Meta Muse vs ChatGPT Agent: Two Companies Built Two Very Different Cages for AI That Acts Like You

Meta launched Muse, a consumer AI agent with access to email, calendar, and payment capabilities, on September 8. The agent is designed with a safety architecture that includes single-use card numbers via Stripe Link and a bug bounty up to $300,000. This launch contrasts with OpenAI's ChatGPT Work agent, which relies on a trained, monitored model rather than architectural walls.

On September 8, Meta handed a consumer AI agent three things that used to be considered untouchable: access to your email, your calendar, and a way to spend your money. The agent is called Muse, it launched the same day OpenAI was fielding accusations about a stolen math proof, and the timing was probably not an accident. A launch that would normally dominate the tech news cycle got buried under the Navier-Stokes controversy instead. I run my own AI agent infrastructure, the kind that publishes articles and manages my content pipeline while I sleep. My agents have strict boundaries: no bank accounts, no email sending, no purchases. So when two of the biggest companies on the planet shipped consumer agents with payment rails attached in the same year, I read both architecture documents closely. This article is that comparison. One full disclosure before anything else: Muse is US-only at launch and I am in Bangladesh, so I have not used it. Everything below comes from Meta's announcement, coverage by WIRED, TechCrunch, and SiliconANGLE, and OpenAI's own system card and help docs, with my judgment layered on top. Where a claim is Meta's marketing, I say so. Muse is a personal agent that lives in Meta's cloud. You message it from a dedicated iOS or Android app, from muse.ai on the web, or from inside WhatsApp, and it opens its own browser and does things on your behalf: sending email, booking travel, filling out forms, negotiating bills, turning a recipe reel into a grocery list, and completing purchases. The pricing structure tells you who Meta thinks will use it: It is powered by a model Meta calls Muse Spark, under Chief AI Officer Alexandr Wang, and it is coming to Meta's smart glasses later. US-only for now, 18 and older. None of that is why this launch matters. Plenty of companies have demoed errand-running agents. What matters is the cage Meta built around it, because the cage is an argument about how AI safety should work, and it is a direct rebuttal of how OpenAI does it. Meta's architecture has two load-bearing pieces. Payments get their own layer. Checkout runs through Stripe's Link, which issues a single-use card number per transaction, so the agent never handles your real card details. Meta says Muse is the first agent covered by Link's agent purchase protections, which guarantee no-fee returns. Shopify's Shop Pay and 1Password integrations are coming. The trust extras are unusually specific: you can opt out of your interactions training Meta's models, you can instruct Muse to forget specific things it has learned, and you can review an audit of its actions. A stronger tier called Confidential VM is coming, which runs the whole VM inside a trusted execution environment with access keys held on your device, meaning even Meta could not read the contents. Meta is working with Moxie Marlinspike, the creator of Signal, on that design, plans to publish the binaries with a transparency log, and is giving selected security firms source access. And they are putting money behind it: Muse is covered by Meta's public bug bounty, up to $300,000 for a valid security hole, including up to $130,000 for a reproducible prompt injection that compromises a single user. When a company pays six figures for proof its safety architecture fails, that tells you what they are afraid of. OpenAI's consumer agent stack has moved fast this year. The original ChatGPT agent mode, which folded in Operator, is being superseded by ChatGPT Work, launched July 9 on GPT-5.6 with Codex technology underneath. Work runs on a persistent cloud VM on OpenAI's servers, breaks a stated goal into steps, and works across your connected apps and files for hours, producing finished documents, spreadsheets, and sites. The safety model is different in kind. Where Meta built architectural walls, OpenAI mostly built a trained, monitored model: The system card publishes the numbers, which I respect. On a synthetic challenge set, ChatGPT agent disregarded irrelevant instructions and exfiltration attempts in the text browser 99.5% of the time, and 95% in the visual browser. But on active data exfiltration attacks in the visual browser, where an adversary actively engineers the attack, the success rate drops to 67% . One in three active attacks got through the model's training defenses in testing. That 67% is the single most important number in this comparison, and I suspect it is the number that pushed Meta toward architecture instead of training. If your defense is "the model is trained to resist manipulation," a 67% defense failure rate under active attack is a thin wall for a system that can send email as you. Meta's answer assumes the model WILL be manipulated and puts the checkpoint outside the model, in a process the model cannot override. Here is the comparison I wish someone had published, as a decision aid rather than a scorecard: Neither, yet, with anything that would hurt me if leaked. But I trust their failure modes differently. OpenAI's approach fails statistically. A trained model resisting manipulation 67% of the time under active attack will eventually fail on someone's machine, and you have no way to know whether your task is the unlucky one. The mitigations are honest about this: the help docs flatly state the safeguards do not eliminate all risks. Meta's approach fails architecturally or not at all, at least in theory. If Sentinel genuinely cannot be overridden by the model, then a successful prompt injection gets you a confused agent, not a drained inbox. The catch is the phrase "genuinely." Sentinel is unproven in public, the strongest version of the design, the Confidential VM, is future tense, and Meta is the company that agreed to an $18 billion settlement over consumer harms less than two weeks before launching a product that requires consumers to trust it with their inboxes. WIRED noted the uncomfortable detail that Meta's policies prohibit staff from looking inside user Secure VMs, but technically nothing stops them, as Meta's own VP of Engineering for consumer products confirmed. My read: Meta's architecture is the right idea wearing the wrong company's logo, and OpenAI's transparency is the right practice protecting a weaker design. Watch which one copies the other first. Whether you get access to Muse or you run ChatGPT agent tasks today, this is the checklist I would apply, based on what both companies' own documents say: I have kept my own agents fenced off from money and email for exactly these reasons. Reading the Bottleneck Labs experiment last week, where seven frontier models with real bank accounts earned $0 and invoiced strangers $12,431 in 72 hours, did not make me want to loosen those fences. But architecture like Sentinel is the first design I have seen that addresses the actual failure: not a dumb model, but a manipulated one. The consumer agent era is now officially here, from two companies with opposite philosophies. The next twelve months of incident reports will settle which cage holds. I write about AI agents, developer tools, and backend engineering every week, based on what I actually run in production. Subscribe, it is free, and you will get the comparisons and incident write-ups before they trend. Have you used ChatGPT agent mode or Work for real tasks, and would you hand an agent your inbox or your credit card first? I would like to hear where you draw the line.