Amazon has blocked the assistant from shopping on its marketplace, while a macOS flaw showed how Muse's broad local privileges can be turned against the user. Early adoption gives Meta distribution; monetization still depends on permission and security beyond Meta's own interface.
Meta's Muse has reached the uncomfortable stage of the consumer-agent experiment where model capability is no longer the only constraint. Amazon began blocking Muse from shopping on its marketplace, calling it an unauthorized AI agent under its conditions of use. Hours later, security researcher Patrick Wardle disclosed a macOS flaw that let locally running apps or terminal commands redirect Muse's transcription endpoint and capture the authentication token controlling the assistant. Meta subsequently issued a hotfix.
The two events arise from different systems, but they expose the same commercial problem. Muse becomes useful by acting across services and by holding privileges on the user's device. Those powers depend on counterparties Meta does not control.
Amazon's block is the clearest example. A shopping agent can compare products and make selections, yet the marketplace still decides whether automated software may touch inventory, accounts and checkout. Amazon told users that continued access by an unauthorized agent violated its terms. Meta can improve Muse's reasoning indefinitely and still cannot compel Amazon to accept the transaction.
That creates a bargaining layer above the model. Agents may own the conversation and capture user intent; marketplaces still control access to the commercial surface where inventory, advertising, recommendations, fraud handling and fulfillment are monetized. Direct merchant connections, including Shopify integrations, give Meta one route around that dependency. Amazon remains too large a destination to treat as incidental.
The Wardle disclosure exposes the second dependency. Muse asks users for extensive access to accounts and device resources because that access is what allows it to act. Wardle found that an unprivileged local process could alter an undocumented setting, redirect the transcription endpoint and obtain the user's Muse token. Meta characterized the issue as a local privilege-escalation attack rather than a remote exploit and issued a hotfix.
The security lesson is narrower than saying autonomous agents are inherently unsafe. The more useful conclusion is that an agent can magnify the consequences of a local compromise because it centralizes authenticated authority over many services. Identity, token protection and execution permissions become part of the product's economic reliability.
Muse's launch has already shown that consumer demand can arrive faster than the commercial rules around it. Meta now has to turn that demand into a network of permitted transactions without letting the privileges that make the agent useful become a cheap escalation path for attackers. Those two constraints will shape the business at least as much as another improvement in model quality.