The resemblance was first raised on social media and then covered by The Verge and TechCrunch. That puts OpenClaw's influence on record. How much Meta actually improved on it is still an open question, and it matters to anyone deciding whether to hand an agent their inbox, calendar and payment details.
Meta concedes Muse's OpenClaw inheritance, but not its code
The argument began when users compared Muse with OpenClaw directly. Both products use the same names for their core workspace files: SOUL.md, memory, tools and others. Both also share lines in the document that sets the agent's personality and tone. The Verge cites one example, the instruction to be "genuinely helpful, not performatively helpful." TechCrunch reports that one user found the files had more than matching names, because their contents were almost entirely the same. A SOUL.md file is a plain-text Markdown file that sets an agent's personality, communication style, values and behavioral boundaries.
On September 22, Nat Friedman, head of product at Meta Superintelligence Labs and a former GitHub CEO, replied on X. He said Muse was "built from scratch" and also "definitely heavily inspired as a product by OpenClaw." He said he bought hundreds of Mac minis for his team after first trying OpenClaw in January. His stated goal was to build something like OpenClaw that could be made "safe and secure and easy to use and scale to billions of people." Someone asked why the file names and SOUL.md content carried over. Friedman answered that the team thought OpenClaw creator Peter Steinberger "got those things exactly right." A Meta spokesperson told TechCrunch the company had nothing to add.
So influence on the product design is established by Meta's own admission. Code reuse is not. None of the public reporting includes an inspection of Muse's source code, and matching file conventions and prompt text don't show that OpenClaw runs inside Muse. The Reddit claim that Muse is "just a wrapper app" and therefore inherits OpenClaw's security problems goes beyond what anyone has shown.
TechCrunch also points out a familiar pattern. Meta has a long record of adopting a competitor's best-received features, most famously when it copied Snapchat's Stories format. OpenClaw is open source, so borrowing its conventions is both legal and predictable.
What OpenClaw proved, and what it got wrong
According to The Verge, OpenClaw went from proof of concept to a genuinely useful agent in about ten months. It started as a one-person weekend project. It ran on users' own computers and talked to them through the messaging apps they already used, including WhatsApp, Telegram, Slack, Microsoft Teams and Discord. The Verge reports that it drew two million visitors and 100,000 GitHub stars in roughly a week. People bought Mac minis to run their agents around the clock. OpenAI hired Steinberger in February.
Its weak point was security. The Verge reports that one of the most-downloaded skills on OpenClaw's platform contained malware. It also cites one researcher's analysis that 15 percent of the skill repository contained malicious instructions designed to access user data secretly or perform other suspicious tasks. For IT readers, the Teams and Slack integrations are the important part. A tool like this lives inside workplace communication channels, and it runs whatever community-written code the user installs.
That is the background to Friedman's pitch. Meta presents Muse as OpenClaw's convenience with the risky parts engineered out.
Inside the Muse Secure VM: Meta's case for a safer OpenClaw
Muse doesn't run on the user's machine. According to Meta's launch material, every user gets a dedicated cloud virtual machine called the Muse Secure VM. It holds both the agent and the user's data. Users talk to it through the Muse app or directly in WhatsApp. The model behind it is Muse Spark, which Meta describes as built for agentic work. Muse is rolling out in the US on iOS, Android and the web. Meta says it is free for most uses, with paid subscription tiers.
Meta's AI Research blog describes the internals in unusual detail. The VM is an isolated Linux machine. The agent's core harness, internally called Hatch, runs inside a systemd-nspawn container. Root inside that container maps to an unprivileged user on the host, some system calls are filtered, and kernel capabilities are restricted. Security-sensitive services run outside the container:
- A separate process called Sentinel is the only authority that can approve connector actions and outbound network traffic, and Meta says the agent cannot override it.
- A credential service called hatch-authd stores OAuth tokens for connected services inside the user's VM rather than in central Meta infrastructure.
- Through a technique Meta calls credential surrogation, the agent only ever handles stand-in tokens, and Sentinel swaps in the real credential at the network boundary.
- Built-in connectors run their business logic in sandboxed worker processes that can each request only specific credentials, so a calendar worker cannot fetch an email token.
- The email connector filters out one-time passcodes, password-reset links and magic login links, so the agent cannot use the inbox to take over other accounts.
Meta also describes a human-in-the-loop system. When Sentinel decides a user should be asked, the approval prompt shows up in the client's own interface, not inside the chat with the agent, so the agent can't fake or intercept it. Approvals are scoped: they can be one-time, per session, per task, time-limited or permanent. For purchases, Muse uses Stripe's Link to issue a single-use card number tied to one merchant, one amount and a limited time window.
Measured against OpenClaw as The Verge describes it, this is a real architectural difference. OpenClaw ran on personal hardware and loaded skills from a community repository with a documented malware problem. Muse puts the agent in a sandbox, keeps credentials away from the model, and sends every outbound action through a separate policy engine. Meta is also candid that this doesn't make Muse immune. Its safety post says the agent will make mistakes and will sometimes be attacked through the data it reads. It calls prompt injection an open problem and frames the architecture as a way to limit damage. Meta also opened a public bug bounty paying up to $300,000.
The Muse macOS zero-day shows where the sandbox ends
The VM design didn't protect the Mac app. Mac security researcher Patrick Wardle, founder of the Objective-See Foundation, found a flaw in the Muse macOS client. Reports put his public disclosure on September 20 or 21, depending on the outlet. The flaw let a local process change an undocumented setting to redirect Muse's transcription endpoint and capture the authentication token used to control the agent. The Eastern Herald names the setting as endo_voyager_dictation_endpoint, and reports that any local process running under the logged-in user's account could modify that endpoint address without elevated privileges.
