Meta placing an approval gatekeeper called Sentinel at the heart of Muse, are two expressions of the same conclusion. Personal or professional, the decisive battle in the agent market is shifting from "how smart is it" to "how much can you trust it with."
Whether Muse's download curve holds three months from now is anyone's guess. Early curiosity demand and lasting demand are different things. But whether Muse succeeds or stumbles, this month confirmed that a product built on "handing an AI your card and your inbox" can draw enough interest to be installed millions of times. Installs aren't the same as usage, but where the market's attention is pouring has become clear.
As of launch it's available in the US on iOS, Android, and the web (muse.ai). No timeline for expansion to other regions is stated in the official announcement.
It's powered by the Muse Spark family, which Meta introduced as its most powerful model. For real-time avatar video conversations it uses a separate Muse Realtime Avatar model.
Muse is the first AI agent to fall under Link's buyer protection via its Stripe Link integration, and it's built to require approval before sensitive actions. That said, since some platforms like Amazon block agent purchases outright, "the machinery exists" and "it works everywhere" have to be treated as separate things.
Three things. First, whether major sites move toward allowing agent access or blocking it. Second, whether the transaction-fee model proves itself in actual revenue. Third, what rivals like OpenAI and Anthropic use to make up for their distribution disadvantage.