An AI Is Shopping on Your Site, and Your Analytics Cannot Tell

Meta launched Muse on 8 September 2026: a personal AI agent that opens a browser, fills out forms, negotiates on your behalf, and checks out with a single-use card. It runs in its own cloud virtual machine, it works inside WhatsApp, and it is free in the US for most of what people need.

Most of the coverage is about whether you would trust Meta with your inbox. That is a fair question and it is not the one that will affect anyone's work first.

The sentence that matters sits in the data policy section of Meta's security post, and it is about your traffic.

It browses as you

“When Muse browses the internet, it will appear as your activity, so if you ask Muse to buy a shirt from a clothing designer's website, that designer might use your visit to show you an ad on Instagram.”

Meta is being straight here, and both halves are true. Muse does not send your conversations or your VM data to Meta's ad systems. And the agent's browsing is indistinguishable from your own, because as far as the website is concerned, it is your session.

Follow that through if you sell anything online:

• Your analytics cannot separate them. A session that reads three product pages, adds to cart and abandons might be a person deciding, or an agent gathering options for a person who has not looked yet.
• Your retargeting pool changes composition. You are now bidding to re-reach humans on the strength of visits their software made. Meta's own example is exactly this: the designer sees the visit and serves the ad.
• Your attribution gets a new gap. The research, the comparison and the abandonment may all be machine. The decision and the purchase approval are human, and they happen somewhere your analytics never sees, inside a chat.

None of that is a privacy scandal. It is a measurement problem, and it starts the day people begin using this rather than whenever regulators get to it.

The practical question for this week is not "should I block agents." It is can an agent complete a purchase on my site at all, does checkout work without a human eye, do forms validate sensibly, is the accessibility tree navigable? Muse's browser sub-agent reads an accessibility tree rather than the raw page, which means the same work that makes a site usable with a screen reader is what makes it legible to an agent.

What it will and will not do for your work

Meta's framing is that Muse “doesn't just answer questions, it actually does the work”. Read the announcement's capability sentences closely and they are all about acting, never about authoring:

• It turns a goal into a plan. Meta says it “helps people stay on top of things, takes tasks and projects off their plate, and turns long-term goals into action plans”. Share a goal and it “helps them develop a personalized plan and coordinate their time and resources, then advances the work on its own”.
• It opens a browser, fills out forms, and negotiates on your behalf. The supplier portal, the renewal, the quote request, the form with eleven required fields.
• It sends email and books travel. For email you pick the scope: “whether it reads their mail or can also send on their behalf”.
• It keeps working after you close the app and comes back when something changes or it needs approval.
• It shows a complete audit trail of “everything it has done and plans to do”.
• It runs inside WhatsApp, with “no learning curve” and “no technical experience required”.

Now the part that is easy to miss, because it is an absence rather than a feature.

Neither the launch post nor the security post claims Muse writes a document. Not a report, not a deck, not a spreadsheet. None of those words appear anywhere in the announcement, and the only authoring the security post describes is code: compiling code the agent writes, and writing its own custom connectors for services that have their own APIs. Every capability sentence in the announcement is about browsing, forms, email, booking, negotiating, paying, planning and coordinating.

That is a category, not a criticism. Muse is not another assistant that drafts things for you, and you already have several of those. It is the one that goes and does the errand around the draft. If your mental model is 'it will write Monday's report', you will be disappointed by a product that is genuinely good at chasing down the five things you need before you can write it.

Two capabilities ship later rather than now: 1Password support, so Muse can use logins you already have, and Shop Pay as a second way to check out.

What actually shipped, and what was announced

The headline privacy claim is that not even Meta can read your data. That is Muse Confidential VM, and Meta says it plans to deliver it “later this year.”

Here is what Meta's own security post says about what shipped on launch day:

“Today's Muse architecture isolates each user's data from each other and keeps it secure. It restricts access to your data by Meta personnel through operational policies. It does not prevent Meta from accessing data when necessary to support, secure or operate the service.”

That is not a leak or a critic's reading. It is Meta's sentence, in Meta's documentation, published the same day. Operational policy is a real control and it is a different thing from cryptography, which is precisely the distinction Confidential VM is being built to close.

Worth saying: Meta is doing that part in the open. Confidential VM is already with trusted testers, the design and source are going to external auditors, and Meta says once it launches there will be “a continuous audit of the system that will be visible to and inspectable by anyone.” Judge it when it ships. Just do not describe it as shipped.

The security engineering deserves credit

It would be easy to read the section above as a hit piece. It is not. The architecture is the most serious attempt at this problem anyone has shipped to consumers.

Sentinel is a separate agent on the same machine, outside the container the model runs in. It is the only thing that can approve an action or let a packet reach the internet. In Meta's words, “Muse proposes actions, but only Sentinel can grant permission to perform action.” The agent cannot switch it off, because the agent has no authority over it.

The agent never sees your credentials. Passwords and tokens live outside the runtime cell. The model gets a surrogate token, and the real credential is swapped in at the network boundary after the action is approved. Meta's conclusion is blunt: any attempt to trick the agent into revealing a secret "is futile," because it does not have one.

The email connector filters out one-time passcodes, password reset links and login magic links. This is the detail I would put in front of anyone building an agent. Connect an inbox naively and you have handed over password recovery for every other account that person owns.

Purchases issue a single-use card number tied to one merchant, one amount and a short window, with human approval every time. Even a stolen number is close to worthless.

The most honest line in the launch

Meta opened a bug bounty paying up to $300,000, including up to $130,000 for a successful prompt injection affecting a single user. And the security post concludes:

“Prompt injection remains an open problem in the industry”

A company that has just shipped an agent with browser access and a payment card is telling you, on launch day, that the central attack against it is unsolved. That is worth more than any assurance in the press release, and it is the right way to read the whole product: strong containment around a component nobody yet knows how to make safe.

What to do

If you sell online, test whether an agent can actually buy from you. Broken forms, checkout that depends on hover states, and validation that only makes sense to a human are now conversion problems with a new cause.

If you own analytics or paid media, start asking how you would ever know. There is no agent header, no published detection signal and no guidance for merchants. That absence is itself the finding, and it is worth raising before someone asks why the retargeting numbers moved.

If you are building agents, read Meta's security post rather than its announcement. The credential surrogation and the email filter are patterns worth copying, and they are described in enough detail to copy.

If you are deciding whether to use it, the useful question is not whether you trust Meta. It is which of the things you were promised have shipped. Today: strong isolation, operational policy, no ad-system sharing. Later this year: the cryptography.

Verified 9 September 2026 against Meta's launch announcement and its “How We Built Safety Into Muse” security post, both published 8 September. Implications for sellers and marketers are this article's reasoning, not Meta's claims.