When the Agent Acts: Meta’s Muse and the New Privacy and Liability Frontier

By Jay Kotzker

The AI assistant that answers your questions is giving way to the AI agent that acts on your behalf. With the September 8, 2026 launch of Muse, Meta has put that shift into the hands of millions of U.S. consumers: an agent that can send email, book travel, make purchases, and keep working after the user closes the app.

When software stops advising and starts doing, the legal questions change. Who authorized the action? Who sees the data the agent gathers along the way? And when the agent gets it wrong, who pays? This post examines Muse as a case study in the privacy and liability issues every business and individual should be thinking about as agentic AI, and the industry’s stated ambition of superintelligence, move from the lab into daily life.

What Muse Is, and Why It Matters

Muse is a goal-driven personal agent, not a chatbot. A user states an objective; Muse builds a plan, coordinates time and resources, and advances the work on its own. It is available to U.S. adults through iOS, Android, the web, and WhatsApp, with support for Meta’s AI glasses planned.

Three features make Muse legally significant:

• Breadth of access. Muse can plug into email, calendar, payments, health and fitness apps, smart-home devices, and shopping services, and it connects to Instagram and Facebook to learn more about its user.
• Persistent memory and initiative. Muse remembers prior conversations and offers suggestions without being prompted.
• Authority to transact. Payments route through Link by Stripe, with single-use card numbers, and Meta describes Muse as the first AI agent covered by Stripe’s warranties and return policy for purchasing mistakes.

Meta has paired these capabilities with an architecture designed to reassure. Muse runs in a dedicated cloud virtual machine, the Muse Secure VM; a separate component called Sentinel screens proposed internet actions and can block them or request approval; credentials are held so the agent itself cannot see passwords or payment details; and users get an audit trail and control over which actions require approval. These are meaningful design choices. They are also, as discussed below, largely contractual and technical promises rather than legal guarantees.

The Privacy Questions

An agent that manages your life must first be given your life. That is the central privacy tension of agentic AI, and Muse makes it concrete.

Aggregation creates a new kind of profile. Individually, an inbox, a calendar, a fitness tracker, and a social media history are sensitive. Combined in one persistent memory that infers goals and acts proactively, they form a richer profile than any single service holds. Health and fitness integrations raise particular concern, since many state privacy laws treat health-related data as sensitive and require heightened consent.

“Secure” is not the same as “inaccessible.” According to WIRED’s reporting, as summarized by TechRepublic, Meta acknowledges the Muse Secure VM is not technically beyond Meta’s reach, even though company policy bars Meta from accessing users’ Muse data. For legal purposes, that distinction matters: a policy can be changed, compelled by subpoena, or breached, while a technical barrier cannot be waived by a memo.

Promises about training and advertising are contractual. Meta states that users can opt out of having Muse interactions used to train its models and that conversations are not shared with its advertising systems. Those commitments are enforceable chiefly through consumer protection law, where regulators treat a broken privacy promise as a deceptive practice. Meta’s 2019 settlement with the Federal Trade Commission, which carried a $5 billion penalty, is a reminder that regulators do pursue that theory, and observers have noted that Meta’s privacy track record will shape how skeptically users receive these assurances.

Third parties never agreed to anything. When Muse reads a user’s inbox or schedules a meeting, it processes the personal data of colleagues, clients, and family members who have no relationship with Meta. For businesses, the more immediate risk is an employee who connects a personal agent to a work account, moving confidential, privileged, or regulated data into a third-party environment without any vendor review.

The Liability Questions: When the Agent Gets It Wrong

Agents will make mistakes: the wrong flight, a duplicate order, an email sent to the wrong recipient, a commitment the user never intended. Existing law offers several frameworks for allocating that loss, none built with autonomous software in mind.

• Agency law. Traditional principles of actual authority, apparent authority, and ratification may bind a user to transactions an agent completes, even ones outside what the user meant to authorize. How courts map those doctrines onto software remains unsettled, a question the American Law Institute is examining in its work on civil liability for AI.
• Contract and terms of service. In practice, the provider’s terms will do most of the allocating, typically through disclaimers, liability caps, and arbitration clauses. Meta’s purchase protections through Stripe and Link are a notable voluntary backstop, but they cover commerce errors, not reputational, privacy, or relational harms.
• Product liability and negligence. Plaintiffs may argue that a defectively designed agent is a defective product. Commentators note that product liability, negligence, and breach of contract could all apply, creating overlapping exposure for developers, deployers, and users.
• Payments law. Whether a user’s delegation to an agent counts as authorization for purposes of Regulation E’s unauthorized-transfer protections is, as Fenwick’s analysis notes, still unresolved.

