Two Metas Talking About Muse

2026-09-16 — business growth strategy India

I sat in front of a browser watching an AI click through a checkout form. Nothing was broken. Nobody was panicking. It just felt wrong somehow.

That's the Muse thing everyone is launching right now — an agent that browses the web for you. And Meta published two documents about it on the same day, and they are almost describing different products.

What Gets Said, And What Doesn't

The consumer announcement is the one people will read. It says Muse is "built from the ground up to be a safe, secure, private, and widely available personal AI agent." No passwords leak. No payment methods exposed. Clean. Reassuring. Nothing spooky in the language.

Then there's the engineering post. Same product. Different story.

I actually counted. The announcement uses the words "risk," "attack," "attacker," "mistake," "untrusted," and "prompt injection" exactly zero times across roughly six thousand characters. The engineering post uses them 39 times between them. Thirty-nine.

That's not a small thing.

Most consultants get this wrong, including us sometimes — they see the gap and think it's dishonesty. It's not. Meta says that Muse runs in its own "dedicated, secure computer with its own browser," Muse Secure VM, which offers various privacy, safety, and security protections. That's true. The engineering post backs every single claim with actual mechanisms. Isolation. Containers. A separate agent called Sentinel that guards the door.

What's true is that the announcement doesn't need to say "prompt injection." People buying insurance don't need to understand actuarial tables.

Actually, that's not quite right.

When an agent has access to your actual accounts — your email, your shopping, your banking — the gap between what gets marketed and what keeps it from breaking matters more. Because the engineers were "handing inboxes, calendars, and a shell to a piece of software and letting it run unattended — which didn't always work out as planned." They tried it themselves. Stuff broke.

Why Browser-Based Agents Are Doing This Backward

Here's the structural problem everyone keeps skipping past. The web was built for human eyes. Forms, layouts, clickable areas — all of it designed for someone looking at a screen. An AI agent has to guess at it, infer it, click it. That's the hardest way to do the job.

Every browser-based agent — Muse, Gemini in Chrome, Claude in Chrome before it — they all pick up a browser and drive it like a human would. Watch an AI click through a checkout while you're sitting there. It's not automation. It's supervision with extra steps.

Muse's solution is to move the whole thing into a virtual machine somewhere. You talk to it. It clicks stuff on a machine that only it can see. That's smarter than switching to a new browser or bolting AI into the side of Chrome. But it raises other questions.

A browser on Meta's hardware, logged into your accounts. That's real authentication and identity work. The kind that takes time and stays invisible when it works, and breaks everything when it doesn't.

The Shape Keeps Changing

The product shape for this has shifted three times in less than two years. First came standalone browsers you installed. OpenAI's Atlas launched in October 2025 and lasted until August 2026. Then AI bolted into the existing browser — Gemini in Chrome, Claude in Chrome. Now a browser living on Meta's VM, something like that.

Each shape solves one problem and creates another. The pitch stays the same though. We can save you time. We can do your work. None of these have moved from "interesting demo" to "everyone's using this to actually get things done."

I know plenty of people who have tried these products. I don't know anyone who switched to one as their main way of working. Not one person.

That tells me something about the gap between a browser-based agent that theoretically works and a browser-based agent that actually saves you time instead of eating it.

Source: "We designed the system to assume the agent may be under attack and limit the potential damage." — Meta AI Research