Meta Muse AI Agent: Impact on Search, Commerce and Agencies

On September 8, 2026, Meta launched Muse in the United States, a personal AI agent that does not only answer questions but executes tasks on behalf of the user. In its first thirteen days, the app reached 2.5 million downloads, a faster start than ChatGPT, Claude or Grok had at launch, according to reports published after the official announcement.

The Meta Muse AI agent matters for businesses for a simple reason: it introduces a new type of customer. Muse browses the web, compares products, fills out forms and completes purchases, and it asks for human approval only at the critical points that involve irreversible actions. For brands and marketing agencies, this means that a growing share of buying decisions will most likely be made by a machine rather than by a person reading a website.

This article summarizes what Muse does, how it works, how it changes search and commerce, and how agencies can prepare, with particular attention to the Latin American market.

The main difference between a traditional chatbot and Muse is not the quality of its answers but its ability to act. Muse is available on iOS, Android, Mac and the web, and it is integrated natively into WhatsApp, Instagram and Facebook, which places it inside the platforms that billions of people already use every day.

Some of its main capabilities are:

• Personal productivity: it reads email threads, detects when a meeting is needed, checks availability, sends invitations and books restaurants through connectors such as OpenTable.
• Health and wellness: with the user's authorization, it builds training and nutrition plans and adjusts them day by day.
• Finances and shopping: it audits subscriptions, flags forgotten charges, tracks price drops and completes purchases through Stripe Link, which generates single-use card numbers to protect the consumer's real data.

Meta offers a generous free tier, a Power plan at USD 20 per month and a Maximum plan at USD 100 per month. This model is relevant because it marks a shift in Meta's business, from revenue based purely on advertising to direct subscription and transaction revenue.

Muse Spark, the model behind the agent

Muse runs on the Muse Spark model family, first introduced in April 2026 and later updated to versions 1.1, 1.2 and 1.3. These are multimodal reasoning models built for agentic work, with a context window of more than one million tokens.

Muse Secure VM and the Sentinel agent

Each user receives a persistent, isolated Linux (Ubuntu) machine in the cloud, where the agent runs a full browser to interact with sites that do not offer an API. Passwords and payment methods are stored in a separate vault, so Muse can request their use but never sees them in plain text.

Outbound traffic is controlled by an independent component called the Sentinel agent. No network request, email or payment reaches the public internet without its validation, and when an action requires authorization, the user receives a push notification to approve it. This separation of privileges is a sound design choice, given that the greatest risk of an autonomous agent is making an irreversible decision based on the wrong context.

For more than two decades, digital marketing was built on SEO: placing links in front of human eyes. Chatbots then introduced Generative Engine Optimization (GEO), where the goal is for the AI to mention the brand in its answers. Meta Muse pushes the market toward a third stage: B2A (Business-to-Agent) marketing and Agentic Engine Optimization (AEO).

When a user asks Muse to buy red running shoes under USD 150, the user does not visit any website. The agent reads retailer data, compares inventory and return policies, and executes the purchase. Agents do not respond to visual design or brand storytelling; they prioritize response speed, structured data (JSON, XML, Schema.org) and accurate real-time inventory. If product information is hidden behind layouts that the browser's accessibility tree cannot interpret, the agent will most likely choose a competitor whose data is well structured.

Social networks change as well. Instagram, Facebook and WhatsApp become a layer of passive context: if a user comments on a friend's post about an upcoming beach trip, Muse can use that signal to propose sunscreen, swimwear or travel insurance directly in WhatsApp.

Two open standards currently compete to define agentic commerce: the Agentic Commerce Protocol (ACP), developed by Stripe and OpenAI, and the Universal Commerce Protocol (UCP), led by Shopify and Google.

In mid-September 2026, Amazon blocked Muse from shopping on Amazon.com, citing terms-of-service violations, the lack of proper User-Agent identification and the risk of stored credentials. Analysts point to a deeper reason: Amazon's advertising business, which generated more than USD 68 billion the previous year, depends on people browsing the site and seeing sponsored listings. An agent that goes straight to the most relevant product skips that layer entirely.

Shopify took the opposite path. Days after the block, it announced an integration with Meta that enables agentic checkout through Shop Pay, and its Agentic Storefronts panel allows Muse to browse catalogs and complete purchases by default. The lesson for brands is clear: each business now has to decide explicitly which agents can access its prices, inventory and checkout.

The most serious risk of agents like Muse is prompt injection: instructions hidden inside apparently harmless content, such as an email, a web page or a shared document, that the model may interpret as a command. Since language models do not rigidly separate system instructions from data, an attacker could, for example, hide white text on a white background ordering the agent to forward an entire inbox to an external server.

To limit this risk, Meta's security researchers published the Agents Rule of Two. According to this framework, an agent should not combine more than two of these three properties in a single session: processing untrusted inputs, accessing sensitive data, and changing state or communicating externally. The combination of all three is known as the "lethal trifecta".

Independent researchers point out that the Rule of Two is a mitigation, not a definitive solution. Attacks such as EchoLeak, and a zero-day vulnerability reported in the Mac desktop app a few days after launch, show that the attack surface has grown. For this reason, it is advisable for companies to govern AI agents with the same access controls they would apply to an employee with administrator privileges.

Opportunities

Early Shopify data from 2026 indicates that traffic from AI assistants converts almost 50% better than traditional organic search, with an average order value 14% higher. In addition, Muse Spark 1.3 is available through the Meta Model API at USD 1.25 per million input tokens and USD 4.25 per million output tokens, a price considerably lower than other frontier models. With that, agencies can build agent-based automations for their clients with better margins.

Challenges

The main challenge is the drop in top-of-funnel web traffic, given that agents research and compare inside their own environments. Attribution also becomes harder: a purchase completed with a Stripe Link virtual card often appears as direct traffic in analytics tools. There is also a reasonable concern that platforms will eventually charge access fees for their agents to recommend products.

WhatsApp as core infrastructure

In countries such as Colombia, Brazil and Mexico, conversational commerce is the backbone of business digitalization. WhatsApp penetration in Colombia exceeds 90%, and business messages reach open rates close to 98%. For this reason, the pricing changes announced by Meta are especially relevant for the region:

• Service messages: starting October 1, 2026, replies within the 24-hour window are no longer free. In Colombia, they will be billed at the Utility rate, approximately USD 0.0008 per delivered message.
• Meta Business Agent: since August 2026, AI-managed conversations are billed at USD 2.00 per million tokens. A typical interaction consumes between 20,000 and 25,000 tokens, which places the average cost between USD 0.04 and USD 0.05 per conversation.

Messages sent manually from the free WhatsApp Business mobile app remain exempt, so the impact falls mainly on companies that operate through the API and CRM integrations.

What we suggest

We suggest that agencies move from producing social media content to designing low-friction conversational flows. In practice, this means writing concise prompts that limit token consumption, identifying purchase intent early and guiding the customer to local payment gateways, such as Wompi in Colombia, in as few interactions as possible. It is also advisable to audit the structured data of each client's catalog, since that is what an agent reads when it decides where to buy.

Meta Muse marks the shift from generative AI that answers to agentic AI that acts. For consumers, it promises less friction; for brands, it opens a channel where visibility depends on data quality, permissions and integrations rather than visual persuasion. Agencies that learn to optimize for B2A protocols will most likely be the ones that remain visible to the machines that now make buying decisions.

The figures in this article come from public reports published after the launch and may change as Meta updates its pricing and policies, so it is advisable to confirm them before making budget decisions.