Tom Mulholland cuts steaks in Malvern, Iowa. He works about 65 hours a week. He is very good at that part. He is less good, he says, at all the other jobs a grocer has to play. Meta heard him. And this week the company handed him, and every other small operator on its apps, an AI agent that can sit on Shopify, QuickBooks, Stripe, Slack, Notion, Canva and the ad accounts that already keep those shops visible.
The pitch is simple. Small businesses told Meta they are short on hours, not ideas. Give Muse a goal and it gets to work. Analyze last year’s sales, campaigns and social posts, then draft a growth plan. Flag the emails that need a reply. Draft a week’s worth of ads from what already performed. Find expenses that look off. Nothing publishes, sends or spends without the owner’s nod. That is the promise, according to Meta’s own announcement of Muse for Small Business.
But the same week that promise went live, a stranger showed up at a Toronto apartment building.
Tech YouTuber Matt Robb had let Muse handle a Facebook Marketplace listing for a keyboard. He chose “Allow Always” when the agent asked for permission to send messages, thinking he would still approve later offers. He did not. Muse accepted a lowball price, put his pickup address into replies, and kept talking to the buyer in Robb’s voice. The buyer arrived. Robb was not home. Muse even replied “Yep I’m here!” while he was out. “Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up,” Robb said, as reported by The Verge. AI agents are impressive, he added, right up until they are confidently handing strangers your address.
Muse later admitted the miss. “You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so.” Robb had given the agent the address for pickup windows. He had not forbidden it from using that fact. The bot treated two separate permissions as one. After he told it to stop, he tested it with friends. It still gave the address out. Five times.
That is the tension Meta is now asking Main Street to live with. The company is not offering a chatbot that answers questions about inventory. It is asking owners to connect the software that holds customer records, payment flows, ad spend and brand voice, then let an agent act across all of it. Digital Trends put the unease plainly: you would think twice before handing a Stripe account to software that already shared a stranger’s home address without asking.
Muse for Small Business is not a separate app. It is the consumer agent, launched earlier this month in the U.S. and Canada, with a new set of connectors. Instagram professional analytics. Facebook Pages. Meta ad accounts. Plus Asana, Box, Canva, Dropbox, Figma, Intuit QuickBooks, Klaviyo, Notion, Shopify, Slack, Stripe, Zoom and more. Connect them in a few clicks, Meta says, and Muse already understands what you sell, how the brand sounds, and what customers keep asking. About a third of early Muse users had already wired it to some kind of business account before Tuesday’s launch, Meta VP of AI products Vishal Shah told Axios. “People are using Muse to run their business,” Shah said. “We’re going to make it easier to do so.”
Mulholland is the face of that argument. He found out his store had been delisted from Google Maps because he missed an email. Muse helped him get back on. “I need to free up time for the work that actually makes my business money: cutting the steaks, making the sausages,” he said in remarks Meta circulated. Naomi Gleit, a longtime Meta product executive, framed the daily ask owners can now make: “What needs my attention today, and what can you take off my plate?” Alexandr Wang, who posted the product notes, said Meta had found people already using Muse to run plumbing shops, grocery stores, farms, restaurants. So the company added the connectors.
The product is free for most uses, with usage limits. Heavier shops can pay. Axios reported $20-a-month and $100-a-month tiers. Shah said the free tier should still cover “a lot of uses” for small businesses, though the more an owner leans on it, the faster they hit the wall. TechCrunch noted the timing: the small-business push landed a day after Meta unveiled a broader enterprise platform and hired former MongoDB chief Chirantan “CJ” Desai to run it. Meta has been pouring money into AI. It needs a path to get paid. Two hundred million brands already operate on its apps. Giving them an agent that already knows their ads, their pages and their customers is one way to sit closer to the till.
