Meta Muse Can Buy Things Now. Can It Buy From You?

Estimated read time: 7 minutes

On September 8, Meta launched Muse, a personal AI agent that reads your email, manages your calendar, books your travel, and buys things. Not “recommends things to buy.” Buys them. It runs on the web, on iOS and Android, and inside WhatsApp, which means it starts life with a distribution footprint most software companies would need a decade to build.

Most of the coverage has focused on whether people will trust an AI with their inbox and their credit card. That is a fair question and a genuinely unresolved one. But it is the wrong question for anyone running a business, because it assumes you get a vote. You do not. Your customers will decide that on their own, and some of them already have.

The question that actually affects your revenue is narrower and more urgent: when one of these agents shows up at your checkout page with a customer behind it, does the sale go through, or does it quietly fail and send that customer somewhere else?

What Meta actually shipped

Muse is a consumer agent that connects to a user’s accounts and then acts inside them. Email, calendar, payments, health and fitness apps, smart home devices, restaurant reservations, shopping. It browses the open web, fills out forms, and completes transactions. For anything sensitive, it stops and asks the person to approve before it proceeds.

The technical design is more careful than Meta usually gets credit for. Muse runs inside what Meta calls a Secure VM, a dedicated virtual machine with its own browser, isolated from the rest of the system. Meta says the agent never gets visibility into passwords or payment credentials. Whether that holds up under adversarial pressure is a separate matter, and we will get to it.

It is US only at launch. Meta AI glasses support is coming. There are paid tiers. None of that is the interesting part.

The detail that matters: Stripe Link is built in

Here is the part that got buried under the trust debate. Stripe confirmed that Meta integrated Link, its consumer wallet, into Muse on day one. US consumers connect a Link account and the agent can then buy from businesses across the internet on their behalf.

The mechanics split into two paths, and which path your business lands on is not a small difference.

• If you accept Link (Stripe says more than a million businesses do), Muse checks out instantly using the payment method the customer already has saved. Clean handoff. No friction. The sale closes.
• If you do not, Link issues the agent a single-use virtual card scoped to that specific approved purchase. Your checkout sees an unfamiliar card number attached to a session that behaves like automated traffic.

That second path is where small businesses lose money without ever knowing it happened. A one-time virtual card from a new device, filling a form faster than a human could, is a textbook fraud signal. Plenty of processors and fraud rules will decline it. Plenty of sites will throw a bot challenge in front of it. The customer sees “we could not complete this purchase,” shrugs, and asks the agent to try a competitor.

You will not see this in your analytics as a lost sale. You will see it as a slightly higher decline rate, or nothing at all.

Agentic commerce now has a three-company standard

The Agentic Commerce Protocol is an open standard built by Stripe, OpenAI, and Meta that defines how an AI agent talks to a business to complete a purchase. It covers how the agent discovers what you sell, how it confirms price and availability, and how payment gets authorized without the agent ever holding the customer’s real card.

Three companies agreeing on a protocol is not a press release. It is a moat forming. When the payment processor, the largest consumer assistant, and the largest social distribution network all speak the same language, the businesses that speak it get transacted with and the ones that do not become harder to buy from. Not blocked. Just slightly harder, at a moment when the alternative is one sentence away.

This is a different problem from getting cited in an AI answer, which we covered in our look at how AI search is rewriting discovery. Citation gets you mentioned. This gets you paid. The second one is harder to fake and worth more.

What changes for a small business

Honestly? Less than the hype suggests, and more than nothing. Three things are actually different this week.

Your checkout has a new kind of visitor. Not a scraper, not a bot farm. A paying customer whose hands are being operated by software. Your fraud rules were written before this existed and they do not know the difference.

Your product data is now sales copy for a machine. An agent comparing three vendors does not read your brand story. It reads price, availability, shipping window, return policy, and specifications. If those live in an image, a PDF, or nowhere, you are invisible in that comparison.

Your bot defenses are now revenue defenses, pointed the wrong way. Aggressive rate limiting and blanket CAPTCHA walls used to cost you nothing. They now have a price attached.

Five things to check this week

None of these require a strategy offsite. All five are afternoon work.

