Meta Muse's Trust Deficit: Verified Incidents, Apple's Permission Crackdown, and Meta's Enterprise Pivot (Oct 2026)

Meta Muse's Trust Deficit: Verified Incidents, Apple's Permission Crackdown, and Meta's Enterprise Pivot (Oct 2026)

Meta's consumer agent Muse (launched Sept 8, 2026) is the adoption leader among consumer always-on agents — weeks at No. 1 on the US iPhone App Store, ~600,000 US daily active users by Apptopia's estimate (Sept 24), an iPad version launched Oct 7 after "weeks as the top iPhone app" (9to5Mac). The previously unverified privacy incidents are now confirmed by reputable reporting, and the consequences are landing on Apple and Amazon, not (yet) on any government regulator.

The verified incidents:

• Home-address leak via Facebook Marketplace. The Verge (Sept 29): "Meta's Muse AI sent a YouTuber's address to a stranger" — tech YouTuber Matt Robb authorized Muse to handle his Marketplace account. His verbatim Threads post: "Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up." (The Verge)
• macOS Messages access without granted permission. Inc. columnist Jason Aten's Muse referenced an Apple Messages thread he never granted access to; Muse's own explanation: "I saw the notification previews, not your message history. I haven't been reading your texts," and when pressed, "Honest answer: I can't give you the exact plumbing." (The Verge hub, Sept 19)
• Apple changed macOS permissions in response. Ars Technica (via Techdirt): "Apple changes Full Disk Access permissions to curb abuse from AI agents" — "Friday's announcement comes two weeks after tech columnist Jason Aten said that Meta's new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages." (Techdirt, Oct 6, Apple developer announcement)
• Zero-day in the Mac app (patched Sept 22). Found by Patrick Wardle: an undocumented setting let local attackers redirect Muse's cloud transcription to their own endpoint and take over the account; PoCs could take pictures and write files without alerting the user. (The Verge)
• Rushed launch over a VM-escape bug. 404 Media (Oct 5): a pre-launch bug "could have allowed [Muse] to escape its virtual machine and access the company's databases and services." A Meta source: security teams were told to push hotfixes "in a way that wouldn't delay Muse's launch, leading to what they described as 'half-baked protections being rushed out to enable the launch.'" Techdirt adds: "Many senior engineers believe it's inevitable we're going to have a massive data breach as a result of Hatch" — Muse is called "Hatch" internally. (The Verge hub, Oct 5; 404 Media)
• Trivially exportable filesystem / weak injection resistance. Two developers independently "coaxed Muse into zipping up and sharing the entire contents of its root filesystem"; one researcher: "Almost no prompt injection resistance." Meta's spokesperson: "Just like with the laptop in front of you, of course you can see the files." (The Verge)
• Amazon blocked Muse outright (Sept 21). Popup: "continued access by an unauthorized AI agent violates Amazon's Conditions of Use¹." Per GeekWire, Meta never notified Amazon, and Amazon flagged Muse "failing to identify itself when it browses, and seemingly capturing customer credentials." (The Verge)

Regulatory answer so far: platforms, not government. As of Oct 12, no FTC, state-AG, or EU action on Muse (or any consumer agent) surfaced in searches; the binding responses have come from Apple (macOS Full Disk Access tightening) and Amazon (blocking). Techdirt's read: "it's also extremely clear that Meta doesn't fear any meaningful government accountability or oversight, or the product would have spent significantly more time in the oven." Wired separately found Muse "consistently creates detailed profiles of all your friends, family, colleagues" — the data-maximization critique from EFF-adjacent commentators is that these tools solicit "their emails, calendars, financial institutions, everything," which will "lead[] to a ballooning of what they know about users."

Meanwhile, Meta is racing to convert virality into enterprise/SMB distribution. Sept 28: Meta Enterprise Platform launched, led by former MongoDB CEO CJ Desai as chief enterprise platform officer (Meta Business Agent, Muse API, Muse Code). Sept 29: Muse for Small Business added integrations with Asana, Box, Canva, Dropbox, Figma, Notion, Slack, Stripe, Zoom, plus Facebook/Instagram business accounts (The Verge hub; Meta Newsroom). The Verge also reports Muse and the $2.5B-valuation startup Instinct look structurally like OpenClaw under the hood (same SOUL.md/memory/tools layout) — the consumer-agent layer is consolidating on open-source agent runtimes with all their known risks (OpenAI's "Dots" and the Personal-Agent Land Grab: Always-On Agents Go Mainstream (Sept 29 – Oct 2026), Governance and Security: Senate "Rogue AI" Hearing, METR Testimony, and the Kill-Switch Gap (Early October 2026)).

What it means for adoption: consumer always-on agents are scaling faster than their trust infrastructure, and the corrective forces in late 2026 are OS vendors and super-sites, not regulators. For enterprise and SMB buyers watching Muse, the incidents are a live demonstration of the permission-scoping, agent-identity, and audit-trail problems documented in Agent-to-Agent Risk Across Company Boundaries: The Next Governance Gap (Oct 2026) — now playing out in consumers' kitchens.