Earlier this month, Meta had launched Muse – its multi-tiered personal AI agent that is capable of executing complex real-world tasks on a user’s behalf. Rather than simply answering text prompts like ChatGPT, Muse boasts full “agentic” capabilities, i.e., it spins up dedicated cloud environments, controls web browsers, manages inbox schedules, negotiates bills, and autonomously checks out shopping carts using Stripe-powered integration.
Muse was supposed to finally mark Meta’s arrival on the agentic AI scene, bringing competition to the popular trio of Gemini, ChatGPT and Claude.
The Muse app, which is available in limited countries, has experienced mega popularity upon release. According to Sensor Tower data reported by CNBC, Meta’s Muse got up to 730,000 downloads in its first five days alone following its September 8 rollout. The rapid adoption pushed Muse to the top of the US iOS free app chart, surpassing initial post-launch download rates for rivals like ChatGPT, Claude, and Grok.
However, less than two weeks after its high-profile rollout, the initial enthusiasm around Muse is being overshadowed by corporate rivalries, platform bans, and critical security disclosures.
Meta’s promise: Muse works while you sleep
Meta pitched Muse as something between a conversational AI bot and true digital automation. Built on the architecture known internally as “OpenClaw” or “Hatch,” Muse operates inside a dedicated, isolated virtual machine (the Muse Secure VM) allocated to each individual user.
What’s at the core of Muse
– Each user’s agent operates within its own Linux environment equipped with a visible browser, token storage, and execution sandbox.
– To prevent malicious behaviour or runaway loops, Meta implemented a decoupled system component called Sentinel. Sentinel acts as an independent permission authority, evaluating outgoing requests and enforcing user boundaries before sensitive actions (like sending an email or completing a purchase) can proceed.
– Users can give Muse broad instructions, such as tracking down dynamic price drops or compiling daily workout regimes based on health metrics, and close the app. Muse executes tasks in the background and prompts the user only when authorisation is required for a certain activity, for eg: locking onto a low price.
So why did Amazon block Meta’s Muse?
Problems emerged for Muse on September 20, 2026, when e-commerce giant Amazon deployed technical barriers to block Muse from accessing Amazon.com.
Users attempting to use Muse shop or search on Amazon were met with strict anti-bot walls explicitly preventing access.
Amazon’s position
Amazon cited several violations, claiming that Meta deployed Muse onto Amazon’s platform without prior authorisation or identification mechanisms. Additionally, Amazon alleged that Muse’s headless browser scraping appears to capture and store customer credentials, posing unacceptable security and liability risks.
Amazon maintains that automated platforms operating on behalf of third parties must operate transparently and respect vendor access permissions.
Meta’s counter-claim
Meta, on the other hand, denied Amazon’s claims of compromising user credentials. The tech giant clarified that user authentication data is routed directly into secure, encrypted VM storage that the core AI agent cannot directly read or exploit. This insulates financial details from model visibility.
But this wasn’t the end of Muse’s concerns.
macOS ‘Zero-Day’ vulnerabilities and local hijacking
Adding to Meta’s platform list of concerns is a fresh technical security exploit that targets Muse on desktop environments.
Security researcher Patrick Wardle (founder of Objective-See) disclosed a critical zero-day vulnerability affecting the macOS build of Meta Muse, dubbed proof-of-concept “not-a-mused”. The exploit focuses on an undocumented, unencrypted configuration setting within the local application files.
The exploit vector: Any standard, unprivileged local process running under the user’s account can modify this setting without requiring root or administrator access.
The risk: Once altered, the endpoint silently redirects all dictated user audio, transcribed text prompts, and local authentication material to an attacker’s remote server. Because Muse holds deep system and app integration across a user’s connected services, compromising the input stream effectively gives malicious code full control over the agent’s broad execution permissions.
Meta is yet to respond to the concerns publicly.
Disclaimer: The following article is based on publicly available news, industry reports, and security disclosures regarding Meta’s AI agent.