Meta's Muse, the personal AI agent it launched on September 8, has been downloaded about 10.9 million times worldwide, according to Sensor Tower estimates, and the businesses it acts on are shutting it out. Amazon blocked it from shopping on Amazon.com 12 days after launch. On October 27 and 28, Royal Bank of Canada, TD and BMO said they block third-party personal agents from their banking services, and CIBC said it does not support them.
Walmart went the other way, building agents a front door with its own rules. Put side by side, the first eight weeks of Muse point to one finding: consumer agents are being let in only where a business has built a door it controls (a gateway, a connector, a signed-in session with limits), and are being stopped wherever they arrive as a browser acting on a customer's password. For software companies, retailers and banks, the question is no longer whether agents will come but which door they will be offered.
How big Muse got, and how fast
Muse runs on "a dedicated secure computer with its own browser," Meta said in its launch post. It can "open a browser, fill out forms, and negotiate" on a user's behalf, and it is "free for most of what people need, with subscription plans for people who want to do more." Checkout runs through Link, built by Stripe, which issues a one-time card so the user's real card stays hidden, and Meta says 1Password support, so Muse can use logins a person already has, is coming soon. The post does not say how Muse identifies itself to the websites it visits.
Sensor Tower's numbers, reported by 9to5Mac and PPC Land on October 20, put Muse at more than 10.2 million US downloads in its first 40 days, the 12th app to reach 10 million that fast since Sensor Tower began tracking in October 2015. In their first 40 days, ChatGPT, Grok and Claude reached 3.7 million, 500,000 and 200,000 US downloads.
Two SaasBuzz calculations put those figures in proportion. Muse's 10.2 million US downloads are 2.8 times ChatGPT's first 40 days, and 2.3 times ChatGPT, Grok and Claude combined. And downloads are not use: Sensor Tower estimated 2.5 million US daily active users on October 16, which is about one daily user for every four US downloads. Meta paid for part of the climb. Sensor Tower found Muse took 39% of Meta's US advertising spend in October to date, up from 23% in September.
The agent is also showing up on the sites it visits. DataDome, which sells bot protection, counted 29.1 million Muse requests on its network between September 22 and October 3, Help Net Security reported, or about 2.4 million a day. In a sample, 99.3% came from cloud and CDN infrastructure rather than consumer devices, and 8.9% hit login, payment, account creation, cart or form pages. "Muse is the first mass-market example of where agentic traffic is heading," said Jerome Segura, DataDome's vice president of threat research.
Meta is still widening the reach. Muse launched in Singapore on October 27 with Shopee, Grab, Singapore Airlines, Agoda, ShopBack, Klook, Trip.com and Lazada named as brands it works with, though Meta's announcement says "connector features will roll out progressively." David Singleton, who works on Muse at Meta Superintelligence Labs and was previously Stripe's chief technology officer, marked the launch on X.
Post on X by @dps
One of the things I enjoy most about building Muse is seeing what everyone does with theirs. Now @Muse is available in Singapore. Can't wait to see what you make and do with it next. 🇸🇬
Who closed the door, and why
Amazon moved first. It notified users on September 20 that Muse could no longer shop on their behalf, SiliconANGLE reported. Amazon's terms require agents to identify themselves in their web requests, and Amazon said Muse did not; GeekWire reported that Amazon believes Muse's access to account pages and order history "amounts to an undisclosed third party moving through customer accounts." Meta has said Muse "has no visibility into people's passwords or payment methods," which sit in secure storage the agent cannot read, and that a second agent, the Sentinel, must approve anything Muse sends to the internet.
The banks followed in October. On October 20, RBC's chief executive, Dave McKay, told Bloomberg the bank was considering blocking Muse and that it is "liable for that as an organization," Money.ca reported. A week later Bloomberg reported the decision.
Post on X by @business
RBC is blocking AI agents such as Meta’s Muse from accessing its banking systems, citing “unacceptable customer risk.”
The Canadian Press then surveyed the big banks. RBC confirmed it blocks third-party personal agents from its signed-in services, including online banking. BMO said it does not allow agents to access its digital properties or carry out transactions, TD said it chose to block them, CIBC said it does not support agents opening or accessing accounts, Scotiabank said it will limit them, and National Bank said it is monitoring. McKay wrote on LinkedIn that "nothing is more important than the security of client information."
The bankers' warnings drew on a case from Facebook Marketplace. A tech content creator who let Muse handle the sale of a keyboard, choosing "Allow always" over "Allow one time," said it accepted a $600 offer below the $700 minimum he had set and sent the buyer his home address, Money.ca reported. No money was lost. Meta says Muse asks before sensitive actions such as purchases or sending email, and Singleton replied on X that he and the creator had confirmed together that Muse did not breach its privacy controls. That is the point the banks are making: the agent did what its settings allowed.
