The chart position is real, but it is not proof that Meta has solved autonomous AI assistance. It does show that Meta has quickly found consumer demand for a product pitched less as another chatbot and more as a cloud-hosted worker that can carry out multistep tasks in a browser. For Windows users and IT administrators, Muse is worth watching because its defining technology is not an iPhone interface: it is a persistent remote virtual machine acting with access to email, calendars, connected services and, potentially, payment flows.
Meta’s launch is also an immediate competitive problem for Microsoft Copilot, Google Gemini, OpenAI’s ChatGPT and Anthropic’s Claude. Those services increasingly offer tools, connectors and forms of agentic work, but Muse has put an unusually direct consumer proposition in front of users: give it an errand, permit the relevant account access, and let it work after the chat window is closed.
The No. 1 ranking is a download signal, not an adoption verdict
The submitted report correctly identifies Muse as Apple’s leading U.S. free app as of Friday, September 18. Axios independently reported that it had climbed to the top of the U.S. free iPhone chart, ahead of ChatGPT, Gemini and Claude. Apple’s rankings are inherently volatile, however, and a free-chart lead measures recent installs rather than retained users, completed tasks, accuracy, or the number of people willing to connect their most sensitive accounts.
The early trajectory also needs context. TechCrunch reported on September 10 that Muse had reached No. 2 but that its initial download performance trailed Meta’s earlier launches of Threads and the Meta AI app. A top ranking a week later is therefore a meaningful reversal in chart placement, but not evidence of record-setting scale across Meta’s product history.
Nor should readers give too much weight to a static list of rival positions. App Store charts shift throughout the day, vary by country and category, and compare products with radically different installed bases. A new, heavily promoted app can rise quickly because users must download it to try it; ChatGPT, Copilot and Gemini already sit on millions of phones. The useful conclusion is narrower: Muse has broken through the consumer-discovery barrier quickly, which most AI agent products have struggled to do.
The source’s reference to “SpaceXAI’s Grok” is wrong. Grok is developed by xAI, not SpaceX. That may read like a minor naming error, but it matters in a story framed as a competitive ranking: the company names are the basic record.
Muse’s actual product is a remote browser with delegated authority
Meta calls Muse a personal AI agent powered by its Muse Spark model. The company says users can interact with it in the standalone Muse app, on the web, through WhatsApp, and on Android and iOS. There is no announced native Windows Muse client in Meta’s launch material; Windows users can access the web service, but the actual work happens in Meta’s cloud rather than on their PCs.
That architecture is the key distinction. Meta says each user gets a dedicated “Muse Secure VM,” a virtual machine with its own browser. The agent can use direct integrations where available; TechCrunch reports that it can also operate a website through that browser when there is no API connection. In practice, that creates a remote operator able to move through ordinary web workflows: searching, entering data, comparing options, preparing messages and, with approval, taking actions.
Meta’s published examples include booking travel, making reservations, sending email, completing forms, assembling shopping lists, managing a calendar and shopping online. Axios has also reported that Meta is testing a feature that would allow Muse to make telephone calls on a user’s behalf. That feature is still a test, not a general capability readers should assume is available.
The distinction between planning and acting is what gives Muse its appeal — and its risk. A conventional assistant can draft an email or explain airline options. A browser-running agent may be able to fill in the recipient field, select an itinerary, submit the form, or initiate a purchase. Once software is allowed to make persistent changes outside its own chat interface, an incorrect inference is no longer merely an incorrect answer.
Meta recognizes that boundary in its own terms. The company warns users not to allow highly autonomous state-changing actions — such as communications, transactions, deleting data or modifying system configurations — without human review or preauthorization. The terms place the legal responsibility for the resulting actions on the user and state that users bear financial-loss risk connected to transactions. That is a substantially more important operational limitation than a promotional claim that Muse “asks permission” for significant steps.
The security model has useful controls, but important protections are still future-tense
Meta says Muse’s credentials and connected-service tokens are kept separately from the main agent runtime, and that the agent itself cannot view users’ passwords or payment details. The company describes a second component, called Sentinel, which reviews external actions before they reach the internet. It says the system will seek confirmation before sensitive actions such as sending email or making a purchase and maintains an audit trail of actions taken and planned.
Meta’s technical security post gives more implementation detail than most consumer-agent launches. It says the operational environment uses Linux isolation primitives and a systemd-nspawn runtime container, with root inside the agent container mapped to an unprivileged host user rather than host-level root. The runtime is described as having a separate Debian image, restricted kernel capabilities and filtered system calls.
Those are meaningful containment design choices, particularly compared with an agent running with broad permissions on a local Windows machine. But they do not eliminate the central exposure: Muse is deliberately authorized to act on a user’s behalf across third-party accounts. Container isolation can reduce the impact of a compromise inside Meta’s environment; it cannot ensure the agent always understands a user’s intent, recognizes a deceptive webpage, or makes correct judgments about a transaction.
