Meta’s Cute Muse Agent Leaves Banks With the Bill

Meta’s Muse AI agent, sold as a fuzzy Labubu-like mascot named Jolly, topped US app charts within weeks of its 8 September launch. OpenAI answered on 29 September with Dots, puffy rainbow blobs in sunglasses and berets that keep working after you close the laptop.

The cute wrapping is how these bots reach inboxes, calendars and checkout. The fight that will decide whether they can actually shop sits with banks, Amazon, partner stores and anyone who tapped allow-always.

Jolly Fits on a Keychain, the Bill Does Not

At Connect in Menlo Park on 23 September, Mark Zuckerberg called Muse “the centerpiece of our vision” and said he expects it to grow into “the personal superintelligence that billions of people around the world are going to use.” The hardware punchline was Muse Charm, a Tamagotchi-style keychain about the size of an AirPods case, with a screen of about two inches and a fingerprint sensor in the corner.

It is due to ship in December. Meta has not set a price, and it has not confirmed cameras on the fob. Zuckerberg told the room that if you are not wearing the company’s glasses, the Charm is “by far the fastest way to talk to your Muse and to show what’s going on around you.” He also said Meta is “making Muse free for a huge number of tokens, with the expectation that over time we will profit by taking a small fee from transactions.”

That fee is the business. Jolly is the face. Lidia Velkova, managing director of the governance shop Clever Together Futureproof, said baby-like features raise perceived trust, and human-like chat raises how much people disclose. Dr. Sarah Saska, a sociotechnologist who studies tech and power, put the split more bluntly: the same systems described to investors as unresolved safety problems reach consumers as “friendly, playful, frictionless, and low-stakes.”

EARLY MUSE NUMBERS

• Downloads: Sensor Tower put Muse at 2.8 million installs in its first two weeks, with 55 percent average daily growth in the first 10 days.
• Five million: By 30 September the same firm said Muse had crossed 5 million downloads, faster than ChatGPT’s 56-day run to that mark.
• The stock: News around the agent helped Meta shares jump 11 percent in a single session, adding some $192 billion in market value.
• The Charm: Ships in December, still unpriced, still a keychain with a fingerprint pad.

Muse is free for most use, with paid plans at $20 and $100 a month. It is on iPhone, Android, the web at muse.ai, WhatsApp and Mac, and only in the United States and Canada. Early users who came for a do-everything helper already report the new skills are hard to find, so the app slides back into inbox triage even as Meta piles on connectors.

Six Banks Put Liability on Paper First

On 22 September, a day before Connect, six lenders published a joint paper rather than wait for a regulator. NatWest Group, ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia and ING Group set out five principles for trusted agentic commerce: transparency, safety, privacy and data, choice, and interoperability. The paper is voluntary. There is no timetable. A later note is supposed to explain how any of it becomes a rule.

Building confidence among consumers, merchants and financial institutions will require thoughtful approaches to identity, authorization, fraud prevention, liability management and customer protection.

Mark Monaco, Head of Global Payments Solutions, Bank of America, joint bank paper

Mark Brant, NatWest’s chief payments officer, said customers still need to trust that they “remain in control of how payments are made and that their money is safe.” Hans Overeem, ING’s head of payments, said people must understand what the agent is doing. None of that assigns a refund when Jolly buys the wrong sofa.

The banks are not a sideshow. They sit on the card, the dispute desk and the fraud file. If an agent exceeds the authority a customer thought they had given, the paper itself says liability can become unclear across the chain, and dispute processes often leave parties out. Cute packaging does not appear in the five pillars.

Who Pays When an Agent Buys the Wrong Thing?

Meta’s consumer help text on Muse payments is plain. You are responsible for all transactions your Muse makes on your behalf, and you should watch email confirmations, receipts and statements. A Meta spokesperson said users can take over at any time, that Muse is designed to ask before it buys, and that it applies “ethical browsing principles” when asked to do things a person could not, such as buying all the tickets to an event.

Kate Winick, a principal analyst at Forrester, said brands should expect the same duties they already have in digital checkout: secure the purchase, describe the goods, honour consumer law, and live with the reputational hit. She compared it to a child ordering through Alexa. The store often refunds even when the settings put the burden on the parent. “AI agents aren’t children,” she said, “but when they take actions customers are unhappy with, retailers will feel the pressure to make it right even if they’re not legally required to do so.”

