On September 8, 2026, Meta launched Muse, a personal AI agent that does errands rather than answer questions: it books travel, sends emails, and shops. It rolled out in the US on muse.ai, in iOS and Android apps, and inside WhatsApp, free for most uses with $20 and $100 monthly plans, running on Meta’s in-house Muse Spark 1.3 model (Meta Newsroom; AlphaSignal). Most launch coverage asked whether consumers will trust Meta with this much access (TechCrunch). This article asks the other question: what happens on your side of the transaction when Muse tries to buy from your store. Muse uses no shopping protocol, feed, or partner integration — it opens a browser and walks your checkout the way a stranger with a fresh card would.

A browser, not an API

Each Muse user gets a dedicated, isolated Linux virtual machine in Meta’s cloud — the Muse Secure VM — with its own browser, where the user’s files, connected logins and Muse’s memory all live. From that browser Muse can open web pages and “complete online checkouts using Link built by Stripe” (Meta Newsroom). Apps are connected one at a time, so email or a calendar needs an explicit grant — a website does not. Any page the browser can load, Muse can act on, including building a grocery list, comparing prices, and ordering (Engadget).

That puts Muse in a different class from the agents this site has covered so far. ChatGPT buys through the Agentic Commerce Protocol; Google and Shopify are converging on the Universal Commerce Protocol. Both are protocol-buyers: a store that hasn’t integrated simply isn’t in the catalog (see Agentic checkout: two rails). Muse is a browser-buyer: nothing to integrate, nothing to opt into. If a human can buy on your site, Muse is expected to as well.

How it pays, and a hard limit on how it reads

Checkout runs through Link, Stripe’s wallet. Meta says Muse is the first AI agent covered by Link’s purchase protections — free coverage for damaged or lost items, price drops, no-fee returns, and a return guarantee on eligible purchases (Meta Newsroom). AlphaSignal’s read of Meta’s separate security deep-dive describes single-use card numbers “scoped to a specific merchant, dollar amount, and time window, with a mandatory approval prompt on every checkout” — that approval comes from Sentinel, a safety agent isolated from Muse at the system level; nothing Muse does leaves the VM until Sentinel signs off (AlphaSignal). We covered what agent-issued virtual cards do to fraud rules in our earlier piece; Shop Pay and 1Password support are announced as coming next, which would let Muse log in with an existing account.

The same deep-dive discloses a limit worth knowing: Muse’s “browser subagent… receives only the accessibility tree of a page rather than the raw DOM, [and] cannot execute JavaScript in the page context” (AlphaSignal). A price that only renders after a script runs on scroll, or a size selector built as an image map, isn’t merely unclear to Muse — under that constraint it can be structurally unreadable. Structured product data sidesteps the problem entirely; script-dependent rendering doesn’t.

Where else a normal checkout stops it

Beyond the product page: a bot-management challenge before checkout ends the visit outright (our Cloudflare flip rescan is measuring exactly this); a cart that requires an account before accepting an item blocks the “compare and order” flow Meta demos; no guest checkout means no order until Shop Pay ships; a checkout offering only iDEAL or another local method has no field for a Link card at all; and an order confirmation that’s a spinner or an email-only receipt leaves Muse unable to report back to Sentinel and the user. None of this is exotic — it’s what the transaction audit already checks.

You will not see it coming

Meta’s documented crawler tokens — meta-externalagent, Meta-WebIndexer, Meta-ExternalFetcher — are the only Meta entries in the community-maintained ai-robots-txt registry, which we fetched directly; it lists no Muse token (robots.json). Until one exists, a Muse session looks like any other browser visit: a Muse purchase reads as human in Google Analytics and in your own dashboard, and so does a Muse bounce — we explained why in Google Analytics can’t see AI agents. A robots.txt rule can’t address a visitor with no name.

What this means for your store

  • US-only today is a window, not a reprieve. No EU date has been announced; when one lands, the checks above start costing orders the same day.
  • Test your checkout as a stranger would — fresh browser, no account, a virtual card if your bank offers one — and note every step that would stop a human with no history.
  • Check what your fraud rules do with a first-order, single-use card. A blanket decline on “no card history” is now a rule against a real, paying customer class.

FAQ

Does Muse use a shopping protocol like ACP or UCP?

No. Muse acts through a browser inside a dedicated cloud VM and pays with Link by Stripe. There is no merchant endpoint to implement and no programme to join — it buys on any site its browser can reach.

Will a Muse purchase show up as a bot in my analytics?

No. With no published user-agent token and a real browser session, Muse purchases and failed attempts alike are indistinguishable from human traffic in standard analytics.

Can my checkout’s JavaScript block Muse from reading a price?

It already might. Meta’s security deep-dive, read by AlphaSignal, says Muse’s browser subagent works from a page’s accessibility tree and cannot execute JavaScript in the page context, so any price or stock status that only renders after a script runs is invisible to it, not just hard to parse.

Sources

An agent that buys through your own checkout, with a card that has no history and a browser that has no name, is the exact shopper the transaction audit simulates. Run it on your store before Muse does.