On September 8, Meta handed a consumer AI agent three things that used to be considered untouchable: access to your email, your calendar, and a way to spend your money. The agent is called Muse, it launched the same day OpenAI was fielding accusations about a stolen math proof, and the timing was probably not an accident. A launch that would normally dominate the tech news cycle got buried under the Navier-Stokes controversy instead.
I run my own AI agent infrastructure, the kind that publishes articles and manages my content pipeline while I sleep. My agents have strict boundaries: no bank accounts, no email sending, no purchases. So when two of the biggest companies on the planet shipped consumer agents with payment rails attached in the same year, I read both architecture documents closely. This article is that comparison.
One full disclosure before anything else: Muse is US-only at launch and I am in Bangladesh, so I have not used it. Everything below comes from Meta's announcement, coverage by WIRED, TechCrunch, and SiliconANGLE, and OpenAI's own system card and help docs, with my judgment layered on top. Where a claim is Meta's marketing, I say so.
What Muse actually is
Muse is a personal agent that lives in Meta's cloud. You message it from a dedicated iOS or Android app, from muse.ai on the web, or from inside WhatsApp, and it opens its own browser and does things on your behalf: sending email, booking travel, filling out forms, negotiating bills, turning a recipe reel into a grocery list, and completing purchases.
The pricing structure tells you who Meta thinks will use it:
- Free tier with a usage meter that warns you before an action crosses into paid territory.
- Power at $20 per month and Maximum at $100 per month for heavy usage.
- A payment card is required to sign up, even for the free tier, which TechCrunch flagged as a real friction point for people who just want to try it.
It is powered by a model Meta calls Muse Spark, under Chief AI Officer Alexandr Wang, and it is coming to Meta's smart glasses later. US-only for now, 18 and older.
None of that is why this launch matters. Plenty of companies have demoed errand-running agents. What matters is the cage Meta built around it, because the cage is an argument about how AI safety should work, and it is a direct rebuttal of how OpenAI does it.
The cage: Secure VM and Sentinel
Meta's architecture has two load-bearing pieces.
- Muse Secure VM. Every user gets a dedicated virtual machine, isolated from other users, with its own browser. Untrusted data from the web lives in one compartment. The part of the agent that can actually take actions lives in another, and that acting part never sees your raw credentials. If a webpage contains a prompt injection attack, the theory goes, the malicious text is trapped in the untrusted compartment with nothing valuable to steal.
- Sentinel. A separate process that inspects every outbound action before it reaches the internet. It checks each action against the policies you approved, and for sensitive steps like sending mail or spending money, it escalates to a human approval prompt. Meta says those approval prompts bypass the model entirely, meaning a hijacked model cannot forge its own permission. Tarek Sheasha, VP of Superintelligence Labs, put it plainly in the launch materials: the agent runs in its own isolated cell, does not see real credentials, and every interaction with the outside world runs through a Sentinel the agent cannot override.
Payments get their own layer. Checkout runs through Stripe's Link, which issues a single-use card number per transaction, so the agent never handles your real card details. Meta says Muse is the first agent covered by Link's agent purchase protections, which guarantee no-fee returns. Shopify's Shop Pay and 1Password integrations are coming.
The trust extras are unusually specific: you can opt out of your interactions training Meta's models, you can instruct Muse to forget specific things it has learned, and you can review an audit of its actions. A stronger tier called Confidential VM is coming, which runs the whole VM inside a trusted execution environment with access keys held on your device, meaning even Meta could not read the contents. Meta is working with Moxie Marlinspike, the creator of Signal, on that design, plans to publish the binaries with a transparency log, and is giving selected security firms source access.
And they are putting money behind it: Muse is covered by Meta's public bug bounty, up to $300,000 for a valid security hole, including up to $130,000 for a reproducible prompt injection that compromises a single user. When a company pays six figures for proof its safety architecture fails, that tells you what they are afraid of.
The other cage: how OpenAI does it
OpenAI's consumer agent stack has moved fast this year. The original ChatGPT agent mode, which folded in Operator, is being superseded by ChatGPT Work, launched July 9 on GPT-5.6 with Codex technology underneath. Work runs on a persistent cloud VM on OpenAI's servers, breaks a stated goal into steps, and works across your connected apps and files for hours, producing finished documents, spreadsheets, and sites.
The safety model is different in kind. Where Meta built architectural walls, OpenAI mostly built a trained, monitored model:
- User confirmations before actions with real-world consequences, like purchases or sending email.
- Watch mode, which kicks in when the agent touches sensitive contexts such as your email or bank, and pauses execution if you look away.
- Browser takeover mode, where you type passwords yourself and the agent is not shown or told what you entered.
- Terminal restrictions, at launch limited to GET requests for downloading images and public datasets.
- Memory disabled during agent tasks, so a successful prompt injection cannot read long-term context.