Nick Phillips, an intellectual property partner at Edwin Coe LLP, warned that where no merchant deal exists with Meta, “the brand or merchant potentially bears residual risk,” including unvetted agent checkouts. That is the gap the banks wrote toward, and it is still open.

WHO HOLDS THE RISK TODAY

Forrester’s Winick also flagged the data bargain. To make Muse stick, Meta defaults to using interactions to train its model and stores what you share. Users can opt out. The more you give it, she said, the better it works and the more exposed you are “to both bad actors and bad actions by Meta.”

Walmart Signed On as Amazon Shut the Door

Amazon began blocking Muse on the evening of Sunday, 20 September. Shoppers who sent the agent to Amazon.com hit a popup: continued access by an unauthorized AI agent violates Amazon’s Conditions of Use. Spokesperson Lara Hendrickson said third-party apps that buy from other businesses “should operate openly and respect service provider decisions about whether or not to participate,” and that Amazon had asked Meta to remove the store. Amazon says Meta never gave notice, the agent does not identify itself while it browses, and it appears to capture and store customer credentials.

Meta’s launch post says Muse has no visibility into passwords or payment methods, and that shared credentials go into secure storage so the agent can use them without seeing them. The company describes an isolated virtual machine and Sentinel checks: a dedicated cloud computer for each user, a separate Sentinel that must approve anything reaching the internet, and a prompt for sensitive steps such as sending mail or paying. Meta still says Muse is not immune to attack, that prompt injection remains an open industry problem, and that Muse will sometimes make mistakes.

Partner stores took the other door. At Connect, Meta said Muse can work through the Shopify catalogue and Shop Pay, with PayPal and Stripe in the mix, and named new retail connectors including Walmart, Sephora, Gap and Wayfair, plus Best Buy, Ulta, American Eagle Outfitters, DICK’S Sporting Goods, Fanatics and Michael Kors. Expedia is listed as coming soon, Instacart for groceries. Alexandr Wang, Meta’s chief AI officer, said developers filed more than 1,500 connector applications in less than a week.

WHO LET MUSE IN, WHO DID NOT

• Amazon: Blocked Muse from 20 September and asked Meta to drop the store.
• Shopify path: Structured catalogue access and, for eligible shops, a checkout route merchants can switch off.
• Named chains: Walmart, Sephora, Gap, Wayfair, Best Buy and others opened a formal pipe.
• Everyone else: An agent can still arrive in a browser like a person, with no deal and no flag.

For a big chain, Muse is a new sales channel that also stands between the shopper and the brand’s own site. For a small shop, it can be a stranger at the till. The agent gets the recommendation and the click. The merchant keeps the parcel, the return and the chargeback.

An Allow-Always Click Brought Strangers Home

YouTuber Matt Robb asked Muse to help sell a keyboard on Facebook Marketplace. The agent shared his home address with a buyer, bargained, and set a collection. Robb only clocked it when the buyer and their family were at the door. There was no hack. He had chosen an allow-always permission, which let Muse keep handling Marketplace chats and pull personal details he had already given, including that address.

That is the line consumers are used to blurring. Ticking a box so an app can read mail is ordinary. Letting software negotiate with strangers, disclose a street, and act in your name is not the same act, even when the log says the permission was granted. An agent can stay inside a setting and still do something the person never pictured.

Meta wants more of that intimacy, not less. Muse is coming to the company’s AI glasses in the coming months, with a wake word, so it can act on what you are looking at. Wang said the Mac app can run the computer while you walk away. Muse is also getting its own email address, so it can sit on a thread. On 29 September Meta added Muse for Small Business, with connectors for Shopify, Slack, Stripe, QuickBooks and the company’s own Facebook and Instagram business accounts, and a promise that nothing publishes, sends or spends without approval.

