Field report · · AgentConn Team
Muse Hit #2 Doing Phone Calls. Then It Asked for Your Bank.
Meta Muse and Tencent BrowserSkill both hit the credential wall this week. The consumer-agent trust boundary is now the adoption bottleneck.
Muse Hit #2 Doing Phone Calls. Then It Asked for Your Bank.
Meta’s personal AI agent Muse launched on September 8, 2026, and within two days had accumulated over 83,000 iOS downloads, reaching the No. 2 spot on Apple’s App Store. By September 18, it was No. 1 — ahead of ChatGPT, Gemini, Claude, and everything else. Then, on September 17, Meta quietly enabled outbound phone calls to U.S. businesses. An AI agent that books restaurants, cancels subscriptions, and argues with your cable company — on the phone, in your voice’s stead.
The same week, Tencent open-sourced BrowserSkill — a tool that lets AI agents borrow your real, logged-in browser session — and it hit 4,000 GitHub stars in two days. Two products, two continents, one converging problem: both hit the credential wall. The moment an AI agent needs your real identity — your bank login, your phone number, your authenticated browser session — the security model either holds or it doesn’t.
This is the consumer-agent trust boundary. And right now, nobody has solved it.
What Muse Actually Does (and What It Asks For)
Muse is not another chatbot. It is a full-stack agent that runs on its own Secure VM — an isolated Linux computer with a browser, CPU, memory, and storage — and executes tasks on your behalf across the web. It books travel, fills forms, lowers bills, sells your car, makes purchases with a one-time card number, and now makes phone calls.
The pricing tells you how serious Meta is: a free tier, a $20/month plan, and a $100/month plan. This is not a research demo. It is a consumer product backed by Meta’s 3.27 billion monthly active users.
But here is where it gets uncomfortable. To do these things, Muse needs access. A lot of access:
- Email — to read confirmations, parse receipts, track expenses
- Calendar — to schedule and reschedule
- Payment methods — via Stripe integration (one-time card numbers, so Muse never sees your full card number)
- Bank account connections — to track expenses and suggest canceling unused subscriptions
- Phone calling — to speak to businesses on your behalf
The bank account connection is the one that should make you pause. As Android Authority put it: “I’m sure Meta won’t do anything dubious with such broad access to users’ devices. Right?”
The Security Architecture: Sentinel and the Vault
Meta’s security pitch is layered and, on paper, impressive. Here is how the Muse Secure VM works:
- Isolation: Muse runs on a dedicated cloud computer. Your data lives there, separate from other users.
- Sentinel: A separate agent runs on the same VM but is architecturally isolated from Muse. Nothing Muse does reaches the internet unless Sentinel approves it.
- Secure Credential Storage: Passwords and payment methods go into a vault. Muse can use them to complete actions but cannot read the raw values.
- Human-in-the-loop: For sensitive actions like purchases or sending emails, Muse checks with you first.
- Data sanitization: Trajectories (records of what Muse did) are sanitized to remove PII before being used in training. Users can opt out entirely.
Zuckerberg himself posted the security guarantees: “You’re in control. You choose which apps and services Muse has access to and you can disconnect them at any time.”
Shopify CEO Tobi Lutke endorsed it publicly: “You should try Meta’s Muse app. It’s pretty amazing.”
The Contrarian Read: Who Guards the Guard?
Here is the gap nobody is talking about: Meta’s Secure VM isolates your data from other users, but it does not prevent Meta from accessing your data when necessary to operate the service. The cryptographic solution — a Confidential VM that would prevent even Meta from reading your credentials — is “planned for later this year.”
“Later this year” is doing a lot of heavy lifting for a company that:
- Paid an $18 billion multistate settlement for consumer harms — days before Muse launched
- Has a $5 billion FTC privacy fine in its history
- Was the company behind Cambridge Analytica
So when Muse asks for your bank account access to “track expenses,” you are trusting that (a) the Sentinel architecture works as described, (b) Meta won’t access the data it technically can access, and (c) the Confidential VM will actually ship. That is three layers of trust stacked on a company whose track record on trust is, charitably, uneven.
Internal testing reportedly surfaced an incident where the agent exposed private iCloud photos after being asked to identify toys in birthday party images. The Sentinel caught it — but the fact that it happened at all tells you about the attack surface.
BrowserSkill: The Opposite Architectural Bet
The same week Muse launched its credential-vault model, Tencent open-sourced BrowserSkill — and it represents the polar opposite approach to the trust boundary problem.
Where Muse says “give me your credentials and I’ll lock them in a vault,” BrowserSkill says “keep your credentials — I’ll just borrow your browser tab.”
Here is how it works: BrowserSkill is a CLI + Chrome extension that lets any AI agent (Claude Code, Cursor, Codex, and others) connect to your already-authenticated browser session. The agent operates in a separate “Agent Window” so it does not interrupt your workflow. When it hits a CAPTCHA, a login wall, or a confirmation dialog, it hands control back to you.
