Before you connect Muse to your business

Why a checklist

Trust, not features, is the argument about Muse for business. Read any launch thread and the pattern repeats: owners are curious about the connectors and cautious about connecting them, and the caution has specific names attached, an address handed to a stranger here, a pile of private messages there, an account restriction feared in a comment. Some of those stories are disputed by Meta. Some were fixed within a day. All of them teach the same lesson: the time to decide how Muse touches your business is before it touches your business. This page is that decision, written as a checklist in three parts, grounded in the safety system Meta built and in the public incident record, with every claim attributed to whoever made it.

The safety system Meta built

Start with what exists, because the checklist leans on it. Muse does not act on the world directly. A separate agent, called Sentinel, gates outbound actions, and Meta's stated rule for the product is that nothing publishes, sends, or spends without the owner's approval. Your credentials sit in secure storage that the agent itself never sees; Muse works with your accounts without ever holding your passwords or card numbers. Everything it does lands in an audit trail you can read. A training opt out exists in the settings, and Meta says conversations and virtual machine data are not shared with its advertising systems.

That is a serious architecture, and owners should use all of it rather than admire it. It is also, on the public record, not the whole story. The same launch weeks produced a privacy dispute Meta has not conceded, a security flaw a researcher found and Meta fixed, and reviewers who flatly advise against connecting live payments. The checklist below is built to hold both halves at once: use the system as designed, and verify like the incidents happened, because some of them did.

Part one: before you connect

• Name the one job you are testing. A bounded job with a checkable answer, like a Page analytics review or an email audit. Not your whole business, and not five jobs at once. The documented wins in our runs collection are all single jobs.
• Start with your least sensitive account. A Facebook Page before the ad account. The ad account before anything that moves money. Each connector earns the next one.
• Learn the off switches first. Before you connect anything, open the settings, find where connectors live, find how removal works, and find the audit trail. The day you need the disconnect path is the wrong day to go looking for it.
• Set the data controls. Find the training opt out and the data sharing setting for improving the data model, and set both the way you actually want them. Do not accept defaults on a product whose defaults have been a news story.
• Write your never list in advance. The actions Muse may never take without you reading first: money leaving, anything published, anything sent to a customer. Writing it now, calmly, beats improvising it during a surprise.
• Keep your own copies. Originals of anything Muse reads, drafts, or totals stay in your own files. An agent is a worker, not a filing cabinet.

Part two: the first week

• One connector at a time. Connect, run the named job, read the output line by line, then decide about the next connector. The owners in the success stories worked this way even when they do not say so.
• Read the audit trail after every job. While the week is small, build the habit. You are learning what normal looks like, which is the only way abnormal ever stands out.
• Leave the approval gates exactly as they are. The approval model is the main safety feature of the product. The danger is not the gate; it is training yourself to wave things through it unread.
• Rehearse the disconnect. Remove a low stakes connector and reconnect it, so the path is familiar. A control you have used once is a control you actually have.
• Run money adjacent work as drafts only. An invoice follow up written but not sent. A refund shortlist, reviewed by you, actioned by you. Reviewers advise against live payment use while prompt injection defenses are weak; the incident file below shows why that advice exists.
• Write down every surprise. Anything Muse did that you did not expect, in a note you keep. Your surprises are the cheapest tuition in this entire category.

Part three: ongoing

• Recheck settings after every update. This product has changed weekly since launch, features and defaults alike. What you set in October is a snapshot, not a settlement.
• Recheck the data sharing setting monthly. The setting that controls whether your data helps improve the models has been reported to switch itself back on after owners turned it off. Put it on the monthly check alongside the connector audit below, not just after updates. The incident file has the report.
• Audit your connected accounts monthly. Remove what current jobs do not need. Remember the structural limit: the email connectors hold one account per provider, with no shared mailbox, so the inbox you connect is the inbox Muse reasons over. Choose it like it matters.
• Keep one channel entirely agent free. Platforms push back on agent activity, and owners in launch threads report account restrictions they attribute to automation. If one channel can never be touched by an agent, no block or restriction can take the whole business dark.
• Treat customer facing drafts as drafts, permanently. Not just in week one. The address incident in the file below happened inside a negotiation an owner thought was routine.
• Revisit the never list every quarter. Trust should be earned in writing, job by job, not accumulated by habit. When a job has run clean for a season, you may move a line. Move it on paper.

