No. 1 and a zero-day in the same week — Meta Muse's first three weeks
Meta's personal AI agent Muse hit No. 1 on both US app stores within eleven days of its September 8, 2026 launch, in the same week it drew a Mac zero-day, an Amazon shopping block and a report of humans behind its phone calls.
Includes a referral code There is a Muse referral code at the end of this post. If you sign up with it, odd duck also receives Muse tokens as a reward.
Meta released Muse, a personal AI agent that works across a user's apps and accounts, in the US on September 8, 2026, and it reached No. 1 on the App Store on September 18 and on Google Play on September 19. By September 25 download estimates ranged from about 2.3 million (Appfigures) to 3.4 million (Sensor Tower) and 4.3 million (Apptopia), and Meta's shares had risen 26.8% since launch. In the same days, researcher Patrick Wardle disclosed a Mac zero-day that Meta hot-fixed on September 22, Amazon began blocking Muse from shopping, and 404 Media reported that internal test calls were placed by humans. Hacker News met the launch with distrust of Meta; Korean news and stock channels called it a craze; people who actually used it found it useful and worried anyway.
Meta's personal AI agent Muse launched in the US on 8 September 2026 and reached No. 1 on both the App Store and Google Play eleven days later. The same week brought a Mac app zero-day and Amazon blocking it from shopping. Downloads and trust went separate ways.
What Muse is
fact Meta presents Muse as a personal agent that does the work instead of answering questions. It sends email and books travel, keeps working after you close the app, and asks for approval before sensitive actions. It launched in the US on iOS, Android and the web; the basics are free, with a paid subscription on top (Meta's announcement, checked 28 September).
fact The model underneath is Muse Spark, built by Meta Superintelligence Labs. The agent runs in its own virtual machine, and anything it does on the internet is approved a second time by a separate agent called “Sentinel”. Users can turn off training-data collection (same announcement).
Feature for feature, it is not very different from other companies' agents. The difference is that it comes from the company that owns Facebook, Instagram and WhatsApp, so the reaction split over the company more than over the features.
No. 1 on both stores in eleven days
fact Muse reached No. 1 on the US App Store on 18 September and on Google Play on 19 September, and has held the spot since (TechCrunch, checked 28 September).
fact How many times it has been downloaded differs by nearly a factor of two depending on who is counting. Around 25 September, Apptopia put it at 4.3 million, Sensor Tower at 3.4 million and Appfigures at about 2.3 million (same article).
fact It was fast, too. Sensor Tower saw downloads grow 55% a day on average over the first two weeks, and the same article compares that with ChatGPT's 24% a day over its first ten days. Meta began running Muse ads in its own apps on 9 September, and within ten days it was running more promotion for Muse than for Facebook, Instagram or WhatsApp (same article).
fact The market followed. Meta's shares rose 26.8% from 8 to 24 September (Seoul Economic Daily, checked 28 September).
What broke the same week
fact On 21 September, Mac security researcher Patrick Wardle disclosed a flaw in the Muse app for Mac. Changing one undocumented setting sent voice input to an attacker's server and could even pull out the account's authentication token. It assumes the attacker can already run code on that Mac (Malwarebytes, checked 28 September). Wardle said the next day that Meta had hot-fixed it (Unite.AI).
What makes this flaw heavy is not the flaw itself but the permissions Muse holds. An agent that already reaches into email, messengers and calendars hands all of those permissions over at once if it is breached. Wardle's advice was one line — “Don't install it.”
fact The same day came reports that Amazon had started blocking Muse from shopping. It showed a notice that access by unauthorized AI agents violates its terms, on the grounds that Muse appears to come in without identifying itself and to store customers' login details (GeekWire, checked 28 September).
fact Amazon had already sued over Perplexity's shopping agent, but the preliminary injunction it won in March was overturned by the Ninth Circuit on 4 August, the same article reports. What Amazon could not stop in court, it is now stopping with its terms.
fact On 22 September, developer Peter James asked Muse to bundle the files it could see and send them to Google Drive, and received a 6.8 GB archive. It was the file system of the Linux environment assigned to his session, and it held Muse's internal instruction documents and integration code. There was no sign of other users' data mixed in, and Meta closed the report as “not applicable” in its bug bounty (mouse.dev, checked 28 September).
fact The same day, 404 Media reported that in internal testing Meta had call-center workers place Muse's calls for it, and that some testers only heard later that the caller had been a person. Meta said the public launch would come with appropriate disclosure (404 Media, checked 28 September).
On 25 September, the same developer wrote that he had found model calls named “azure/muse-special” in his session logs and that it might be an OpenAI model (mouse.dev). He said himself that it was a guess, and neither Meta nor OpenAI has explained. It should not be treated as established fact.
Hacker News and Korean YouTube saw different things
fact The launch thread on Hacker News drew 666 points and 742 comments (Hacker News, checked 28 September). The main current in the top comments was distrust over whether Meta can be handed email, messengers and payments. A counterargument kept coming back in the same thread: whatever the tech community says, the people who use Meta's apps will use it. Eleven days later, the counterargument proved right.
fact On Korean YouTube, the most-watched Muse videos came mostly from news and stock-market channels. Their titles used words like “frenzy” (YTN, 1.49 million views), “sensation” (Oseon's US Stock Market Live, 1.17 million) and “even beat ChatGPT” (Korea Economic TV, 330,000), and YTN's also added “concerns, too” (YouTube, checked 28 September). For an app released only in the US, there were even videos on how to sign up from Korea (a tutorial).
fact The people who actually used it reacted differently again. A 14 September review on MileMoa, a community for Koreans living in the US, said that finding award flights, screening 44 insurance products and checking hotel dates actually worked. In the comments, worries about privacy and terms-of-service violations kept coming (MileMoa, checked 28 September).
The three places run at different temperatures because they were looking at different things. Developers looked at how this agent could be abused, investment channels at rankings and share prices, and the people who tried it at how much time it saved them. None of the three was wrong.
Where Meta means to make money
fact At Meta Connect on 23 September, Meta said it would put Muse into its AI glasses within months, give Muse its own email address, and say more this year about “Muse Charm”, a dedicated device that goes in a pocket (Meta Newsroom, checked 28 September).
fact According to TechCrunch, Muse gives generous usage for free for now, and Meta has talked about taking a small fee on transactions in future. Named shopping partners include Stripe, Shopify, Best Buy, Walmart, Expedia and Instacart (TechCrunch, checked 28 September).
The agent does the buying, and Meta takes a cut of the transaction. Where Amazon shut its door is exactly where Meta means to make money.
As a small game studio, we come away from these three weeks with one question. Once people start handing even payments to agents, our apps become screens that people tap and agents read. What to show there, and what to block — now is the time to start preparing.