The strongest privacy promise Meta has advertised is also not generally available yet. Meta says a “Muse Confidential VM,” in which the VM and its data would be encrypted with a key held only by the user, will arrive later in 2026. Meta Research says the company is still gathering auditor feedback and plans a public, continuous audit after that product launches. Until then, readers should treat the confidential-VM claim as a roadmap item, not as a protection present in the version climbing the App Store charts.
Meta also says it does not send Muse conversations or VM data to its advertising systems, and users can opt out of having interactions used to train future AI models. Its security documentation nevertheless states that sanitized conversation and tool-use data can be used for model training by default. The practical reading is straightforward: turn off training in Muse settings before connecting work email, proprietary files or high-value personal accounts if that data use is unacceptable.
What Windows users should — and should not — delegate
Muse’s cloud-browser design means Windows users are not installing an autonomous process with local access to their desktop, documents or corporate network. That limits one obvious class of endpoint risk. It does not make Muse suitable for enterprise accounts by default, because authority over SaaS data can be more consequential than local filesystem access.
A personal agent with mailbox and calendar access could read meeting details, contact lists, invoices, travel plans, password-reset messages and internal discussions. It could also leave traces on every service it visits. Meta itself notes that browsing initiated by Muse appears as the user’s activity to third-party sites, which may affect subsequent advertising or tracking outside Meta’s own ad systems.
For now, the prudent operating model is to begin with reversible, low-consequence jobs:
- Use Muse to research options, build a draft itinerary or prepare a form, but inspect the final result before it is submitted.
- Connect a secondary or personal account first rather than a work mailbox, privileged administrator account or shared finance account.
- Do not grant permission to send email, spend money, delete data, or change subscriptions until the approval flow has been tested and understood.
- Review the audit trail after each meaningful task, and revoke a connected service rather than assuming an old permission is harmless.
- Disable model-training use in settings if the account will expose sensitive correspondence, files or task history.
Enterprise IT teams should treat Muse as a third-party automation and identity-integration request, not as a consumer app download. The relevant policy questions are the same ones raised by any delegated SaaS agent: which OAuth scopes it receives, whether it may impersonate users, where its task artifacts reside, how long they are retained, whether logs can be exported, and how access is revoked when an employee leaves.
Meta has solved distribution before it has proved reliability
Muse’s early chart success gives Meta something its AI efforts have needed: a consumer-facing product people recognize as distinct from the generic “ask a chatbot” experience. Its WhatsApp and Instagram adjacency, vast marketing reach and free entry tier give it an advantage that smaller agent startups cannot match. The $20-per-month Power plan and $100-per-month Maximum plan also reveal the business model beneath the launch: an agent that consumes substantial compute while carrying out work, not simply answering occasional questions.
But the most consequential validation has not happened yet. Meta has shown the design, described the containment system and secured a rush of installations. It has not publicly established long-term task success rates, error rates in real transaction flows, the scope of third-party app permissions users are granting, or independent results from the auditors it says will inspect Confidential VM.
Muse has become the app to watch because it places AI agents in front of mainstream users as software that can do things, not merely talk about them. The immediate consequence is that consumer AI competition has shifted toward delegated authority — and users who hand that authority to Muse are still responsible for every email, purchase and irreversible change it makes.
Update: Meta says Muse gave an incorrect explanation of Mac message access (September 19, 2026)
A new Mac-specific privacy concern has emerged around Muse. The Verge reported that Jason Aten shared screenshots showing Muse referring to a Messages conversation despite his claim that he had not enabled message access. When challenged, Muse said it had seen notification previews through the paired Mac app.
Meta Superintelligence Labs executive David Singleton disputed that explanation. He said Muse does not monitor Mac notifications and only syncs Messages data after a user explicitly enables access; according to Singleton, the assistant was confused about its own capabilities and gave an incorrect account of how the feature works. Meta apologized and said it is working to make Muse explain its internal behavior more reliably.
The clarification does not establish that Muse accessed Messages without permission, but it creates a separate reliability problem: users cannot safely rely on the agent’s own statements to understand what data it can see. The new Mac app can access Messages, Calendar and Notes through opt-in permissions, making the exact grants especially important for users who handle sensitive personal or business information.
Windows users accessing Muse through the web are not directly affected by the Mac permission model, but IT teams should treat this as a warning for any future desktop integration. Verify permissions in the operating system and the connected-service settings, rather than accepting an agent’s conversational explanation of its access.
Update: New estimates point to strong early Muse download volume (September 22, 2026)
TrendForce reports, citing TechCrunch and Apptopia estimates, that Muse logged about 1.8 million iOS downloads across the U.S. and Canada during its first 12 days. That compares with an estimated 1.3 million downloads for ChatGPT over the equivalent period after launch.
The figures add scale to Muse’s chart rise, but they remain third-party estimates rather than Meta disclosures and do not measure retained users, successful task completion, or how many users connected sensitive accounts.
