Meta Delayed Muse for Safety. Then It Launched

Meta reportedly kept its personal agent Muse off the market for months because of safety concerns. On September 8, it released the app after, sources said, a rival’s similar product gained traction. The company had reasons to wait and reasons it could no longer treat waiting as free.

The account of Mark Zuckerberg’s decision is sourced reporting, not Meta’s stated explanation for launching Muse.

When personal agents act on a user’s behalf, developers cannot settle every risk before launch. They still need the power to stop a release, especially for severe risks, but also need controls over what a deployed agent may do, where it may do it, how anyone can inspect its actions, and how quickly its authority can be withdrawn. A control that makes the agent incapable of completing useful work will not survive the same competition that made the launch decision difficult.

A rival’s traction puts a price on waiting

Instinct’s $1 billion Series C at a $10 billion valuation, announced on September 29, priced a personal-agent challenger at $10 billion. Instinct also described a concierge service among its products. The financing came after Muse launched, so it cannot explain Meta’s earlier decision. It does show why executives could regard a challenger’s traction as strategically material rather than as another demonstration of agent software.

Meta’s launch supplied a separate demand signal. Sensor Tower estimated that Muse was downloaded more than 902,000 times in the six days after September 8, compared with 773,000 downloads for Meta AI over the same interval after its launch. Downloads do not establish retention, successful tasks, or safe transactions. They do establish that a delayed agent can find a large audience quickly once released.

Release timing has become a competitive variable beyond these two companies. Reuters reported in September that Anthropic was considering a model release in response to OpenAI’s momentum. Neither report proves that rivalry made a company abandon its safety process. Meta’s reported months-long delay is evidence against that simpler account. The narrower lesson is that a pre-launch hold now operates inside a market where another firm can test demand while the hold remains in place.

Delegated authority changes what a safety check must cover

In 2023, Adept raised funding for a model intended to turn text commands into computer actions. That ambition drew a line between three kinds of assistant. A retrieval assistant finds information. A task agent carries out a bounded instruction. An autonomous agent can retrieve information, choose further steps, and execute them. Each additional step gives the software another opportunity to misread the user, encounter hostile material, or exceed the authority the user meant to grant.

Meta’s Muse and Instinct were described as able to make calls on users’ behalf. In a conversation with Instinct founder Noah Shinn, reported use included people sharing payment credentials and agents driving transactions. An incorrect answer can be corrected on a screen; an incorrect purchase reaches a card issuer and a merchant. Instinct’s early-user feedback also included a purchase that failed when the card charge did not go through and the merchant did not receive the order. Successful payment is only one condition of successful delegation: the user also needs to know whether the merchant received an order and whether another attempt would duplicate it.

OpenAI added native sandboxing and a testing harness to its Agents SDK for long-horizon tasks. Microsoft announced an Agent Control Specification intended to give developers granular, consistent control over agent actions. Those tools address different seams. A sandbox limits where an agent can operate; a permission rule limits what it can do there; a test can expose failures before a task reaches a customer. None guarantees that an agent will interpret every outside instruction correctly.

Prompt injection makes that last limit consequential. A merchant page, retrieved document, or message may contain text that tries to redirect the agent while appearing to be ordinary task material. The agent must read untrusted material to do the job, but the material must not acquire the user’s authority merely by entering its working context. The safety boundary runs through the account, the tool call, and the instruction the agent accepted along the way.

Shared protocols make authority a counterparty’s problem

Google donated its Agent2Agent specification and SDKs to the Linux Foundation, which launched the Agent2Agent project in 2025 with Google, Amazon, and Microsoft among its founding members. In October 2026, Meta, Walmart, Instinct, Shopify, Sierra, Stripe, and others published the Personal Agent Protocol to standardize and secure interactions between AI bots and businesses. Both efforts recognize that an agent’s useful work crosses organizational boundaries.

Those boundaries expose different people to the same decision. A user may authorize an agent to shop, but a merchant must determine which agent has appeared, whose instruction it carries, and whether that instruction remains valid. Discussion around the Personal Agent Protocol raised unresolved questions about agent identity and authority. Publishing an interaction format does not answer them. An agent can speak a shared protocol while still presenting a credential that grants more power than the user intended.

Natura’s announced $99 Interface ring sharpens the issue at the consumer end. The device was presented as a way to reach Claude, ChatGPT, Muse, Grok Bot, and Instinct from one surface. The ring can make invoking an agent easier; it cannot, by itself, make one provider’s permissions legible to another provider or to a merchant. A durable consent architecture would have to distinguish a request to find an item from permission to buy it, and allow the user to withdraw the latter without losing the former.

Conditional access keeps the veto without making it the only tool

OpenAI’s 2023 safety framework gave its board the ability to hold back a model even if company leadership judged it safe. That pre-release authority has not become obsolete. Anthropic later released Opus 4 under stricter safety measures after tests indicated it could potentially help novices make biological weapons. Some capabilities warrant a hard boundary before anyone uses them.

Other decisions admit narrower gates. Sources reported that the U.S. government asked OpenAI to stagger access to GPT-5.6 customer by customer over security concerns. OpenAI was also reported to be adopting structured safety-case documentation for frontier reinforcement-learning training, drawing on practices from aviation and nuclear industries. The UK AI Safety Institute’s work probing models for safety gaps has reportedly become a blueprint for other governments. These are not signs that institutions have surrendered release control to product teams. They show institutions specifying the evidence and conditions under which access can proceed.

For an action-taking agent, those conditions can attach to a customer, a capability, or an operating environment rather than only to the entire product. An agent might be allowed to draft a purchase but require confirmation before charging a card; it might operate in a sandbox before receiving access to an account. Developers would then need records of what the agent attempted and a way to revoke the permission it used. Verifiable agent control depends on those inspectable steps, not on a claim that the model is generally safe.

Recovery reveals whether the controls were real

A researcher reported that other apps or terminal commands could access authentication tokens in Meta’s Muse Mac app; Meta said it issued a hotfix. The flaw concerned the credential that connected an application to a user’s account. A quick patch matters, but token exposure also asks what an attacker could have done before the patch and whether affected authority could be revoked cleanly.

Users can sometimes judge an agent’s visible mistake and choose a different service. They cannot reliably assess a chain of hidden tool calls, a leaked token, and a merchant action that follows them. Merchants and other recipients may bear costs without ever choosing the agent. Agent developers must limit what an exposed token can authorize and keep records of failed transactions; those choices shape agent liability.

Meta’s reported hesitation over Muse and its later hotfix occupy different points on the same control path. The first kept the agent from acting; the second addressed a failure after people could use it. Between them sit the permissions on a call or purchase, the sandbox around a task, the record of an attempted charge, and the switch that ends an exposed credential’s authority. The brake has not disappeared. It now has to work while the agent is moving.