The doors that are opening
The same weeks produced the other answer. On October 21, Walmart announced an Agent Gateway, an MCP server through which approved agents search its inventory and buy for users, TechCrunch reported. Each agent gets its own profile, so its purchases show apart from the shopper's own; shoppers can require approval for each purchase or set a spending limit; agents cannot see payment information and may use only the data a task needs; and agents that break the terms are blocked. Walmart had already named Muse as a partner.
Melody Koh, a general partner at NextView Ventures, described the result from the user's side of the screen.
Post on X by @melodykoh
One thing I’m noticing - when asking @Muse to research topics related to buying something, it usually surfaces @Walmart options because the agent gets blocked by @amazon. Pretty smart for Walmart to not be hostile to agents IMO.
Meta is helping to write the rules for that kind of door. On October 6, Sierra and Meta announced the Personal Agent Protocol, with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners, The Next Web reported. It defines how a personal agent signs in to a business: sessions built on OAuth, a guest mode for public information, and read-only or write access chosen by the customer after sign-in. Each company decides whether agents work through its website, its APIs (MCP or OpenAPI) or its own agent. A first specification was due later in October; payments and finer permissions are listed as later extensions.
Who | Door | Terms |
|---|---|---|
Amazon | Closed, Sept. 20 | Agents must identify themselves |
RBC, TD, BMO | Closed, Oct. 27-28 | No agents in online banking |
Walmart | Gateway, Oct. 21 | Own profile, spend limit, no card data |
Singapore partners | Connectors, Oct. 27 | Rolling out in stages |
Stripe Link | Payments | One-time card per purchase |
Source: SaasBuzz analysis of SiliconANGLE, The Canadian Press, TechCrunch and Meta's announcements.
What it means for software companies, retailers and banks
The split is not between companies that like agents and companies that fear them. Amazon's objections, the banks' warnings and Walmart's terms come down to the same three conditions: the agent says who it is, it gets only the access the task needs, and the business can see and stop what it does. Walmart wrote those conditions into an interface it runs. The banks and Amazon had no such interface for Muse, so the only enforcement left was a block.
That makes the browser route the weak one. An agent that drives a cloud browser with a customer's saved login looks, to the site, like the customer, which is why Amazon objected to an "undisclosed third party" and why the banks talk about liability. DataDome's sample, with 99.3% of Muse requests coming from cloud infrastructure, shows how that traffic looks to a bot filter. An agent that arrives through a gateway or a protocol session arrives labeled, scoped and revocable.
For SaaS companies, the practical work is the door itself: an agent-facing API or MCP server with scoped, revocable tokens, agent identities that show in audit logs, per-agent limits, and terms that say what happens when an agent overreaches. Companies that sell login, payments, fraud and bot management sit in that path. Stripe is already in two places in this story, Muse's checkout and the Personal Agent Protocol, and DataDome is publishing the traffic counts.
For retailers, the door decides who keeps the customer. An agent that buys through Walmart's gateway leaves the order, the profile and the returns inside Walmart. An agent turned away by Amazon takes the shopper's request somewhere else, which is what Koh described. For banks, the calculation runs the other way: when an agent does something the customer did not expect, McKay's point is that the bank is liable, and SaasBuzz found no bank that offers a Walmart-style gateway for moving money.
The case against the finding
The strongest objection is that blocks will not hold. Muse has millions of users, and a customer who wants an agent to pay a bill can hand it a password whatever the bank prefers, leaving the bank with less visibility than a sanctioned door would give it. The download figures also suggest Meta can bring demand to any business that opens up.
Both points support the finding rather than undo it. Demand is what gives a gateway its value, and the risk of customers sharing passwords is the reason a scoped door beats an outright block. What would change the conclusion is a regulator or a court telling businesses they cannot refuse an agent a customer sends, or the Personal Agent Protocol stalling before its first specification ships. Neither has happened. Meta also has an open question of its own: Deutsche Bank analysts estimate the free tier costs Meta about $40 per user a month, The Motley Fool reported, and a block cuts into what Muse can do for the money.
What to watch
Whether Meta publishes how Muse identifies itself to websites, and whether Amazon reverses its block once it does.
The first Personal Agent Protocol specification, and which banks, if any, sign on.
Walmart's Agent Profiles, due in November, and whether other retailers copy the model.
Muse's arrival in markets beyond the US and Singapore, and which partners are named.
Method and sources
Download and user figures are Sensor Tower estimates from its proprietary panel, as reported by 9to5Mac and PPC Land; Meta has not published download or user counts. Traffic figures are DataDome's and cover only sites on its network. Bank positions are from The Canadian Press survey of October 28. The ratios are SaasBuzz calculations from those figures. A claim on X that Nvidia invested $3 billion in Muse was left out because no outlet or Meta statement we could find confirms it. Earlier SaasBuzz coverage of Meta includes the CMA's investigation of its commercial terms, and Amazon's latest results are in our third-quarter earnings report.