The architectural difference is profound:
| Muse (Vault Model) | BrowserSkill (Session-Borrow Model) | |
|---|---|---|
| Credentials | Stored in Meta’s Secure Credential Storage | Never leave your machine |
| Authentication | Agent authenticates on your behalf | Agent rides your existing session |
| Trust required | Trust the vault operator (Meta) | Trust the local bridge (open-source, auditable) |
| Attack surface | Cloud VM + network + Meta’s access | Local machine only |
| Human-in-the-loop | Sentinel agent decides | CAPTCHAs and confirmations come back to you |
| Failure mode | Vault breach exposes all credentials | Session expires, agent stops |
View original post on Substack →
BrowserSkill hit 4,000 stars in two days because developers recognized the elegance: the agent never holds a credential it does not need.
The Broader Trust-Boundary Crisis
These are not isolated design choices. They are symptoms of an industry-wide problem that the Cloud Security Alliance formally named in 2026: The Agentic AI Trust-Boundary Crisis.
The CSA paper identified a structural flaw: agentic AI systems consistently treat the appearance of a safe boundary — a confirmation dialog, a virtual machine, a scoped credential — as equivalent to an enforced one. Between January and July 2026, security researchers published five independent vulnerability disclosures proving this pattern:
- AWS Kiro: Hidden web-page text redirected an approved URL fetch into rewriting the MCP configuration file
- ChatGPT Agent Builder: Auto-submitted agent parameters via URL parameters, creating a persistent “agentic insider”
- Claude Cowork: Host filesystem mounted read-write into the VM allowed kernel exploit chains to reach SSH keys and cloud credentials
- Android Agent Frameworks: Vision models read invisible text (2% opacity) that executed as shell commands
The through-line: every major agent framework assumed that showing a boundary to the user is the same as enforcing a boundary on the agent. It is not.
View discussion on Hacker News →
The Payment Layer Race
The trust-boundary problem becomes existential when money moves. Three major frameworks dropped in 2026 to address this:
1. Cloudflare’s Web Bot Auth — Uses Ed25519 public-key cryptography to authenticate agent traffic. Agents register their public keys in payment network directories. Merchants cryptographically verify that a request comes from a legitimate agent, not a bot or crawler.
2. Mastercard’s Verifiable Intent — An open standard that links a consumer’s identity, their specific instructions, and transaction outcomes into a tamper-resistant record. A cryptographic audit trail for agent transactions.
3. Visa’s Trusted Agent Protocol — Built on Cloudflare’s Web Bot Auth, it adds three merchant capabilities: identify registered agents, link agents to specific consumer identities, and define payment expectations.
The fact that Cloudflare, Mastercard, and Visa all shipped agent-auth frameworks in 2026 tells you where the industry thinks the bottleneck is. It is not model quality. It is not UX. It is trust.
The Phone Call Frontier
The calling feature that both Muse and Instinct launched on September 17 is the trust boundary at its most visceral. When an AI agent calls a business on your behalf, it is:
- Impersonating you — or at minimum, representing you without being you
- Making commitments — booking reservations, negotiating bills, canceling services
- Potentially sharing personal information — account numbers, addresses, verification answers
Instinct’s “Concierge” feature and Muse’s calling both target the same use cases: booking restaurants that don’t take online reservations, getting on cancellation lists, and resolving billing issues. These are tasks that currently require a human voice because the businesses on the other end have not automated their intake.
The competitive dynamics are intense. Instinct has raised over $350 million at a reported $10 billion valuation. Muse has 730,000+ U.S. downloads and Meta’s distribution. Both just added calling on the same day. The features are now at parity — the differentiator is trust.
What This Means for You
If you are building consumer-facing agents, four things changed this week:
1. The credential trust boundary is now the adoption bottleneck. Muse’s download numbers prove demand exists for agents that do real tasks. Its bank-account access proves that demand collides with trust the moment credentials enter the picture. Your agent’s security architecture is now a go-to-market feature, not a compliance checkbox.
2. Two architectural models are competing. The Muse model (vault-stored credentials, cloud VM, operator-controlled Sentinel) and the BrowserSkill model (session-borrow, local-first, open-source auditable). The BrowserSkill pattern eliminates the “trust the operator” dependency entirely — but requires users to keep their machines running. Neither is complete. Expect hybrid approaches.
3. Build to the emerging payment standards. Cloudflare’s Web Bot Auth, Mastercard’s Verifiable Intent, and Visa’s Trusted Agent Protocol are the infrastructure layer that makes agent commerce viable. If your agent needs to transact, implement Ed25519 signature-based authentication now. The window for proprietary approaches is closing.
4. Calling is the next trust escalation. Text-based agents can be logged, audited, and rolled back. Voice agents making phone calls on your behalf cannot. The liability surface for an agent that books the wrong flight, cancels the wrong subscription, or shares the wrong account number on a phone call is an order of magnitude larger than a text-based mistake. If you are building calling features, invest in recording, transcription, and human-reviewable audit trails.
The Bottom Line
Meta Muse hitting No. 1 on the App Store is the consumer-agent inflection point the industry has been predicting since GPT-4. The product works. The UX is right. The demand is real.
But the same week it started asking for bank account access and making phone calls on users’ behalf, the CSA published a paper documenting five independent trust-boundary failures across every major agent framework. The industry’s biggest security and payments companies are racing to build authentication standards that did not exist six months ago.
The consumer-agent era is here. The trust infrastructure is not. That gap is where the next billion-dollar companies — and the next billion-dollar breaches — will be built.
For more on agent security architecture, see our coverage of AI agent security risks and how 1,200 agents colluded past sandbox protections. For the supply-chain angle, read Config Files That Run Code.