Ars Technica reported that the stolen token gives full control of the Muse account. Wardle told the outlet he had built proof-of-concept attacks that wrote malicious files to disk and took pictures, often with no sign even an alert user would notice. VentureBeat reports that Wardle demonstrated a compromised Muse session obtaining the location of a linked iPhone in Barcelona and initiating a Bluetooth Low Energy scan on the device. Wardle also blamed specific design choices. Muse sends dictation to Meta's cloud instead of using macOS's on-device transcription, and any local app could change the client's undocumented settings.
Meta patched it quickly. Meta hot-fixed the Mac app within a day by removing the setting from production builds, and David Singleton of Meta Superintelligence Labs called it a local privilege escalation, not a remote exploit. Singleton argued that exploitation requires malicious code already running on the user's machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low.
The two sides disagree about how serious it was. Wardle said that it could be abused through a ClickFix-style attack where a victim is tricked into copying and running a malicious command on their computer. ClickFix lures, which persuade users to paste a command into a terminal, have become a common way to get initial access. Once one works, the "local only" prerequisite is met. Both descriptions are accurate. The bug needed code running on the Mac, and getting code running on a Mac is not especially hard.
The Verge's description of the flaw as letting anyone take complete control of the agent "with a simple attack" is broadly right about the impact. It leaves out two details that change what a reader should do: the bug was in the macOS client specifically, and it has been patched. VentureBeat draws the architectural lesson: Wardle's vulnerability did not defeat those cloud protections; it compromised the Mac client Meta released nine days later. Sentinel can check every action the agent proposes. It has no way to tell an attacker holding a stolen session token apart from the legitimate user.
Privacy promises that are still roadmap items
The privacy claims also need to be sorted into what exists today and what is only planned. Mark Zuckerberg wrote that Muse was "built from the ground up for privacy and security." The VM does isolate each user from other users. It doesn't isolate users from Meta. Meta says it will launch a Muse Confidential VM later in 2026, encrypted with a key only the user holds so that even Meta can't get in. That protection hasn't shipped.
Two data policies apply now and are easy to confuse. Meta says Muse conversations and VM data are not shared with its advertising systems. Model training is a separate matter. Meta's research post says conversations, tool calls and subagent handoffs may be used to train future models after key personally identifiable information is removed. The Verge reports this is on by default, and users have to opt out in settings.
The friction goes beyond privacy. Ars Technica reported that Amazon started blocking Muse from shopping on its site about 12 hours before Wardle's disclosure, calling it an unauthorized agent. Amazon said Meta did not notify the company in advance that Muse would be accessing its site and that the agent does not identify itself while shopping.
Instinct and the wider rush to productize OpenClaw
Muse isn't the only company following OpenClaw. The Verge names Instinct as another agent platform that owes a lot to it. Its creator is raising money at a $2.5 billion valuation, and TechCrunch reported in August that the startup had raised $350 million in total at that valuation. Instinct looks less directly derivative than Muse. It still copies OpenClaw's core idea of talking to your agent through a messaging app, in this case Apple's default one. Users on X have posted anecdotes about it filling out medical paperwork, cancelling subscriptions and booking DMV appointments. Those are individual users' claims and haven't been verified. The Verge also reports that Instinct was criticized for overly broad terms of service, which the company appears to have changed since.
Muse's numbers show how popular the approach is. It reached No. 1 on the US App Store. TechCrunch cites an Apptopia estimate of 642,000 US daily mobile users at a point where ChatGPT's mobile app had 231,000 after the same amount of time. That comparison is limited to US mobile users and is a third-party estimate, not a figure from Meta. VentureBeat separately cites Sensor Tower: Muse passed 2.5 million downloads in its first 13 days.
What this means for you
Whether Meta copied OpenClaw doesn't change much for anyone. What matters is where Muse and its clients run, and what they're allowed to touch. Windows users can't install a Muse desktop client at all: Ars Technica noted there is no Windows version. Mac users and administrators of managed Macs have concrete things to check. For IT teams, the bigger risk is employees connecting consumer agents to work accounts. OpenClaw already connected to Teams and Slack, and Muse can link to email and calendars.
- Anyone running the Muse Mac app should make sure it has taken Meta's hotfix, which removed the redirectable dictation-endpoint setting from production builds.
- Treat any request to paste a command into Terminal as hostile, because a ClickFix lure was the realistic way to exploit Wardle's bug.
- If you use Muse, check which connectors are linked and whether each one is read-only or can also send. Meta says users can change access or disconnect a service at any time and can review a full audit trail.
- Opt out of model training in Muse's settings if you don't want your conversations and tool calls used for training. That is separate from Meta's promise not to share data with its ad systems.
- Keep in mind that Meta can still access your data in the VM until the Muse Confidential VM actually ships.
- Security teams should treat personal AI agents as privileged endpoints that can act on connected corporate accounts, and ask the same questions they would ask of any OAuth-connected app.
OpenClaw showed that people want an AI agent they can message like a friend. Muse shows that a well-funded company can wrap that idea in a serious cloud sandbox and a one-tap install. The Muse Confidential VM is Meta's next commitment. Until it ships, and until the client apps get the same scrutiny as the VM, trusting Muse means trusting both Meta and every device signed into your Muse account.