Wang posted a shipping list on 4 October that ran from invite codes and a phone-call beta through Mac computer use, Canada, gadgets and memes, then asked what to build next. The replies that stuck were not about Jolly’s cheeks. People outside the United States and Canada want in. People already inside want the new skills to show up in the app they actually open.

what we've shipped:

muse ♥️
ton of connectors 🔧
muse invite codes 💌
muse phone call beta ☎️
muse for mac 
muse in canada 🇨🇦
muse connector platform 🛠️
muse mac computer use 💻
muse for small business 💼
muse gadgets 🕹️
muse memes 🤡
no butthole 🍰

what should we ship next?

— Alexandr Wang (@alexandr_wang) October 4, 2026

The Child-Safety Settlement Still Hangs Over Muse

On 26 August, weeks before Muse launched, Meta agreed to pay up to $18 billion to resolve claims that it designed Facebook and Instagram in ways that harmed children, in what state officials have called the largest big-tech consumer settlement on record. Tennessee Attorney General Jonathan Skrmetti’s office set out the product changes alongside the money, including two-hour daily time limits for young users across those two apps, pauses after 15 minutes of continuous use, a night block from 12 a.m. to 6 a.m., and a mute on push alerts from 8 a.m. to 3 p.m. on school weekdays.

Florida stayed out. New Mexico had already taken Meta to a jury. Days after Muse launched, a New Mexico jury found Meta had misled users about its data practices in a case tied to the Cambridge Analytica scandal. A Meta spokesperson said the company disagrees with the verdict and will keep defending itself.

Zuckerberg has rejected calls for an industry-wide slowdown in frontier AI, arguing each firm should decide for itself. Anthropic chief Dario Amodei has urged the opposite, with public backing from Sam Altman, Elon Musk and Google DeepMind’s Demis Hassabis. Muse still defaults to feeding interactions into training unless the user turns that off. It still wants email, calendars, Instagram, Facebook, WhatsApp and a path to spend.

THE MONTH THE TOY MET THE LEDGER

1. 26 August 2026: Meta agrees to pay up to $18 billion and change how teens use Facebook and Instagram.
2. 8 September 2026: Muse launches in the United States and Canada with Jolly as the face.
3. 20 September 2026: Amazon blocks the agent from its store overnight.
4. 22 September 2026: Six banks publish voluntary agentic-commerce principles.
5. 23 September 2026: Connect puts Muse on a keychain and names more shop partners.
6. 29 September 2026: OpenAI ships Dots; Meta adds Muse for Small Business.
7. December 2026: Muse Charm is due to ship, still without a public price.

The design choice is not a side detail in that sequence. After using celebrity polish on smart glasses, the companies reached for kawaii. The Charm hangs next to house keys. The blob on OpenAI’s stage looks like a toy. The access request underneath is for the inbox, the card and the right to act.

Dots Arrive While OpenAI Holds the IPO

OpenAI’s DevDay recap calls Dots always-on agents built to handle everything. Each one gets its own cloud computer and browser, plugs into more than 4,000 apps, and can sit in ChatGPT, Slack and Microsoft Teams. They are on Pro and Business Premium in eligible markets. Enterprise, education and healthcare tenants get a beta that is off until an admin turns it on. Pro users in the European Economic Area, Switzerland and the UK are left out for now. Pro is $100 a month. Business Premium is $20.

Altman told the San Francisco hall, which had about 2,500 people in the room, that Dots would “feel like a whole new way to work with AI” and called them “the real deal version of AI that we’ve always imagined for ourselves.” He said they run on GPT-6 Astra, the model he described as the one that most closely follows human directions, and that sensitive steps such as password changes need explicit consent. ChatGPT, the surface they live on, now claims 1.2 billion weekly users.

The same week, Altman told reporters he would not “barrel, all guns blazing, towards an IPO.” He said OpenAI has to make confident safety claims as models jump in capability, and that he does not want Wall Street pressure in the middle of that work. He had already ruled out a 2026 listing. Dots still went out as cuddly, always-on workers with their own computers.

Grok-style bots are being sold as coworkers. Dots are being sold as a chief of staff. Muse is being sold as the thing that lives with you, on glasses, on a Mac, on a Charm on your bag. The mascots are doing their job if you stop seeing a payment rail. Amazon already treated Muse as an uninvited shopper. The six banks treated it as a liability file. Meta’s own help page treats it as your tab.

Jolly ships on a keychain in December. The principles that would say who pays when he buys the wrong thing are still a PDF.