The first appellate signal: Amazon v. Perplexity

On August 4, 2026, the Ninth Circuit vacated a preliminary injunction that had barred Perplexity’s Comet browser agent from shopping on Amazon. The court held that Perplexity did not “access” Amazon’s systems under the Computer Fraud and Abuse Act or California’s analogue; the users did, with the agent acting as their tool. The case returns to the Northern District of California, and Amazon has signaled it may seek rehearing or Supreme Court review.

The ruling is about computer access, not damages. But its framing, the agent as an instrument of the user, has implications well beyond the CFAA. If agents are tools, responsibility for what they do may flow toward the person who wields them, which makes the scope of each user’s authorizations and approval settings far more consequential than most consumers appreciate.

The Regulatory Landscape Is Moving – Unevenly

No U.S. jurisdiction has yet enacted rules aimed specifically at consumer AI agents, and several broader AI laws have been narrowed or delayed in 2026. The table below summarizes the frameworks most relevant to agentic AI as of this writing.

In the absence of agent-specific law, private infrastructure is filling the gap. Payment networks have introduced agent identity and authorization frameworks, such as Mastercard Agent Pay and Visa’s Trusted Agent Protocol, that function as de facto governance for agentic commerce.

From Agents to “Superintelligence”: Governance at Scale

Muse is among the first major consumer products from Meta Superintelligence Labs, and it runs on Muse Spark, the first in a new model series Meta says is scaling predictably. Meta has reportedly planned a more capable successor model, and Mark Zuckerberg has framed Muse as working around the clock on users’ health, relationships, and finances.

Whatever one thinks of the term “superintelligence,” the direction is clear: more capable models, granted broader permissions, acting with less human review. Each step raises the legal stakes. Approval checkpoints that work for a single purchase may not scale to an agent pursuing months-long goals. Audit logs matter only if someone reads them. And the more an agent anticipates rather than follows instructions, the harder it becomes to say that any particular action was authorized.

For policymakers and counsel alike, the open questions include:

• What standard of care should apply to an agent’s provider when the agent acts autonomously?
• When does proactive, memory-driven behavior cross from assistance into decisions the user never made?
• How should consent work for data and actions that evolve after the user first connects a service?

Practical Steps Now

The law will take years to settle. Organizations and individuals can reduce their exposure today.

For businesses and employers

• Update acceptable-use policies to address personal AI agents connected to work email, calendars, or files, including confidentiality, privilege, and data-transfer restrictions.
• Review vendor and customer contracts for how they allocate responsibility for agent-initiated actions, including authority limits, indemnities, and liability caps.
• Revisit privacy notices and data maps if your products or staff use agents that process customer or third-party personal data.
• Track Colorado’s ADMT rulemaking and the EU’s staggered AI Act deadlines if you operate in either jurisdiction.
• Preserve audit trails of agent activity; they may become the key evidence of what was, and was not, authorized.

For individuals

• Connect only the services an agent genuinely needs, and revisit those connections periodically.
• Require approval for purchases, outgoing messages, and anything irreversible.
• Exercise available opt-outs for model training and review what the agent has remembered.
• Read the liability, dispute, and arbitration sections of the terms of service before delegating meaningful authority.

Muse is a thoughtfully engineered product, and Meta’s emphasis on approvals, isolation, and audit logs sets a useful baseline for the industry. But engineering safeguards are not legal clarity. Until legislatures and courts define who bears responsibility for autonomous action, the allocation of risk will be decided largely by terms of service, payment-network rules, and the settings individual users choose.

At Holon Law Partners, our AI, Data & Technology team works with companies building, deploying, and governing AI systems, from privacy compliance and data governance to contract strategy for emerging technology. We will continue to follow these developments closely and welcome the conversation.

This post is provided for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship. Laws and regulations in this area are changing rapidly; please consult qualified counsel about your specific circumstances.

Sources

• TechRepublic — Meta Launches Muse AI Agent
• Let’s Data Science — Meta Launches Muse
• YourStory — Meta’s Muse personal AI agent
• Oman Observer (AP) — Meta rolls out AI agent
• ETV Bharat — Muse payments and privacy
• AI Weekly (TechCrunch summary) — Muse Secure VM
• SoyaCincau — Muse privacy promises
• eMarketer — Meta debuts Muse Spark
• Wilson Sonsini — Ninth Circuit CFAA and agentic AI
• Retail Insight Network — Amazon injunction overturned
• Sovereign Magazine — Perplexity Comet ruling
• Ropes & Gray — Colorado scales back AI law
• SecurePrivacy — Colorado ADMT Act guide
• National Law Review — EU AI Omnibus enters into force
• Messaging Architects — What took effect August 2, 2026
• Linklaters — Agentic commerce
• Stellagent — Liability in AI agent purchasing
• Chargeflow — Agentic commerce regulation
• Justt — The chargeback liability gap
• Ballard Spahr Consumer Finance Monitor — Agentic commerce podcast