Meta's Muse Personal Agent Goes Viral, Hits #2 on Apple App Charts

Full analysis

Meta shipped a consumer AI agent called Muse that hit #2 on the US App Store, behind ChatGPT. It uses computer-use, meaning the AI drives software screens directly like a person clicking through them, so it can cancel a subscription, book a hotel, or flag a fraudulent charge without anyone wiring up an integration. The pitch is convenience. The engine underneath is a data flywheel: every task teaches Meta what 300 million people want, buy, and ignore.

How hard is this to undo? For Meta, easy. It is an app they can iterate weekly. For everyone building a competing agent, harder, because Muse just reset what a first-time user expects. For a user handing over email and card access, close to impossible to undo, since the behavioral data is already captured.

What's actually being decided: not "is Muse a good app." It is whether computer-use becomes the default way personal agents work, and whether the winner is whoever owns the cheapest inference and the biggest data loop rather than whoever has the best model.

What sets the deadline: nothing hard. The natural clock is the first EU launch and the first publicized failure, both likely inside two quarters.

The Skeptic. Chart position is a vanity number. WhatsApp hit #1 the week it launched too. What matters is whether people still let Muse touch their bank in week six. Computer-use is brittle where it counts: multi-step logins, two-factor prompts, CAPTCHAs, dynamic layouts, anything living inside a mobile app instead of a website. The "proactive goal extrapolation" that reads as magic in a product brief is the exact feature that books the wrong hotel at scale. And the actual product here is the consent funnel that gets hundreds of millions of people to hand Meta their email and card credentials. Meta has run that playbook before. The agent is the reason people say yes.

The Safety Lens. An agent living inside email, subscriptions, and financial accounts is a fresh attack surface with no legal home. The obvious break: a malicious invoice email that tells the agent to approve a payment, and the agent, reading the screen, obeys. Who eats that loss? Meta, the user, the bank? Undefined. The consent problem is worse. People granting "let Muse manage my email" almost certainly do not grasp that they are generating labeled training data on every purchase decision they make. That collides head-on with GDPR's rule that data collected for one purpose cannot be quietly repurposed for another. The first EU regulatory inquiry lands within two quarters of launch, and Meta has the enforcement scar tissue to know it is coming.

The Compute Pragmatist. Chat and computer-use are not the same workload, and the cost gap is the whole game. Every Muse action needs the model to look at a screenshot, decide the next click, act, then often check whether it worked and retry. That is closer to running video understanding per session than answering a chat message. It is many times the tokens per completed task. Meta can eat that because it owns its own chips and data centers. An agent startup renting GPUs cannot match the unit economics, full stop. If computer-use is where the category lands, the moat moves to whoever runs the cheapest inference at scale. That is Meta, Google, and Amazon. Not a Series A with a clever wrapper.

The Researcher. The genuine advance is grounding actions in the screen instead of the API. Every prior agent died on the integration cold-start problem: no partner hooks, no product. Driving the UI directly sidesteps that entirely, and it means the addressable surface is every app a human can operate. No partnership deal required. The quieter point is the corpus. Muse is assembling the largest real-world record of people delegating goals to an agent and correcting it when it errs. That is exactly the data you need to make the next agent better at deciding what a vague request actually means. The flywheel quote undersells it.

The Enterprise Buyer. No CTO signs off on a consumer agent that logs into corporate systems by reading screens and clicking. No audit trail I can trust, no SSO story, no indemnity when it authorizes the wrong payment, and a computer-use layer that by design types into whatever field it sees. The interesting question is whether Muse's consumer success drags a "computer-use for the enterprise" pitch into procurement meetings. It will, and the answer will be no for anything touching money or regulated data until someone can show me deterministic guardrails and a signed liability chain. Convenience at home does not survive a compliance review.

Where they part ways. The Researcher and the Compute Pragmatist agree computer-use is the real shift, but they locate the moat in different places. One says the advantage is the data corpus; the other says it is owned inference. That matters, because if the moat is compute, model quality stops being the story and this becomes a game only three or four companies can afford to play. The Skeptic and the Researcher clash on whether the flywheel even spins: a corpus of agent actions is only valuable if people keep granting access after the first wrong-hotel incident. And the Safety Lens versus everyone else: the same computer-use property that removes the integration problem is what makes prompt injection trivial. The feature and the vulnerability are the identical mechanism.

What it hinges on. Three things. Does computer-use hold up on the messy stuff (two-factor, CAPTCHAs, mobile-only flows) or does it quietly cap out at the easy tasks? Does retention survive the first public failure, or does trust evaporate the way it did for earlier agents? And does a regulator treat the data flywheel as a purpose-limitation violation? The council leans one way with conviction: the capability is real and the compute advantage is real, but the adversarial surface and the consent problem are underpriced by everyone shipping right now.

What to verify before betting the roadmap on this. If you build agents, test computer-use against the hostile cases: a login with two-factor, a subscription buried behind a retention dark pattern, a payment page with a malicious instruction planted in the DOM. Skip the demo environment entirely. If you buy agents, ask for the liability clause in writing before anything touches a bank account. The demo is clean. The web is not.

Prediction: Before June 2027, a publicized incident in which Meta's Muse agent takes a wrong money-touching action (an unauthorized payment, a wrong charge approval, or a prompt-injection-triggered transaction) will force Meta to add a mandatory human-confirmation step for financial actions that was not required at launch.

Confidence: Medium. The failure path is baked into computer-use; only timing is uncertain.

Why: Computer-use works by reading whatever is on the screen and acting on it, which means a hostile instruction planted in an email or a web page is read as a command, and financial accounts are exactly where the payoff is high enough to attract that attack. Muse launched to millions with autonomous task completion as the headline feature, so the volume of money-touching actions is large from day one and the odds of one going publicly wrong climb fast. The reason the opposite is less likely: Meta has been burned by regulators and press before and reacts to viral failures by bolting on friction, which is precisely a confirmation step. The only way this call misses is if Muse already ships that gate quietly or if adoption of financial tasks stays too small to produce a newsworthy failure, and the whole product pitch runs against the second.

Revisit by 2027-06-01: We're right if Meta adds a required human-confirmation step for Muse financial actions following a publicized wrong-action or injection incident. We're wrong if no such incident forces a change and Muse still executes money-touching tasks with the same autonomy it launched with.