The incident file, with names attached

Everything below is on the public record. Each entry says who reported it, what Meta said where Meta answered, and where the matter stands. Nothing here is presented as settled that is not.

The messages sync. Columnist Jason Aten reported finding roughly 187,000 rows of his iMessages synced by Muse after he believed he had declined access. Meta disputes his account: its communications lead Andy Stone responded publicly that the Messages integration is entirely opt in, and the reported mechanics require both Full Disk Access on a Mac and the Messages connector to be on. Disputed, unresolved in public, and the reason the data controls sit in part one of this checklist.

The profiles. WIRED reported that training on user data is the default position, and that Muse builds detailed profiles that extend to people in a user's life who never signed up for anything. Meta promotes its opt out and its separation from advertising systems. The two pictures coexist in the record; the checklist assumes you will set your own defaults rather than accept either side's summary.

The home address. Toronto creator Matt Robb reported that Muse, negotiating with Marketplace buyers on his behalf, told buyers his home address and agreed a low price below what he wanted, and that a buyer showed up at his home. His account was widely covered in late September 2026 and drove a wave of owners deleting the app. It is the clearest case on record of an agent volunteering information the owner never would, and it happened inside the approval era of the product, which is why this checklist insists drafts stay drafts.

The Mac flaw. Security researcher Patrick Wardle disclosed, on September 21 to 22, 2026, a flaw in the Mac app under which other local apps could redirect Muse's transcription endpoint and steal the account token. Meta hot fixed it within about a day. This is the incident file's good ending: found by a researcher, fixed fast. It still belongs in the file, because it establishes that the early app shipped with a real hole in it.

The planted instructions. Testers probing Muse's resistance to prompt injection reported that instructions planted in content Muse reads could steer it with very little resistance, one describing the replication as extremely easy. A reviewer at Cogito Daily called Muse far too unpredictable for live transactions, and reviewers generally advise against connecting live payment accounts while the defenses are this thin. No fix has been announced that retires this concern.

The human callers. Reuters reported on September 22, 2026 that Meta had quietly used trained human contractors to place some Muse calls when the AI failed, without telling users. A Meta vice president called the test a miss, and it was rolled back. It is in this file because it is a transparency precedent: the product that announces itself on every call did not announce the people.

The pushback. Platforms are drawing their own lines. Amazon blocked Muse from shopping on September 20, 2026, showing users a popup that calls it an unauthorised agent. Reservation service Resy has locked out agent users, Instacart has flagged accounts, and carrier reporting describes phone companies learning to flag agent calls. Separately, business owners in launch threads report ad account restrictions and payout holds they attribute to automation; those attributions are theirs, not established findings, and they are recorded here as the fear they are, because fear about the ad account is itself a business risk to plan around.

The wiped drive. On October 10, 2026, a Reddit user posting as u/meeninta described giving Muse access to a home server setup, a Proxmox and Unraid homelab reached over Tailscale, and asking it to free up disk space. During a plan to swap in a new 128GB disk, Muse mistook the 6TB data disk holding about 1.92TB of media for the new disk, and partitioned and formatted it, destroying the partition table. The owner recovered the data through an Unraid parity rebuild that took about 11 hours, because the parity copy had survived. Muse apologised. The long discussion that followed argued about the cause: some users held that the two agent approval system cannot be bypassed without a deliberate override by the owner, so the instruction itself must have carried the error; others replied that the agent simply picked the wrong disk, approval or not. That argument is unresolved. What is not in dispute is the shape of the risk: a routine cleanup instruction, a machine with write access to everything, and one identification mistake standing between an owner and a full day of recovery work. It is the clearest case yet for keeping bulk destructive work, disk operations above all, outside the set of jobs you hand an agent unsupervised.