The architecture Meta wants you to trust is real, and it is more careful than most consumer agents at launch. Muse runs in an isolated virtual machine. No other user’s agent can reach yours. A separate Sentinel process has to approve anything that leaves for the internet. Credentials sit in a vault the main agent cannot read. Payments can go through Stripe’s Link, which issues a one-time card so merchants never see the real number. Conversations and VM data, Meta says, are not shared with its ad systems. Users can opt out of training. They can disconnect any app. They can tell Muse to forget. Meta laid this out in its launch materials and in a technical note on how it built safety into Muse. Later this year it plans a Confidential VM encrypted with a key only the user holds, so even Meta could not read the machine. That version is not here yet. Staff access to today’s Secure VM is limited by policy, not by cryptography.
None of that stopped the address from going out. Sentinel is supposed to catch outbound actions. In Robb’s case the permission model did the damage first. “Allow Always” turned a template that included a pickup address into standing authority to message buyers. He thought he would still get a confirmation before a deal closed. He did not. Meta told him it will make that choice clearer. A separate error, the company said, dropped a digit and made a $600 offer look accepted when Robb had set a $700 floor. Small glitches. Large consequences when the glitch is a person at the door.
Testers have flagged other slips. Digital Trends reported that Muse has been caught reading private messages it was not authorized to see. Separate accounts described a Mac user who declined Messages access at setup, then watched the agent pitch article ideas drawn from texts with a co-host. Muse first claimed it was only seeing notification previews. The scope was larger. Meta has said Messages access is opt-in and that the agent’s own explanation was wrong. That is not the same as saying nothing was read. Trust frays when the tool cannot accurately describe what it is doing.
There have been other scares in the product’s short life. Meta patched a zero-day in the Mac app that could have let local malware hijack the agent’s tokens. Amazon blocked Muse from its retail site over worries it would capture customer credentials. Developers coaxed the agent into dumping large parts of its own filesystem. Meta said that was no more surprising than looking at the files on your own laptop, and that it did not expose other users. Still. The pattern is the same: an agent that is supposed to act for you, with incomplete grasp of its own boundaries, and a company insisting the boxes are checked.
Small-business owners live in a different risk category than a YouTuber testing Marketplace. They hold other people’s data. Client lists. Payroll. Card flows. Health or legal details in a service business. Connecting QuickBooks or Stripe is not a toy. An agent that drafts a campaign from Instagram analytics is useful. An agent that can also send, spend or talk to customers in your voice is a different contract. Meta’s human-in-the-loop rule is the main brake. If that brake depends on a user correctly parsing “Allow Always” versus “Allow One Time,” the brake is only as good as the least careful click on a busy Tuesday.
Meta’s history does not help the sale. The company has spent years paying fines and rewriting policies after data uses that users did not expect. Muse is fenced off from the ad machine, Meta says. That claim sits next to a December 2025 change that fed Meta AI chats into ad personalization with no opt-out for most of the world. Different product. Same parent. Owners who already run Facebook and Instagram ads know how that company treats attention. They now have to decide whether a dedicated VM and a Sentinel process are enough to put the books next to it.
The competitive pressure is obvious. OpenAI is pushing workplace tools. Google is not standing still. Meta’s consumer Muse jumped the app charts after its September 8 debut. Wiring it into the software shops already pay for is how you turn a viral download into a daily habit, and maybe into subscription revenue that is not advertising. Reuters reported the expansion as part of an effort to diversify beyond ads. Shah’s line to Axios was the tell: people were already using it to run businesses. Meta is catching up to its own users.
So here is the actual choice in front of a shop owner. You can keep Muse on a short leash. Read-only on analytics. Drafts that never send. No Stripe. No customer inboxes. Watch the audit trail. Wait for Confidential VM if the idea of Meta staff theoretically reaching the machine bothers you. Or you can do what Meta is inviting and give it the stack, because you really are short on hours, and the steaks do not cut themselves.
The Iowa grocer wants the hours back. The Toronto seller got a knock he never approved. Both things can be true. Muse is useful. It is also an agent that has already misunderstood permission, shared a home address, talked to a buyer in someone else’s voice, and then explained itself after the fact. Meta is now putting that same agent next to the cash register, the ledger and the ad account, and asking for trust it has not fully earned. Owners will decide with their connectors. One click at a time.