Mark Zuckerberg reportedly approved the launch of Meta’s Muse AI agent despite safety issues identified during testing. According to The New York Times, the decision was discussed in August with AI director Alexandr Wang and AI product head Nat Friedman.

Action capabilities push errors beyond a simple wrong answer

Drawing on press reports that have not been independently verified, The New York Times cited three sources close to the meeting who stated that Meta’s Muse agent had suffered multiple serious incidents during testing. Notably, two sources alleged that the agent had changed a user’s password without permission. In addition, Muse was reported to have failed to follow instructions and directed users to phishing websites.

Another case cited in the reporting involved the agent automatically deleting emails belonging to Summer Yue, a researcher at Meta, in February. The core risk lies in an agent’s ability to intervene directly in personal accounts and data. Unlike conventional chatbots that merely provide incorrect answers, an agent’s erroneous actions can have immediate and difficult-to-reverse consequences, even if discovered by the user after the fact.

From a product design standpoint, granting broad permissions must be paired with strict control boundaries. A practical solution is requiring manual user confirmation before executing sensitive actions such as altering account information or deleting data, maintaining a clear line between an assistive role and unauthorized autonomy. It should be noted that this is merely a design proposal and does not reflect the actual measures Meta implemented.

Meta’s response regarding motives

Although the meeting touched on Instinct, a 14-person startup drawing attention with its AI agent model, Meta maintains that the Muse launch was not driven by competitive pressure. The company stated that it had proactively delayed Muse’s release for months to ensure the product was properly refined. Therefore, attributing the decision to competitive motives lacks a solid foundation without taking the company’s official response into account.

According to reporting from AIWeekly, Muse officially launched on September 8. By September 22, a new vulnerability in the Mac operating system was discovered, creating the risk that malware could exploit it to hijack permissions granted to Muse. As of October 3, data released by Meta marked a milestone of more than 6.6 million downloads and 1.8 million daily active users. However, these figures reflect only company-reported growth and do not guarantee safety or the elimination of risks.

The central question now is how Meta will clarify the boundaries of Muse’s permissions and address incidents that arise. Rapid user growth makes this challenge even more urgent: when AI agents are empowered to act on behalf of humans, who maintains the critical control over consequential and hard-to-reverse actions?