1. Find out whether you accept Link. If you are on Stripe, this is a toggle in your payment method settings, and turning it on costs you nothing. If you are on a platform that resells Stripe, ask them directly. This is the single highest-leverage item on the list.
2. Run a virtual card through your own checkout. Use a one-time card number from your bank or a privacy service. If it declines, your fraud rules are about to decline real agent purchases too. Fix the rule, do not disable fraud screening.
3. Audit what stands between a visitor and the buy button. Email gates, interstitials, CAPTCHA on the cart, forced account creation, a cookie banner that blocks interaction. Each one is a place an agent gives up.
4. Put price, stock, and shipping in text. Not a hero image. Not a downloadable spec sheet. Plain HTML, with product schema if your platform supports it. You already have schema on the site; make sure the commerce fields are populated, not just the article ones.
5. Write a return policy a machine can parse. Number of days, who pays shipping, what condition. Vague policies are a reason for an agent to pick the competitor with a clear one.

If you sell online at any real volume, the platform you are on determines how much of this you can even control. That is worth a hard look, and we broke down the tradeoffs in our comparison of the best ecommerce platforms for small business.

The security problem nobody has solved

Muse launched alongside a security disclosure, and Reuters reported internal concern that the agent can mishandle access to sensitive personal data. Meta is not hiding this. The Secure VM design exists precisely because the company knows what it is handing out.

The unsolved problem is prompt injection. An agent that reads a web page and then acts on what it read can be instructed by that page. Hidden text on a product listing, a poisoned review, a crafted email in the inbox it is summarizing. The agent cannot reliably tell the difference between “content I am reading” and “an instruction from my user.” Nobody in the industry has fixed this. Not Meta, not OpenAI, not Anthropic.

For you, this cuts two ways. As a business owner using agents internally, assume anything your agent reads could try to steer it, and never give an agent standing authority to move money or send messages without review. As a merchant, understand that your product pages are now an attack surface for other people’s agents, which means user-generated content on your site is worth moderating more carefully than it was last month.

What not to do yet

Do not rebuild your site for agents. Muse is US only, brand new, and the adoption curve for “let an AI spend my money” is going to be slower than Meta wants. Nobody has a credible number for how much revenue is flowing through consumer agents today, and anyone quoting one is guessing.

Do not buy an “agent optimization” service. That category is going to fill up with people selling the 2026 version of meta keyword stuffing. The five items above are the whole job right now, and four of them are things you should have done anyway.

Do not pull your fraud screening. The right move is a rule that recognizes tokenized single-use cards as legitimate, not an open door.

The honest summary: a large, well-funded consumer agent just shipped with payment rails wired in from day one, and a shared protocol behind it. That is a real structural change even if this quarter’s volume is tiny. The cost of being ready is one afternoon. The cost of finding out in eighteen months that your checkout has been quietly declining a growing slice of demand is considerably higher.

Frequently asked questions

Does Muse work outside the United States?

Not at launch. Meta shipped it US only, across the web, iOS, Android, and WhatsApp, with AI glasses support planned. International expansion has not been dated.

Will an AI agent see my real card number?

No. That is the point of the Link integration. At businesses that accept Link, the saved payment method is used without exposing the details. Everywhere else, Link mints a single-use virtual card scoped to the approved purchase. Meta says Muse has no visibility into passwords or payment methods, and the customer approves the total in the chat before anything is charged.

Do I need to accept Stripe Link to sell to agent customers?

You do not need it, but the purchase is meaningfully more likely to complete if you have it. Without Link, the agent pays with a one-time virtual card, which some fraud systems decline. If you already process on Stripe, enabling Link is a settings change rather than a project.

Is agentic commerce big enough to matter yet?

Not in dollar terms, and be skeptical of anyone claiming otherwise. What matters is that the plumbing shipped and three of the largest players agreed on a standard. Volume follows plumbing, usually with a lag.

Should I block AI agents from my site?

Distinguish between the two things you might be blocking. Blocking training crawlers is a defensible business decision. Blocking a shopping agent is blocking a customer with a wallet open. Those deserve different rules in your robots file and different treatment at checkout.

Related Coverage

• Best Ecommerce Platforms for Small Business: your platform decides how much of your checkout you can actually change.
• Google AI Search Transformation: the discovery half of the same shift, where being cited comes before being bought from.
• AI Agents Explained: what an agent actually is, minus the marketing.

Faceted Media Magazine covers business, AI, and entrepreneurship for the people building what is next.