Meta’s Muse Attack Questions

Meta launched its new AI agent, Muse, on 8 September, promising an assistant that can browse websites, complete forms and even make purchases on a user’s behalf.

The company says Muse can use a browser to carry out tasks and complete payments through Link by Stripe. The system operates inside what Meta calls a Secure VM, a virtual machine designed to keep the AI agent and the user’s information separate from the wider computer environment.

Muse is currently available in the US through WhatsApp and the Muse app, with plans to bring the technology to Meta’s AI glasses.

However, the launch raises an important question for website owners: what does a website actually see when Muse visits?

Meta Published Two Very Different Documents

Meta published two documents about Muse on the same day.

The first was a consumer-facing announcement explaining what Muse can do and highlighting its privacy and security protections.

The second was an engineering article from Meta Superintelligence Labs explaining how the company designed the system to deal with security threats.

The difference between the two is significant.

The consumer announcement focuses heavily on Muse being secure and private. It says that internet access is controlled through Meta’s Sentinel system, that Muse cannot see users’ passwords or payment details, and that users are asked before sensitive actions are carried out.

The engineering document takes a more cautious approach.

It acknowledges that an AI agent can make mistakes and that information encountered online could be used to attack it. Meta says the system was therefore designed on the assumption that the agent could come under attack, with measures intended to limit the damage if something goes wrong.

The engineering post also discusses prompt injection and offers security researchers up to $300,000 for qualifying reports, including rewards of up to $130,000 for successful prompt injection attacks affecting an individual user.

This creates two very different descriptions of the same product. One presents safety as a key feature of the finished product, while the other treats security as an ongoing exercise in limiting the consequences of mistakes and attacks.

Websites See Muse as the User

Perhaps the most important detail for website owners appears only in Meta’s engineering documentation.

When Muse browses the web, it is designed to appear as though the user’s own browser activity is taking place.

This means a website visited by Muse may not simply see an obvious AI bot.

Instead, Muse uses a current Chromium-based browser and performs actions on behalf of the user. From the website’s perspective, this can look much closer to an ordinary human visitor.

That could have consequences for everything from analytics and advertising to bot detection and access controls.

For example, a clothing retailer could record the visit in its analytics system and potentially use that activity to serve the user a later advert on Instagram, even though the person never personally visited the retailer’s website.

This is not necessarily a security vulnerability. It is a deliberate part of how Muse has been designed.

But it creates an important distinction between what the AI is doing and what the website believes is happening.

Why AI Browsers Have Struggled to Take Off

Muse is part of a wider push towards AI agents capable of interacting directly with websites.

Over the past couple of years, these products have appeared in several different forms.

Some have attempted to create entirely new AI-focused browsers. Others have added AI agents to existing browsers, such as Google’s work with Gemini in Chrome and Claude’s browser integration.

Muse takes a different approach by keeping the browsing activity inside a virtual environment rather than requiring users to watch an AI operate their own browser.

That could make more sense for automation. If an AI is capable of completing a task independently, forcing the user to sit and watch it click through a website adds little value.

The underlying problem remains, however. Most websites were designed for people to read and interact with visually, not for AI agents to understand and operate.

An AI browsing agent therefore has to interpret buttons, menus and forms intended for humans. This can be considerably more complicated than communicating with a website through a structured machine interface.

Muse Creates Questions About Identity

Moving browser activity into a virtual machine solves some problems, but it introduces another.

If Muse is logged into a person’s accounts and acts on their behalf, websites need to understand who is actually making the request.

The site may effectively be interacting with an AI agent that has the user’s permissions but does not clearly identify itself as an AI.

That matters because websites already use automated systems to decide how visitors should be treated.

Bot detection can restrict access. Paywalls can distinguish between different types of visitors. Analytics systems can classify traffic. Advertising platforms can build audiences based on browsing behaviour.

These systems often depend on being able to identify automated traffic.

Muse’s approach makes that distinction much harder.

Not Every Website Gets the Same Treatment

Meta’s engineering documentation also reveals that there are effectively two ways Muse can interact with online services.

For companies that have built a direct connector with Meta, Muse can communicate with the service through an API rather than controlling a conventional browser.

These connectors can provide structured access, defined permissions and an interface specifically designed for AI agents.

For other websites, Muse uses the browser.

This creates a potentially important divide.

Larger services that have integrated directly with Meta can provide an environment designed for agents. Websites without such an integration may instead receive a browser session that looks like ordinary user activity.

For website owners, the question may therefore become less about whether AI agents are visiting and more about how those agents are accessing their services.

Existing Bot Controls May Not Be Enough

Traditional website controls are largely built around identifying automated visitors.

Crawlers can be blocked through robots directives and other technical controls. Some services use user-agent information to identify bots, while machine-focused paywalls can make similar distinctions.

Analytics platforms may also infer that traffic is human based on whether a browser executes JavaScript and behaves in a particular way.

Muse complicates these approaches because it is deliberately operating through a real browser environment.

As a result, some existing systems may interpret its activity as a normal user session.

This could become increasingly relevant as more AI agents start carrying out tasks such as shopping, booking services, researching products and completing online forms.

The Web Is Moving Towards Agent-Friendly Protocols

At the same time, another part of the technology industry is working on a different solution.

A growing number of protocols are being developed to allow AI agents to communicate directly with websites and services without having to imitate a human navigating a visual interface.

Technologies such as MCP and WebMCP are designed to give agents access to defined tools and actions. In online commerce, protocols such as UCP and AP2 aim to make transactions more structured.

Other work, including Agent2Agent, focuses on communication between AI agents, while the IETF is working on Web Bot Authentication to help agents prove their identity.

This could eventually create a clearer distinction between an AI agent and a human visitor.

Instead of an AI pretending to be a person browsing a website, the website could know that it is dealing with an authorised agent and determine what that agent is allowed to do.

What Website Owners Should Watch

The technology is still developing, so there may not be an immediate action required from every website owner.

However, the way Muse operates highlights several areas worth monitoring.

First, businesses will need to watch whether AI agents eventually gain reliable identities that websites can verify.

Second, the number of direct connectors being developed will be important. A growing connector ecosystem could reduce the need for agents to navigate websites through traditional browsers.

Finally, website owners should pay attention to how future AI products describe their interaction with the web.

Muse’s launch is notable because Meta’s consumer announcement and engineering documentation present substantially different perspectives on the same technology.

For website owners, the engineering details may ultimately matter more than the marketing message.

As AI agents become capable of acting on behalf of users, understanding who is visiting, what the agent can access and how its activity is being recorded could become an increasingly important part of running a website.