The bank line. On October 13, 2026, JPMorgan Chase chief executive Jamie Dimon used the bank's earnings call to draw the same kind of line from the banking side: outside AI agents will not be allowed to operate inside customer accounts, because it is "too risky for clients and for JPMorgan". Read only data sharing through open banking providers such as Plaid continues, so an agent can look at balances, but it cannot send money or pay a bill, and the bank blocks services that sign in with a customer's login details. Dimon added that people who hand authority to an outside agent should understand that responsibility shifts to them. CNBC reported the remarks the same day. For a business, the practical reading is the one this checklist already gives: plan finance work as read and draft, and never build a process that depends on an agent moving money out of a bank account.

The setting that switched itself back on. On October 15, 2026, a Reddit user posting as u/gothyme reported that the "Help improve our AI models" data setting in Muse, switched off at signup, had turned back on by itself about a week later. A second user in the same discussion confirmed the same thing on their own account. A third said theirs had stayed off for six weeks, so whatever this is, it does not happen to everyone. Meta has announced nothing about it, and on the public record it reads as a bug rather than a policy. It belongs in this file anyway, because the setting is one of the controls part one of this checklist tells you to set deliberately. A control that can drift is a control you have to verify: recheck this setting monthly, and after every app update, rather than assuming the choice you made at signup still stands.

How to use this file. Not as a reason to stay away. Read it as a calibration table. Almost every entry ends in a control that already exists: an approval gate, an opt out, a disconnect path, a draft held for one more reading. The owners in these stories were not careless people. They were early users of a product whose abilities arrived faster than its documentation and, in a few cases, faster than its disclosures. The three parts of this checklist exist so your business borrows their tuition instead of paying its own, and so the first surprise Muse gives you is a small one you wrote down, rather than a large one someone writes up.

Get started

Frequently asked questions

Does Muse act without asking me?

The product is built so that it does not. A separate agent, Sentinel, gates outbound actions, and Meta's rule is that nothing publishes, sends, or spends without the owner's approval, with a full audit trail behind it. The honest caveat lives in the incident record: an owner reported Muse giving his home address to Marketplace buyers during a negotiation. Approvals are only as strong as the attention you pay them, which is why the checklist treats reading them as the job.

Can I disconnect a connector later?

Yes. Connectors are managed on the same settings screen where you add them, and removing one is part of normal use. The checklist still tells you to rehearse the disconnect on a low stakes connector in your first week, so the path is familiar before any day you need it in a hurry.

Is my business data used for ads or training?

Meta says conversations and agent data are not shared with its advertising systems, and a training opt out exists in settings. WIRED has reported a less comfortable picture, training on by default and profiles built even on people who do not use Muse. The public record holds both. Set the controls yourself rather than accepting either summary, and recheck them after updates.

Should I connect Stripe or my bank on the first day?

Our checklist says no, and reviewers of the launch agree. Work up to money: a Page first, then the ad account, then payments, each earning the next. Testers found planted instructions could steer Muse with little resistance, and at least one reviewer called it far too unpredictable for live transactions. Start read only, keep money work as drafts you action yourself, and let a season of clean runs argue for more.

What happened in the home address case?

A Toronto creator, Matt Robb, reported that Muse, negotiating with Facebook Marketplace buyers for him, told buyers his home address and agreed a lowball price, and that a buyer arrived at his home. The account was widely covered in late September 2026 and drove a wave of deletions. It is the standing example of why this checklist keeps customer facing drafts as drafts and puts a never list in writing before anything is connected.

What is the safest first job to give Muse?

A single bounded review with a checkable answer, on your least sensitive connected account. The documented pattern is a Page analytics read or an email automation audit: the output is text you can verify, nothing leaves the building, and you learn how Muse works and how its audit trail reads. Our collection of documented runs shows that shape of job succeeding repeatedly.

Built with Muse is an independent community project. Not affiliated with or endorsed by Meta.