Meta Muse Has One Small Problem: You Have to Trust Meta

I have developed a small ritual whenever an app asks for permissions.

Camera? Maybe.

Location? While using.

Contacts? Absolutely not. I have seen my contacts.

Meta’s new personal AI agent, Muse, is asking for something rather more ambitious. It would like access to your email, calendar, shopping, payments and other services so it can actually do things for you. Not suggest things. Not produce a charming bullet list titled “Here are five ways to save time.” Do them.

According to Meta’s launch announcement, Muse can open a browser, fill forms, negotiate, keep working after you close the app and return when it needs approval before sending an email or buying something. It can remember details you mentioned once and use them later.

We have moved remarkably quickly from “Facebook knows I looked at a jacket” to “Facebook would like permission to negotiate the jacket.”

That is not an upgrade to the chatbot. It is a change in the contract.

The internet used to want your attention

For most of the consumer internet era, the bargain was simple. Platforms wanted us present.

Look at the feed. Click the link. Watch the video. Open the product page. Abandon the cart. Receive seventeen reminders that the cart remains emotionally devastated by our absence.

Meta became exceptionally good at this economy. Facebook and Instagram learned to predict what might hold our attention long enough for an advertiser to rent a little piece of it.

Muse points in almost the opposite direction.

The promise is: tell me what you want, then leave.

Meta spent twenty years perfecting software that says stay here. Now it has built software whose selling point is go away, I’ll handle it.

A platform that works while you are absent needs a different currency from attention.

It needs authority.

Chatbots needed trust. Agents need power of attorney, apparently

There is a large psychological difference between allowing software to answer a question and allowing it to act.

If an AI tells me a restaurant is excellent and it turns out to serve pasta with the texture of office stationery, I can blame the AI and continue with my life.

If an agent books the wrong flight, sends the wrong email, exposes private files or buys something I did not intend to buy, the mistake has escaped the chat window and entered reality.

The risk has changed from bad information to bad action.

That is why Meta’s security architecture deserves attention. Meta says each Muse runs inside a dedicated Secure VM. A separate Sentinel agent sits between Muse and the internet and approves its actions. Credentials are stored so Muse can use them without seeing them. Sensitive actions require approval, and users get an audit trail.

This is not the usual “your privacy is important to us” paragraph inserted immediately above twelve tracking partners. It is a serious attempt to solve a serious problem.

Unfortunately, reality has already RSVP’d.

The guard dog appears to have eaten a slipper

Reuters reported that internal Meta testing uncovered security and reliability failures around Muse, including exposure of sensitive data and inconsistent performance. Meta says errors remain possible and that the product met minimum safety standards after its launch was delayed for more security work.

This is more interesting than a standard privacy panic because both things can be true.

Meta may have built an unusually thoughtful consumer-agent security architecture.

And the agent may still do something catastrophically stupid on a Tuesday afternoon.

That is the central problem with agentic AI. Security is no longer only about stopping a hacker from entering the building. It is also about making sure the employee you deliberately let inside does not enthusiastically carry the filing cabinet into traffic.

Meta can isolate credentials, gate internet access and encrypt the machine. Later this year, it says a Confidential VM will encrypt the entire environment with a key only the user holds.

All of that matters.

But security engineering answers only one part of the trust question.

There is another one: do I trust the company asking for this authority?

You can encrypt a password. You cannot encrypt a reputation.

The timing is almost too neat for satire.

Less than two weeks before Muse arrived asking Americans to connect increasingly intimate parts of their digital lives, Meta agreed to an $18 billion settlement with U.S. states and territories over claims related to harms to young users on Facebook and Instagram.

Then came the new proposition:

Hello again. Calendar?

Reputation does not make Muse unsafe by definition. Nor does an ugly corporate history prove that a new security architecture is bad. That would be lazy reasoning.

But consumer trust is not a penetration test.

People do not review a company’s threat model over breakfast. They evaluate the company making the request.

For Meta, that creates a strange strategic problem. Muse requires deeper trust than almost anything Meta has launched before, while the company carries decades of reasons for users to treat the word “access” with the enthusiasm normally reserved for an unexpected call from the tax office.

A company can ship new code considerably faster than it can ship a new reputation.

And then there is the money

Muse also hints at an economic shift underneath the technical one.

Stripe says Muse can use Link to make purchases across the web. At businesses that accept Link, checkout can happen directly; elsewhere, Link can issue a single-use virtual card for an approved purchase.

This moves the platform from influencing commerce toward participating in its execution.

Advertising monetizes the space between I might want something and I bought it.

Agents operate much closer to the second sentence.

The old system tries to persuade me that I need new headphones. Ads follow me around until one of us loses the will to live.

The agentic system waits until I say: “Find me noise-cancelling headphones under $300, good for flights, available this week.”

Now the commercial opportunity sits inside explicit intent.

The winning platform may not be the one that knows what we are likely to want. It may be the one authorized to act once we want it.

The customer journey may continue without the customer

This is where marketers should become mildly uncomfortable.

We have spent years optimizing customer journeys as though customers particularly enjoyed travelling through them. Landing pages. Retargeting sequences. Conversion funnels. Pop-ups offering 10% off in exchange for an email address and a small portion of the soul.

An agent does not care about your cinematic homepage.

It cares whether the product is available, whether the specifications are clear, whether the price fits, whether the return policy is acceptable and whether the merchant looks trustworthy.

Humans will still create desire. We will still choose brands because of taste, memory, culture, status and irrational affection.

But after preference becomes intent, more execution can move to machines.

Brands may increasingly have to win the human before the prompt and satisfy the machine after it.

Your brand can still make people want you.

Your data, pricing, availability, policies and reputation will determine whether their agent can actually choose you.

The real platform war

Muse matters because it makes the next platform battle unusually clear.

The question is no longer only: Which AI gives me the best answer?

It becomes: Which company am I willing to let act as me?

That is a more intimate position than search engine, social network or shopping app. It is a digital proxy: software standing between intention and consequence.

Meta wants that position. So will every technology company with enough compute, distribution and confidence to ask for your calendar.

The winner will need excellent models.

It will need excellent security.

But above all, it will need something technology companies have historically treated as a communications problem whenever they were running short of it.

Trust.

For twenty years, the internet competed for our attention.

Now it wants permission to leave the room without us.