Meta’s Muse Hits No. 2 on the App Store Now Comes the Access Control Test

Meta’s first consumer AI agent is climbing the charts fast, and its rapid rise is forcing the industry to confront a question it has put off: who controls what an AI agent can access?

Meta launched Muse on Tuesday as its first personal AI agent built for consumers, and within 48 hours the app climbed to No. 2 on the US App Store’s Top Charts, according to Sensor Tower data reported by TechCrunch. The app moved up from fourth place on Wednesday to second place within days, signaling a fast-building wave of consumer interest in agentic AI.

The download numbers tell a mixed story. Muse has been installed more than 83,000 times on iOS in the United States since launch, enough to land it at No. 2 — but that pace lags well behind other Meta launches. Threads pulled in more than 4.3 million US downloads on its first day, and the standalone Meta AI app saw 108,000 US downloads during its own debut. ChatGPT, for comparison, crossed half a million US installs in under a week — a rate that took Muse roughly twice as long to match. Muse’s Android performance is notably weaker: the app has only reached No. 338 in the Productivity category on Google Play, and Android download figures aren’t yet public.

What Muse Actually Does  And Why That Matters More Than the Rankings

The App Store numbers are the headline, but the more consequential story is what Meta built. Muse isn’t a chatbot that answers questions; it’s designed to take action on a user’s behalf. According to Meta’s own launch details, the agent can manage email, book dinner reservations, track a budget, and hunt for deals, always with the user’s approval built into the workflow.

That approval step is the whole ballgame. Muse runs on a dedicated virtual machine inside Meta’s cloud, pairing the agent with the user’s data and a browser the user can watch in real time as it fills out forms and completes tasks. Meta’s chief AI officer, Alexandr Wang, said most people will never need to pay for it, noting the free tier should cover the vast majority of users, while the $20 and $100 monthly tiers exist mainly to offset compute costs for heavier users.

Under the hood, Muse is also wired into commerce. The agent uses Link, built by Stripe, so it can complete purchases at checkout on a user’s behalf — a capability that moves Muse from “assistant that suggests” to “agent that transacts.” Meta is rolling Muse out across iOS, Android, the web, and WhatsApp in the US, with AI glasses support reportedly planned next.

The Real Story Behind the Ranking: Agents Are Getting Real Credentials

Here’s the part that consumer coverage of Muse’s App Store climb tends to skip: an AI agent that can send emails, book travel, manage subscriptions, and check out at a merchant is an agent holding real account credentials — and that’s exactly the problem enterprise security teams have been warning about all year.

Security analysts increasingly treat this as an identity problem, not simply an AI problem. Forrester’s AEGIS framework argues that traditional least-privilege controls fall short when agents act autonomously across multiple systems. The key question is not just what an agent can access, but which decisions we should allow it to make without human approval. That concern applies equally to a consumer agent canceling a subscription and an enterprise agent updating records in a CRM.

The same issue appears in discussions of agent identity access control. Giving an agent the same credentials as a human can make its actions harder to separate, audit, and revoke. Muse takes a different approach at the consumer level: it gives the agent its own virtual machine, makes its browser actions visible, and adds approval checkpoints before certain actions.

Consumer Agents Are Catching Up to What Enterprise Agents Already Do

Muse’s task list — managing email, tracking budgets, completing purchases, running long-term goals like a yearlong plan — mirrors capabilities that have, until now, mostly shown up in developer- and enterprise-facing agent platforms. That overlap is worth pausing on, because it shifts the comparison points consumers reach for.

Someone evaluating Muse today is asking the same question researchers ask about coding and productivity agents: how much autonomy is worth the added exposure? A Devin vs. Manus comparison examines that trade-off for technical agents, and the same logic now applies to a mainstream app ranked No. 2 on the App Store.

Calling Muse an “AI app” also misses an important distinction: chatbots wait for instructions, while agents pursue goals and take actions. AI tools vs. agents explains that difference, and Muse clearly falls into the agent category.

Messaging-focused agents face the same challenge: giving agents initiative while keeping humans involved in sensitive actions. Lindy AI automation shows how that balance works in practice, offering a useful comparison for Meta’s approval-gated approach.

What to Watch Next

Muse’s rise on the App Store shows that mainstream users are willing to give AI agents real tasks, not just questions. But downloads measure adoption, not whether its access model can handle millions of users routing email, purchases, and personal data through an autonomous system.

The next phase will focus less on chart position and more on how Meta and other companies giving agents real account access — handle identity and credentials.

Even the instructions agents follow can create risk when poorly scoped. What SKILL.md gets wrong examines how those rules can become an attack surface.

For now, Muse holds No. 2. Whether its approval-gated, single-VM approach shapes how other companies build consumer agents remains to be seen.

Related: What Is Crew AI? How It Works, Pricing, Features & Best Alternatives (2026)