White glove service

Meta launched a personal agent called Muse on 8 September. You give it a goal rather than a question. Close the app and it keeps going. Within ten days it could place phone calls and had reached the Mac, with access to your files, Messages, Calendar, Notes and Mail. Then on Wednesday, at Meta's Connect conference, Mark Zuckerberg's "one more thing" turned out to be a keychain.

It is called Muse Charm. The agent lives inside, as an animated avatar that people at Meta call Jolly. "You just go ahead and tap here in the fingerprint sensor in the corner, and you can start talking without having to unlock a phone or open an app," Zuckerberg said. It ships in December, he promised.

The best-known rival is Instinct. When its founder, Noah Shinn, announced phone calls on 16 September, he called the feature "a white glove service meant to handle high-touch cases". That is the pitch for the whole category. Something discreet runs your affairs and never has to be told twice.

What made a butler useful was knowing the household. Before getting too interested in the service, we would like to know what these agents know about us. And who they answer to.

A pet that goes shopping

The Charm has been compared with the Tamagotchi all week. It is hard not to. Bandai's egg-shaped keychain went on sale in Japan on 23 November 1996 and has shipped 100 million units since. When it reached Hawaii the following spring, schools on Oahu banned it within weeks, and at one of them a confiscated pet cost a dollar to get back. The attachment children formed to these things even got a name: the "Tamagotchi effect".

Sarah Perez at TechCrunch thinks that is the wrong reference. Young people already hang Apple Watches off their bags as charms. On her reading the Charm is an accessory first and a computer second. She may have a point.

We would put the difference elsewhere. The Tamagotchi needed you. It beeped when it was hungry, and if you ignored it for long enough it died. The Charm runs errands for you, with your card on file.

The hardware isn't finished. Bloomberg reports a two-inch screen, a 5G modem, cameras front and back and a price in smartwatch territory, while Engadget says only a few prototypes exist. Andrew Bosworth, Meta's chief technology officer, did not oversell it: "It's cool, it's fun, it's neat, it's weird, it's different. There's nothing like it."

Zuckerberg did explain how Meta expects to be paid. Muse is free "for a huge number of tokens", he told developers, "with the expectation that over time we will profit by taking a small fee from transactions." So the pet on the keychain has a job. It buys things.

One in five

Running errands assumes the errand gets done. The best evidence on that is not encouraging.

OSWorld 2 tests agents on 108 realistic computer tasks, the long, fiddly kind that take a competent person just over an hour and a half.

The best agent finished 20.6% of them.

Its partial score was 54.8%. That is the more telling number. These systems get a long way into a task and then stall, or misread the screen, or make a wrong call at step forty.

Instinct had that kind of week. On Monday night it stopped answering some of its users. There is no public status page, so they asked its founder on X whether it was down. One told TheStreet it had gone quiet mid-task, when it "was supposed to send two emails for me and confirm a dentist appointment."

In August a Los Angeles investor, Jason Yeh, asked his Instinct to find restaurant reservations in Tokyo. It booked one he had never mentioned, with a $200 cancellation fee. Its apology was almost disarming. "The failure was acting on my own notes without verifying them against what you actually said."

And early on Tuesday a user posted screenshots of Instinct describing someone else's financial document. Shinn replied that the model had invented a proper noun and that no data had crossed between accounts. We can't check that. Nobody outside the company can.

Muse and Instinct both make phone calls now. The person on the other end of the line never agreed to any of this.

For now the confirmation prompts should stay. Payments, public messages, deletions, legal commitments and anything medical still need a person to check them. Meta and OpenAI both say prompt injection is unsolved. Both have contained it without fixing it.

Meta showed its work

The engineering under Muse is good. Meta has explained it in more detail than anyone else in this market.

Each user gets their own Linux machine in Meta's cloud. A separate gatekeeper, called Sentinel, checks everything the agent sends out. Passwords never reach the agent. Anything it reads on the web is treated as untrusted. At checkout it shows you the exact purchase and waits.

The product around it is borrowed. Meta's Nat Friedman told TechCrunch that Muse was built from scratch but "definitely heavily inspired as a product by OpenClaw", down to the file names. OpenClaw is the open-source agent whose author OpenAI has since hired. The verdict that went round afterwards, that Muse is literally OpenClaw for normies, is unkind and close to right. Meta removed the rented server, the API keys and the SSH session. That is most of the difference.

Before you connect anything

Muse works in the United States and, since 18 September, Canada. Google's Gemini Spark agent names Switzerland among the places it does not serve, along with the European Economic Area and the UK. Apple's new Siri is not coming to iPhones in the EU at first. For readers in Lausanne or Geneva, all this is being tested on other people for now. That may be no bad thing.

Meta's own security write-up has a sentence that deserves more attention than it has had. The current setup, Meta writes, "does not prevent Meta from accessing data when necessary to support, secure or operate the service." A version that locks Meta out is promised for later this year. Until then the butler has the house keys. So does the agency that sent him.

On the Mac, Meta has now added a help page. It lists what Muse asks for. Automation lets it send messages and delete notes in your apps. Full Disk Access, in Meta's own words, "covers all the files on your Mac". Muse checks with you before it sends an email or buys anything.

On 21 September the researcher Patrick Wardle showed that any program on the same Mac could quietly send Muse's dictation to someone else's server. Meta fixed it the next day. It said the practical risk was "quite low", because an attacker would already need code running on your machine. Fair enough. That is also exactly when Full Disk Access becomes dangerous.

Instinct has published much less and asks for more. Its terms appoint it as your agent for "agreements, commitments or transactions", binding "as if entered into directly by you". The consequences are yours.

One detail in Instinct's small print is worth knowing. Disconnecting a service from it does not delete what it has already indexed; you have to ask separately.

The permission question matters more than the capability one. It gets asked far less. An assistant that can find your dentist's email address should not, for that reason alone, be able to read your password resets and empty the mailbox. Permissions are nearly always wider than the task. What matters is what the agent can reach, for how long, and whether you can see what it did.

Models change. Assistants get discontinued, acquired or repriced. The organisation's record of what it knows keeps its value through all of it. Whether that record sits in a vendor's account or in a database the organisation controls is a decision that gets more expensive to reverse every month.

If Muse ends up keeping the notes, how much of that record could move to another assistant without somebody rebuilding it by hand?