Update: Reuters reports Muse call test used human contractors (September 23, 2026)
Reuters reports that Meta tested a “human concierge” system in which Muse could hand phone requests to trained contractors rather than complete the calls with AI alone. The internal test was reportedly enabled for roughly half of Meta employees last week after AI-only calling struggled in some situations.
According to Reuters, Meta has rolled the experiment back after employees raised privacy and disclosure concerns, including the possibility that a contractor could receive sensitive information during a call. Meta reportedly acknowledged that beginning the test without adequate disclosure was a mistake and says it will strengthen safeguards before any public release.
This changes the practical reading of Muse’s phone capability. The calling feature was already described as a test, but the new report indicates that its apparent automation may at times have depended on human intervention. Windows users are not directly affected by the Mac or mobile calling integration, but IT teams should require explicit disclosure and controls before allowing any agent to pass customer, employee, or account information to a human contractor.
Update: Report flags apparent Muse service strain as usage grows (September 24, 2026)
Wccftech reports that Muse is showing signs of service strain before reaching one million daily active users, citing Similarweb estimates of roughly 700,000 daily users and a “degraded” status listing from SaaSHub. Reported complaints include failed searches, while one stress test allegedly failed to create most of 120 requested sub-agents.
These are third-party signals rather than Meta-confirmed reliability metrics, so they do not establish a broad outage or quantify real-world task failures. However, they reinforce the article’s central caution: a dedicated cloud-VM agent is materially more expensive and operationally complex to run than a conventional chatbot.
For users and IT teams, the practical implication is to avoid depending on Muse for time-sensitive or irreversible workflows until Meta publishes clearer availability, capacity and task-success data. Approval checks remain necessary, but they do not help if an agent cannot reliably complete or resume a multi-step job.
Update: Muse is reportedly expanding to Meta smart glasses and a new wearable (September 24, 2026)
The Verge reports that Meta plans to bring Muse to its smart-glasses lineup and to a new standalone AI wearable called Charm. The report also identifies Muse’s official mascot as “Jolly,” following Meta’s Connect presentations.
For users, the expansion would shift Muse from a cloud agent used through phones and browsers toward an ambient assistant that can receive visual and voice context throughout the day. That may make capabilities such as identifying objects, comparing products, and acting on personal prompts more convenient, but it also raises the stakes around what contextual data the service receives.
The Verge’s hands-on testing found errors in a glasses-based food-recognition demo and a failed shopping-cart action, reinforcing that wearable access does not resolve the agent’s reliability limitations. Windows and IT administrators should treat any future Muse wearable integration as a new data-access surface, with separate reviews of microphone, camera, account-linking, and retention permissions.
Update: Hands-on report details Muse’s Stripe-backed shopping workflow (September 25, 2026)
PCWorld reports that Muse can use Link by Stripe to complete purchases across merchants, including through single-use virtual cards for stores that do not directly support Stripe’s wallet. According to the report, Muse cannot view the underlying card or bank-account details stored in a user’s Stripe account, and purchases are meant to require final explicit approval.
The hands-on testing also suggests shopping may be a more mature use case than general personal-assistant tasks. PCWorld found Muse could search across multiple ticket and retail sites from its cloud-hosted virtual machine, although its attempts at restaurant booking, Gmail triage, and commute assistance were less compelling.
One notable limitation is that Amazon has reportedly blocked Muse from accessing its website. That restricts the agent’s usefulness for users who expect a single assistant to compare Amazon listings alongside other retailers.
For users and IT teams, the Stripe integration makes the financial-control question more concrete: even if Muse is shielded from raw payment credentials, it may still be authorized to initiate purchases. Keep transaction approval enabled, use spending-limited payment methods where possible, and avoid linking corporate or shared finance accounts until the agent’s behavior has been independently tested.
Update: Report says Muse exposes limited sandbox command output, raising new escape concerns (September 25, 2026)
Tom’s Hardware reports that Muse can run some basic Ubuntu commands inside its persistent private sandbox and return the output to users. Screenshots shared by blogger Evan Hoffman and analyst Tae Kim reportedly identified two dedicated CPU cores, 8GB of memory, Ubuntu 24.04, and AMD EPYC Turin-based host infrastructure.
More importantly, Hoffman said Muse offered to help configure SSH access to its private VM. That does not demonstrate an escape from Meta’s environment, and attempts to query protected kernel data reportedly failed. Still, an agent that can suggest or execute shell-oriented setup steps creates a new attack-surface question beyond the browser automation described earlier.
The report should be treated cautiously: the alleged SSH path has not been independently demonstrated as a working tunnel or a compromise of Meta’s hosts. The command output appears to come from the user’s isolated Muse sandbox, not proof that Muse has administrative access to the underlying server.
For Windows users and IT teams, the practical guidance is unchanged but more urgent: do not treat a Muse VM as a general-purpose remote Linux machine, paste in network or SSH commands, or place credentials and internal tooling in its workspace. Meta’s containment claims matter most when the agent is prevented from turning a delegated browser session into a user-controlled remote execution environment.