Meta just launched Muse, an AI agent that lives in an app, in WhatsApp, and soon in its smart glasses, and does real tasks for you: booking a hotel, clearing your inbox, comparing prices before buying something. You describe a goal in plain language, and it works through the steps on its own, only pausing when it needs your approval to spend money or share something sensitive.
This is not a new idea. An open source project called OpenClaw exploded in popularity earlier this year, and a private assistant called Instinct has been generating buzz among early testers for how much it can handle on its own. Meta is arriving after both, which is unusual for a company that normally moves first and asks questions later.
What Meta is counting on instead is trust. It built Muse so each person's agent runs in its own isolated digital room, separate from everyone else's, so a bad link or a poisoned webpage cannot leak into your data. A built-in checker reviews anything the agent wants to send out of that room and asks you to approve it directly, not through the AI itself, because attackers have learned to hide instructions inside emails or webpages that trick an agent into acting against you.
That trick is called prompt injection, and it is now one of the most common ways agentic AI systems get exploited in the real world. Meta is paying outside researchers to try to break Muse this way, which tells you how seriously the industry now takes this problem.
The most practical piece of the launch is how Muse pays for things. Working with Stripe, it uses a one-time use card number for each purchase instead of your actual card, backed by no-fee returns on anything it buys. That solves a real fear: handing your money to software you cannot personally watch every second.
Expect throwaway card numbers like this to become standard across shopping agents, since few people will hand real wallets to software they cannot fully see. None of this erases Meta's track record, though: the company has faced anger over its smart glasses recording people without clear consent, and it pulled an Instagram feature this year after users objected to how it reused public photos.
Asking the same customers to now hand Muse access to their email, calendar, and shopping accounts is a bigger ask than anything Meta has tried before. If it works, other companies will copy the isolation and approval system rather than the Muse brand itself.
For any business watching this space, the lesson is not really about Meta. AI agents that shop and act on someone else's behalf are moving from a lab demo into daily products within the year, and if you sell anything online, a growing share of your buyers will eventually be agents clicking checkout instead of people, so your payment and return systems should be ready before that becomes normal rather than rare.