The system card publishes the numbers, which I respect. On a synthetic challenge set, ChatGPT agent disregarded irrelevant instructions and exfiltration attempts in the text browser 99.5% of the time, and 95% in the visual browser. But on active data exfiltration attacks in the visual browser, where an adversary actively engineers the attack, the success rate drops to 67%. One in three active attacks got through the model's training defenses in testing.
That 67% is the single most important number in this comparison, and I suspect it is the number that pushed Meta toward architecture instead of training. If your defense is "the model is trained to resist manipulation," a 67% defense failure rate under active attack is a thin wall for a system that can send email as you. Meta's answer assumes the model WILL be manipulated and puts the checkpoint outside the model, in a process the model cannot override.
Head to head
Here is the comparison I wish someone had published, as a decision aid rather than a scorecard:
- Where your credentials live: Muse stores them in the Secure VM where the acting agent cannot read them. ChatGPT agent uses takeover mode where you log in yourself and the agent never sees the password, but your logged-in sessions then live in its browser environment.
- Who blocks a bad action: Muse routes every outbound action through Sentinel, a separate non-model process. OpenAI relies on the model's own refusals plus automated monitors, with watch mode forcing human supervision in sensitive contexts.
- Payments: Muse uses Stripe Link single-use card numbers with guaranteed no-fee returns. ChatGPT agent requires your explicit confirmation before a purchase but transmits real payment details at checkout.
- Distribution: Muse is embedded in WhatsApp, which puts it in front of more than three billion people the day it ships. ChatGPT lives in its own apps and desktop software.
- Failure under attack: Published numbers exist only for OpenAI: 67% defense success on active exfiltration in the visual browser. Meta has published no equivalent benchmark, which is itself worth noticing.
- Verifiability: OpenAI publishes a detailed system card with attack success rates. Meta promises a transparency log and third-party source audits for the Confidential VM tier, but that tier is not shipping yet.
- Price: Muse is free with a card on file, then $20 or $100 monthly. ChatGPT agent capabilities ride on existing ChatGPT subscriptions.
Which one would I actually trust
Neither, yet, with anything that would hurt me if leaked. But I trust their failure modes differently.
OpenAI's approach fails statistically. A trained model resisting manipulation 67% of the time under active attack will eventually fail on someone's machine, and you have no way to know whether your task is the unlucky one. The mitigations are honest about this: the help docs flatly state the safeguards do not eliminate all risks.
Meta's approach fails architecturally or not at all, at least in theory. If Sentinel genuinely cannot be overridden by the model, then a successful prompt injection gets you a confused agent, not a drained inbox. The catch is the phrase "genuinely." Sentinel is unproven in public, the strongest version of the design, the Confidential VM, is future tense, and Meta is the company that agreed to an $18 billion settlement over consumer harms less than two weeks before launching a product that requires consumers to trust it with their inboxes. WIRED noted the uncomfortable detail that Meta's policies prohibit staff from looking inside user Secure VMs, but technically nothing stops them, as Meta's own VP of Engineering for consumer products confirmed.
My read: Meta's architecture is the right idea wearing the wrong company's logo, and OpenAI's transparency is the right practice protecting a weaker design. Watch which one copies the other first.
If you try one of these, do these five things
Whether you get access to Muse or you run ChatGPT agent tasks today, this is the checklist I would apply, based on what both companies' own documents say:
- Never let the agent touch a payment method you cannot freeze. Muse's single-use Link numbers are the right pattern; on ChatGPT, confirm every purchase yourself and treat the confirmation prompt as the only thing standing between the agent and your card.
- Start logged-out. ChatGPT agent offers a logged-out mode that uses no cookies and no pre-existing sessions. Use it until you have watched the agent work for a while.
- Connect the minimum. Both companies say the same thing in different words: every connector and every login you grant is a failure mode you have pre-approved. An agent doing travel research does not need your email.
- Read the audit log after the first three tasks. Muse surfaces an activity audit. ChatGPT narrates its actions in real time. Three reviews will teach you more about the failure patterns than any launch post.
- Opt out of training before your first real task. Muse allows it in settings; do it before the agent reads anything you would not post publicly.
I have kept my own agents fenced off from money and email for exactly these reasons. Reading the Bottleneck Labs experiment last week, where seven frontier models with real bank accounts earned $0 and invoiced strangers $12,431 in 72 hours, did not make me want to loosen those fences. But architecture like Sentinel is the first design I have seen that addresses the actual failure: not a dumb model, but a manipulated one.
The consumer agent era is now officially here, from two companies with opposite philosophies. The next twelve months of incident reports will settle which cage holds.
I write about AI agents, developer tools, and backend engineering every week, based on what I actually run in production. Subscribe, it is free, and you will get the comparisons and incident write-ups before they trend.
Have you used ChatGPT agent mode or Work for real tasks, and would you hand an agent your inbox or your credit card first? I would like to hear where you draw the line.
