Three financial professionals interviewed for a San Francisco Chronicle article published Oct. 25, 2026, advised against connecting Muse or similar AI agents to financial accounts or delegating consequential financial decisions. They distinguished that from lower-risk chatbot research using information with identifying details removed.
Which financial decisions should stay with a person?
The professionals' concern is about giving an agent access to act through accounts, not simply asking a chatbot to analyze information. Financial planner Robin Patin described using a conventional chatbot to review a credit-card statement after removing identifying details and flag possible subscriptions to cancel. She also said it gave incorrect answers in other interactions.
Financial planner Bradley Geddes said tax matters and irrevocable elections should go to a human who is accountable to the client. Sean Pyles, a financial planner, pointed to the human context in financial conversations, such as facial expressions or pauses, that an AI model may miss.
What safeguards does Meta say Muse uses?
Meta describes Muse as an AI agent that can act across connected services. The company says each user has a dedicated, isolated Linux cloud virtual machine, or VM. Credentials are stored outside the agent's runtime, and the agent receives substitute tokens rather than real credentials.
Meta says Sentinel controls connector permissions and network access. It can allow an action, deny it, or ask the user. Some read-only, previously approved, or low-risk actions may proceed without interrupting the user. Meta says it requires user approval for purchases. For wallet payments, it describes a single-use card number tied to a merchant, amount, and limited validity period.
These controls define how Meta says Muse is designed to operate; they do not remove the possibility of mistakes or attacks. Prompt injection is an attempt to manipulate an AI agent through content it reads. Meta says it uses training, labels for untrusted input, detection classifiers, red-teaming, and approval gates to address the threat, while acknowledging that prompt injection remains an open problem and Muse can still make mistakes.
What Meta says about data access and training
Meta says Muse conversations and VM data are not shared with its advertising systems, though browsing activity may indirectly affect ads. It says sanitized interaction histories may be used to train the underlying model unless users opt out in settings.
Meta also says operational policies restrict staff access to VM data, but its launch architecture does not technically prevent access when needed to operate, support, or secure the service. The company said it planned to deliver Muse Confidential VM later in 2026 and described testing it with a small group.
When research stops before the transaction
A Moneywise account published Oct. 9, 2026, described one reporter's use of Muse for flight research, a camera resale, and car negotiation. The reporter chose to book and pay for the flight personally, still had to handle steps to sell the camera equipment, and could not get Muse to negotiate directly with the car dealer as hoped. Those were the outcomes of one person's tasks, not a universal measure of what Muse can do.
Creator Alex Finn presents a different personal account. In his English-language video, he says Muse found and canceled a Perplexity Max subscription he had been paying $200 a month for, which he described as monthly savings.
