Muse: when the company that owns the thread ships the agent

Every other agent in this directory reaches a messaging app from the outside: through a business API, a review, a rented line, or a Mac in a cupboard. On 8 September 2026 the company that owns the app shipped one from the inside. Five days later Muse has drawn 34 posts and sightings here, against 22 for Instinct over the same days, and the rows it fills and the rows it leaves blank say what a platform owner does differently.

What happened, in five days

Meta announced Muse on 8 September as a personal agent you reach in the Muse app or directly in WhatsApp, running on a computer of its own in the cloud, free for most of what people need. The same day it published a security write-up: a persistent Linux virtual machine per user with its own browser, an egress guard that approves anything leaving it, an audit trail, a credential store the agent cannot read, and one-time card numbers for shopping.

An analyst wrote it up as an isolated Linux box per user. A user costed the free tier at what it must be costing Meta. Another gave the same job to Muse and Instinct and one of them booked it.

On 12 September a Meta engineer showed Muse writing its own connectors, code it runs in that same VM to reach any service with an API. That night Meta's chief AI officer launched a challenge: can your Muse make you $1,000, post it under a hashtag. The first entries arrived by morning.

What the rows say it does differently

It publishes what the others do not. Of the 76 agents here, 11 publish any document about their own security, and Muse's is the only one that describes a threat model rather than a posture. 2 state a paid bounty; Muse's is up to $300,000 through Meta's programme, with a prompt injection against one user priced at up to $130,000, and the other is Zo's. 2 hand the model a surrogate rather than the secret; Muse's write-up says OAuth tokens live in the user's VM and not in Meta's infrastructure, and the card the agent shops with is a one-time number; the other is asaply, which pays with Apple Pay and never sees the card.

Those are the three rows the trust pieces on this site count hardest, and a company that sells advertising fills all three on day one.

It owns the channel, and it says less about it than the renters do. 17 listings reach WhatsApp. Every other one works inside Meta's business messaging rules: outbound from approved templates, free-form replies only in a window after the person writes first, and every one of them names the provider that carries its messages because the provider makes them. Muse's provider row says Meta, because Meta is the platform.

What the row does not say is anything a renter would have to publish: no number, no statement of how the WhatsApp thread starts, and no word on whether the initiation rules that bind the renters bind the owner. The muse-vs-poke comparison put it as the most consequential open question on the channel, and five days have not closed it.

It trains unless you switch it off. 6 listings take that position, and Muse's sentence is the plainest of them: a switch in settings, off by default. That is the same answer Poke gives and the opposite of folk's, and the company behind it is the one whose business is what it knows about you. The conversation about what Muse arrives already knowing is on the comparison; the row here is the sentence.

It publishes no price above free, and two users have. Meta's page says free for most of what people need and subscriptions for more, and names nothing. One user's upgrade sheet showed $20 and $100 a month; another costed the tiers at $16 and $80; the listing records both as the users' figures and neither as Meta's. A company that publishes a threat model and not a price list has decided which of the two it wants read.

The campaign, and what it does to the evidence

The challenge is a distribution move this directory has not recorded for any other listing: a company asking its users to post what the agent earned or saved them, under a hashtag, with screenshots. Every entry is exactly the shape of thing filed here as a sighting, and every entry is a user's claim inside the vendor's frame.

The first one, a user who steered an Instagram feed towards companies giving away products for a demo, is recorded with the frame stated, and so will the rest be. The count at the top of this page will rise with the campaign; that is what a campaign is for, and it is why the number is beside Instinct's rather than alone.

What is not known

Where inference runs. The write-up is precise about the VM and silent about the model's location, and the listing's row is blank. How the WhatsApp thread begins, and whether a person can start one without the app. Whether Meta's own messaging rules apply to Meta. What a subscription costs, from Meta. And whether the campaign's entries describe a product or a promotion; the two look identical in a screenshot.

What to watch

Whether a third product states a paid bounty, and whether a third hands its model a surrogate rather than the secret; both are two-listing rows today. Whether the WhatsApp count moves, because the sixteen are the renters and the owner, and an owner in the market changes what renting is worth. And whether Meta publishes a number, a price or the initiation answer, any of which turns a blank row into a sentence on the listing the day it appears.