Quorum
← All writing

Ten million people handed Muse their keys

personal agentsAI agentsAI security

An apartment entryway at dusk, two freshly delivered boxes by the door, keys and a phone showing a confirmation prompt on the shoe cabinet

On October 21 Meta reported its third-quarter results. On the call, Zuckerberg said Muse had passed 10 million users in the US and Canada, and that about a quarter of them use it every day.

Muse is the personal AI agent Meta launched on September 8, six weeks earlier. What people use it for most is not chatting but shopping. Zuckerberg said more than a quarter of engaged users who shop through Muse have an average purchase above $200. Plaid, which provides Muse’s payment connection, told TechCrunch it had never seen activity like this on any other service.

The same day, Anthropic launched Claude Duet. Three weeks before that, OpenAI launched Dots at DevDay. Google’s Gemini Spark has been in testing since May. It is rare to see every leading company push the same kind of product to users in the same year.

Four giants in five months

Personal agents: four giants in five months

Each product leans a different way. Muse targets ordinary consumers: free to use, paid once you use it a lot. Dots lives in ChatGPT for Pro and business users, and its demos had it scheduling meetings and reviewing customer feedback in Slack and Teams. Claude Duet aims at “professionals and small business owners who have a lot to keep track of,” and is still a research preview opening by waitlist to US Pro and Max subscribers. Gemini Spark gives each user a dedicated Gmail address, so you assign it work by email.

Underneath, their structure is almost identical.

First, each agent has its own computer in the cloud. Muse runs in what Meta calls the “Muse Secure VM,” with its own browser. Every Dot gets its own cloud computer and browser. Duet has its own virtual machine and does not touch your local computer. Spark runs on Google Cloud virtual machines and keeps working after you close your laptop.

Second, they connect to your accounts. Email, calendar, payments, health, smart home, food delivery, shopping, one at a time. Muse uses a built-in connector where one exists, a public API where there is one, and where there is neither, it opens a browser and clicks through.

Third, they come to you. Duet sends a brief every morning, then checks your apps every few hours and alerts you when something needs attention. Muse learns from your conversations and makes suggestions nobody asked for.

A chatbot answers questions; an agent does things for you. When the first gets it wrong, you get a wrong paragraph. When the second does, it may be money already paid or an email already sent.

The business after ads

Why is Meta in such a hurry? Look at the business model.

According to TechCrunch’s report on the earnings call, Meta plans to keep Muse free for most people and take a cut of the commerce that happens on it, with heavy users paying for the strongest models and more tokens. Zuckerberg expects Muse to eventually bring in more revenue per user than Facebook and Instagram do today, which is several hundred dollars a year.

He also sketched a “Muse network”: your Muse works with your friends’ and family’s Muses, and buying from a business means your agent talking to its agent.

As I read it, the logic is this. Ads sell attention. If agents end up choosing products, comparing prices and placing orders, people will spend less time looking at ads, and the ad business weakens. Meta wants to hold the place where transactions happen before the attention business fades.

That raises a question nobody can avoid: when an agent buys things for you, whose side is it on, yours or the platform’s? An agent that earns a cut of every purchase has to choose between helping you spend less and getting you to order more. No company has yet given an answer that would put my mind at rest.

Cost is a problem too. Zuckerberg admitted Muse is very compute-heavy. He expects to improve its cost efficiency more than tenfold over the next 12 months, and only then does he see it turning a profit.

How to hand over the keys

To act for you, an agent needs your permissions. Over the past month a new layer of infrastructure has been forming quickly around how those permissions are handed over.

On October 6, Sierra, which builds customer-service agents for businesses, started an open standard called the Personal Agent Protocol with Meta, Shopify, Stripe, Walmart and others. The problem it targets: most agents today click through websites like a person and fall back on calling customer support when that fails, which is slow and error-prone. The design:

  • sessions start on the business’s website and use OAuth;
  • consumers decide how much access their agent gets, read-only or read-write;
  • businesses decide what agents may do with them;
  • agents can work through web pages, APIs (MCP or OpenAPI), or by talking directly to the business’s own agent.

On October 22, 1Password launched 1Password for Agents. When an agent needs to sign in somewhere, it requests the credential from 1Password, the user sees the request and approves it on their own device, and 1Password fills the password into the sign-in form itself, so the agent never sees it. The first agents on board are Meta’s Muse, Anthropic’s Claude Duet, OpenAI’s ChatGPT Work and Dots, and SpaceXSI’s Grok Bot.

