Muse can act for you. Nothing outside Meta can check who it is.

Say you run a small furniture shop. An email lands in your inbox: a customer wants to buy a table, and wants it delivered on Friday. The message is polite and the details are clear. At the bottom it says it was sent by the customer's personal AI agent.

Do you ship the table?

You'd probably want to know a few things first. Is this agent really working for that customer? Did the customer say yes to this purchase, or only to "look around for a table"? If the customer later says they never ordered it, who do you call? The email can't answer any of that. It only tells you what it says about itself.

The product here is real, and it's putting this question to real shops.

What Meta says Muse does

Meta describes Muse in its launch post of 8 September 2026 as a secure, private personal agent that helps with people's goals. The post says each Muse runs on its own dedicated computer in the cloud, kept apart from everyone else's. A separate agent called Sentinel has to approve anything Muse sends to the internet. Muse can use credentials stored for it without seeing them, and it checks with the person before sensitive actions like sending an email or making a purchase. For payments, the post says it can use a one-time card so real card details stay hidden.

That's a careful list. If it works as described, it deals with real worries, and we'd rather people used agents with these controls than without them.

The trouble is where the controls live

Look at where every one of those safeguards sits. The isolated computer is Meta's. Sentinel is Meta's. The stored credentials and the confirmation prompts are Meta's. They all sit inside one company's boundary, and they're described by that company.

From outside, nothing can verify any of them. The shop can't ask to see Sentinel's approval log. A regulator can't inspect the isolation. And that's not an accusation: the controls may be excellent. It's a statement about who can check.

The shop, meanwhile, is the one deciding whether to ship the table. What reaches it is an email, a session or a message. There's no statement saying which person is accountable for the agent, and no statement of what the agent was permitted to do.

A dispute nobody can settle from outside

Here is a case from the news, which shows the shape of the problem. The Next Web reported on 28 September 2026 that a creator who let Muse handle his Facebook Marketplace listings for a day said it gave his address to a buyer and agreed a low price, and that it only asked him about the sale after the buyer had arrived. Meta said it was looking into it. A member of the Muse team said on X that in similar earlier reports Muse had followed direct instructions and asked for permission, and the creator disputed that for his case.

We don't know which account is right, and we're not taking a side. What matters is that the buyer, who dealt with Muse, has no way to look at the evidence either. The only people who can say what the agent was allowed to do are inside the company.

"Allow always" is the wrong shape

Many agents offer a blanket permission of the "allow always" kind. It's convenient, and it's a poor fit for something that can spend money and message strangers.

A permission should be tied to a task. It should name which actions are allowed, run out after a while, and be something the person can take back. "Buy a table, up to this price, from this shop, until Friday" is a permission. "Always allow purchases" is a blank cheque with a friendly label.

People who never signed up

There's a second problem, and it's harder. TIME reported on 6 October 2026 that Muse keeps profiles on its users, and that people who don't use Muse can still be mapped when other people's agents read messages that mention them. Meta told TIME that each user's virtual machine is isolated so that no one else's agent can access it, and that the data isn't shared with its advertising system.

Whatever the truth of the details, the shape is worth a thought. A friend of yours runs an agent. The agent reads a message you sent. You never agreed to anything. If that data is mishandled, who answers to you, and who can a regulator ask?

What the shop should check instead

We think the office on the receiving end should check facts that the agent can't write for itself, and it should check them every time.

Is the agent's identity signed by someone the shop can verify, and is it still valid today? Is there a named person or company that answers for it? Does the permission cover this exact action, for this task? And what's the data-protection status of whoever stands behind it? If any of that is missing, the answer is no, and the shop keeps a note of why.

Notice what isn't on the list: a score. Someone's model saying "this agent looks trustworthy" is a guess made on the agent's own side. A shop can't show that guess to anyone later. Our longer piece on who the relying party is and what it should check goes through the checks one at a time.

What we don't know

We don't know whether Muse's controls work as described. We haven't tested them, and we have no inside view.

We don't know how a shop would check any of this today. A check of this kind needs a shared place to look, and we're setting up a non-profit to work on exactly that. It isn't incorporated, and nobody at Meta has endorsed us.

And here's the one we keep coming back to. Suppose an agent processes data about people who never used the platform. What would a regulator need to read, in what form, to hold anyone to account? We don't think that question has an answer yet, and we'd like to hear from people who have looked at it from the regulator's side.