A month ago I wrote a short list of cautions for anyone thinking about handing Meta's Muse the keys to their accounts. Muse had been out for a few weeks and was spreading fast, and the advice was basic: connect only what the job needs, say plainly when it's allowed to act, set a spending limit, and don't take its word for how it knows something.
Since then Muse has been marketed to business owners directly, and the companies behind the other big AI assistants have started announcing agents of their own. This post revisits those cautions, because any tool that can see a business's revenue and customer lists raises the stakes even more than one that can access your personal information.
Muse Hangs Out a Shingle
Meta launched Muse for Small Business on September 29. According to Meta, the most common requests are reviewing ad performance (which campaigns are working and which aren't) and planning a new campaign from a creative brief. Owners have linked it to tools like Shopify for products and orders, Canva for ad design, and HighLevel for customer records. Altogether, the Small Business version adds 15 outside tools to the personal version's 40+. Meta's VP of AI products, Vishal Shah, told Axios he believes roughly one in three early users have connected it to a business account of some kind. It's free with usage limits, and heavier use requires a paid plan.
Meta also says nothing is published, sent, or spent without the owner's approval, which is the right promise to make. Still, those examples come from Meta, and the company hasn't published any results showing improved ad performance, or anything else. What the examples do show is how many connections businesses make to get that help.
Know the Risks
Connecting an assistant to your business accounts is a different decision from asking a chatbot a question. These agents run in the background, store logins, and act on your behalf. Meta's own write-up on Muse's security is candid about where that leaves things. It says Muse is not immune to attack, that hostile instructions hidden in something the agent reads (called prompt injection) remain an open problem across the industry, that Muse will sometimes make mistakes, and that some low-risk actions automatically go ahead without asking. Approvals you set can be one-time, or they can be permanent. Meta also says the current setup doesn't stop Meta itself from reaching your data for support or security work, and that a protected environment meant to prevent that is planned for later this year. Conversations are used for training Meta's models with personal details removed, unless you opt out in settings. Malwarebytes, drawing on TIME's analysis of Muse's internal instructions, also reports that Muse keeps running files on the people in a user's life, and that any message sent to a Muse user can become part of what the agent reads if it has access to that messaging system. Meta says Muse data isn't shared with its advertising systems and that you can tell Muse to forget specific things.
Outside researchers have found problems. In late September, Mac security researcher Patrick Wardle reported that an undocumented Muse setting could be changed by a program already running on the computer, which would send the user's voice dictation to an attacker's server and expose the account's login token. Meta patched it with a hotfix within a day of the disclosure and called it a local attack, not a remote one, with low practical risk, since malicious code would have to be running on the machine first. Wardle disagrees, arguing that a trick that gets someone to paste and run a malicious command could deliver that code. Either way, the episode shows what's at stake, because Muse's reach can include files, calendars, email, and messaging apps, and whoever controls it inherits all of that.
An Agent for Everyone
Even with the risks, Muse didn't have the personal agent market to itself for long. OpenAI introduced Dots on September 29, agents that keep working after you close the chat, rolling out first to Pro and Business Premium customers outside the EU and UK. Anthropic announced Claude Duet on October 22, a waitlisted research preview for US Pro and Max subscribers aimed at professionals and small businesses, and Google has pitched a Gemini hub for small business owners of its own. Full disclosure: I use Claude every day, Anthropic's flagship product, but Duet gets the same scrutiny as the others.
Muse for Small Business (Meta, reported Sept 29)
Connects to: 15 outside tools
What the maker says it holds back: Nothing published, sent, or spent without the owner’s approval; Meta says prompt injection is still unsolved.
Dots (OpenAI, reported Sept 29)
Connects to: 4,000+ apps
What the maker says it holds back: Custom Rules can allow, require approval for, or block actions; password changes stay with the user; OpenAI says Dots can make mistakes.
Claude Duet (Anthropic, reported Oct 22)
Connects to: 6,000+ connectors
What the maker says it holds back: Payments need approval; won’t trade securities or move money; declines to store card numbers and ID by default; research preview by waitlist for US Pro and Max subscribers.
Each of the three promises to ask before doing anything that matters, and each admits it can make mistakes. They also connect to far more than just about anyone needs on day one. How thoroughly you connect them is your choice.
Limits Help Build Trust
These assistants can save real time, and setting one up well takes a few decisions before the first connection.
Connect one tool at a time, and only what the job needs. Start with read-only access where the tool offers it, and open up the ability to allow autonomy only once you're confident tasks will be done correctly and safely.
Decide what stays off limits. Customer lists, payroll, banking, and anything holding passwords or card numbers should stay out of reach unless a specific job truly needs them. Permission should be given per task, not across the board. Duet declines card numbers and ID by default, and that behavior should be enforced in the other agents, too.
Check what happens to your data. Meta says Muse conversations are used for training, with personal details removed, unless you opt out in settings. OpenAI says workspace content on its Business, Enterprise, and Edu plans isn't used for training by default, while people on personal plans choose for themselves. Find the setting before you connect, not after.
Choose the narrowest approval. A one-time or per-task approval expires on its own. A permanent one is an open door, so save it for work you've watched the assistant do well many times.
Read it before it goes out, and cap the cost. Anything a customer will see gets read by a person first. Set a spending limit and a stop-after-a-few-failed-tries rule up front, the same as in last month's list.
What Makes Sense For You?
A new hire might get the key to the front door on the first day, but access to the safe comes later, and only if they earn it. Likewise, these assistants arrive with strong references and no history, asking for trust. Their creators want us all to connect everything at once, since that helps their agents to be the most productive with the least friction. It would be wonderful to live in a world where that made sense, but sadly we are not yet in that world.
My recommendation is to be discerning about the connections and tasks that you set these personal agents to. Yes, their potential is very powerful, but so are the current risks. Make them earn your trust and access over time, like you would anyone who works on your behalf.
Sam Hardin is the founder of Bright Pivot LLC, an AI automation and operations consultancy based in Covington, Louisiana. Bright Pivot helps small and medium businesses on the North Shore automate the routine and augment the rest.
Have questions about what this means for your business? I'd love to talk it through. Book a time on my Calendly, or reach me directly at sam@bright-pivot.com.
Source Links
Vulnerability details come from news coverage, not from the researcher's own write-up.
ALM Corp on Meta's press release, Muse for Small Business
Malwarebytes, Muse files away your friendships, arguments, and secrets
Malwarebytes, Muse zero-day report
Gizmodo, Meta patched the Muse zero-day
VentureBeat, OpenAI launches Dots
TechCrunch, Claude Duet
Deccan Herald, Google's Gemini tools for small business owners
