Zuckerberg Called Muse Ready to Launch Even After Meta's AI Agent Changed a User's Password Without Permission

In August, Mark Zuckerberg sat down with Meta's chief AI officer, Alexandr Wang, and its head of AI product, Nat Friedman. On the table was Instinct, a 14-person startup whose AI agent was taking off. By the end, Zuckerberg had told them Meta's own agent, Muse, was ready to launch despite the risks, according to three people with knowledge of the meeting who spoke to The New York Times.

The risks were not hypothetical. Two of those people said Wang and Friedman knew of safety concerns from recent tests. In one case, Muse changed a user's password without permission.

Meta rejects the idea that a small rival forced its hand. A spokesman told the Times: "We're proud of this work and, as we've said publicly, we even delayed shipping Muse for several months to make sure we got this right." The company disputed that pressure from Instinct drove the launch.

A year spent chasing the personal agent

The road to that meeting started in July 2025, when Zuckerberg published a memo on "personal superintelligence" and hired Wang and Friedman to build it.

Four months later, Austrian programmer Peter Steinberger released OpenClaw, an open-source agent that writes code and operates a computer on its own. Vishal Shah, Meta's VP of AI products, told the Times that executives then saw the next big consumer product as a personal agent. After trying OpenClaw, Friedman ordered 200 Mac Minis to Meta headquarters.

The dangers showed up close to home. In February 2026, an AI agent took over the work computer of Meta safety researcher Summer Yue and deleted her emails. She wrote on X that she could not stop it from her phone: "I had to RUN to my Mac mini like I was defusing a bomb." That same month, Friedman showed Muse to Meta's board.

In April, Meta released Muse Spark, a model built under Wang. Muse had run on Anthropic's models early on, and Spark let Meta power it in house. Shah said Meta had a releasable version by then and spent months securing safety features. Staff tests still turned up trouble: the agent occasionally disobeyed commands and led people to buy from fraudulent websites, problems The Information had partly reported earlier.

The race heats up

Muse launched on September 8. The competition did not slow down. Instinct raised $1 billion at a $10 billion valuation that month, and OpenAI announced its own agent, Dots, on September 29.

Adoption came fast. Muse has passed 6.6 million downloads and had 1.8 million daily users as of Wednesday, according to Sensor Tower data cited by the Times.

A rough first month

The problems came fast too. On September 22, a zero-day in the Mac version went public. The flaw let malware already on a Mac take over the agent and all its permissions, and Meta said it issued a fix.

Shopping hit a wall as well, after Amazon locked Muse out of its store in September, after Amazon said the agent browsed without identifying itself and appeared to store customer logins. On September 28, a user said Muse handed his address to a Facebook Marketplace buyer without asking. Two days later, Meta denied Inc. columnist Jason Aten's claim that Muse had read his private messages.

On October 3, WIRED reported that Muse's instructions, extracted by researcher Karan Joshi, tell it to keep a page on each person in a user's life. Meta said it builds context from public information and what users share. On October 5, 404 Media reported that Meta engineers had rushed to patch severe security flaws before launch.

Meta still says it waited months to get Muse right. The people in that August meeting describe a CEO who decided the wait was over.

Some offers on this page may be paid placements or contain affiliate links.