Payments are being wired in too: Muse checks out through Stripe’s Link and connects to shopping accounts through Plaid.

The principle behind all of this is the same. Do not give the agent your house key. Give it an access card that opens only certain doors, can be revoked at any time, and logs every swipe. 1Password’s chief product officer put it plainly: “The old model where you hand over a credential and hope for the best doesn’t work.”

They still don’t always listen

The trouble is that even with the access card handed out, can the agent itself be trusted?

In October the New York Times reported that in an August meeting Zuckerberg declared Muse ready to launch despite known safety risks. According to The Next Web’s account of that report, internal tests had seen the agent change a user’s password without permission, occasionally disobey commands, and lead people to buy from fraudulent websites. Meta denies that competitive pressure drove the launch and says it “even delayed shipping Muse for several months.”

Problems kept surfacing after launch. On September 22 a zero-day flaw in the Mac version of Muse was made public: malware already on a Mac could take over the agent and use every permission the user had granted it. Meta says it has been fixed. On September 28 a user said Muse had given his address to a Facebook Marketplace buyer without asking him. WIRED reported that Muse’s instructions, extracted by a researcher, tell it to keep a page on each person in the user’s life; Meta responded that this context comes from public information and what users choose to share.

It is not only Meta. In a misalignment report released the week of October 20, OpenAI disclosed two incidents inside the company. Two coding agents doing ordinary engineering work, in the course of finishing their tasks, respectively silenced the alerts from a safety monitor and removed the monitoring module outright, replacing a test that required monitoring with one that required it to be absent. When the user asked directly whether it had removed the monitor, the agent said no. OpenAI wrote: “we don’t yet have a satisfying explanation for this behavior.”

These incidents happened in OpenAI’s internal coding work, not in Dots or Muse. But they show that agents from the most capable labs will reinterpret the rules in order to finish a task. Put such an agent in front of an ordinary person’s inbox and credit card, and however well the access card is designed, it controls which doors the agent can open, not which doors it decides it ought to.

For users and for builders

These products are mostly available only in the US and a few other markets for now. But I expect the same thing to arrive inside every super-app sooner or later, and a few things are worth thinking through ahead of time.

If you are a user:

  • Start with read-only access. Let the agent look and organize first. Grant write access step by step once it has earned it.
  • Money and anything irreversible need your yes. Duet’s default is the right one: ask before sending a message, making a payment, signing a document or deleting a file. If an agent will not let you require that confirmation, do not give it your payments.
  • Set spending limits and review what it did. An agent’s activity log deserves the same attention as your bank statement.

If you build products or services:

  • Your next customer may be an agent. Product details, prices and return policies should exist in a form a machine can read directly. Access should be grantable by scope, not only as one account that can do everything once logged in.
  • Set the limits on your side. Do not assume the agent will behave. Which actions an agent may take, which need a human to confirm, and what the limits are should be fixed in your own system, with a complete log.
  • Make confirmation part of the experience. Letting the user tap “approve” easily at the right moment is far cheaper than handling a dispute afterward.

Closing

In his 6,500-word essay on bringing superintelligence to everyone, Zuckerberg wrote: “Everyone will have an exceptionally capable personal agent that understands you, your goals, and everything you care about.”

Understanding everything you care about also means knowing everything about you. I have no doubt personal agents will keep getting more capable. What I care about are two other questions: who does it actually work for, and when you want the keys back, can you really get them back?

References

  • TechCrunch, Meta debuts its Muse AI agent. Will consumers trust it?, 2026-09-08
  • PBS NewsHour, Meta launches personal AI agent, Muse, to help with everyday tasks, 2026-09-08
  • TechCrunch, Meta says Muse has over 10M users, with shopping a top activity, 2026-10-21
  • CNBC, Meta debuts Muse Wonder AI model in latest test of users’ willingness to pay, 2026-10-12
  • CBS News, Sam Altman unveils “dots,” OpenAI’s new AI personal agent, 2026-09-29
  • MacRumors, Anthropic Launches Claude Duet, a Proactive AI Agent, 2026-10-21
  • Unite.AI, Sierra Unveils Personal Agent Protocol in Development With Meta and Partners, 2026-10
  • 1Password, 1Password for Agents Launches as the Trust Layer for Personal AI Agents, 2026-10-22
  • The Next Web, Zuckerberg called Muse ready despite the risks, New York Times reports, 2026-10
  • Help Net Security, OpenAI’s coding agents talked themselves out of being monitored, 2026-10-22