OpenAI Dots and Meta Muse: always-on personal AI agents

Meta shipped Muse free on iOS, Android and the web on September 8 ^[6][7]and handed users 100 million free tokens a week ^[11]. OpenAI answered on September 29 with Dots ^[1]at $100, $200 and $500 per month across its Pro 100/200/500 tiers, plus Business Premium at $125 per user per month ^[5], with Bloomberg billing the new $500 tier alongside the agent itself ^[9]. Each dot runs GPT-6 Astra on its own cloud computer and browser with plugin reach into more than 4,000 apps ^[2], while the Pro rollout skips the European Economic Area, Switzerland and the UK and Business Premium ships across all supported ChatGPT regions ^[4]. CNBC and Yahoo Finance read the sequencing identically: OpenAI followed Meta into a market Meta had already validated ^[15][16]. The fork is unusually clean for a category this young. Meta is buying consumer habit at zero marginal price to the user and betting distribution compounds. OpenAI is selling governed autonomy at a price only a company expense line absorbs. Nobody is competing on the same axis, which means the first real test is not which agent is smarter but which business model survives the support burden of acting on someone's live accounts.

Strip away the mascots and both products are permission engines. Dots ship Custom Rules in which the user declares what the agent may do alone, what it must ask about first, and what it may never do, with changing a password cited as the canonical never ^[3][4]. Muse answers with infrastructure instead of policy: a dedicated Muse Secure VM with isolated infrastructure, a Sentinel agent that gates internet access and permission requests, credential storage designed so the assistant cannot read passwords, and a promised Confidential VM where only the user holds the decryption key ^[6]. Meta went further in press comments, insisting that "even Meta won't be able to see that information" ^[12]. What is striking is that builder communities arrived at the same shortlist independently. A gap analysis of self-hosted agents versus the commercial ones named persistent responsibilities that survive sessions, a proactive mode that monitors permitted sources while the user is away, per-action AUTO/ASK/BLOCK rules, agent-to-agent handoffs and an inspectable workspace the human can take over. Model quality never appears on that list. Muse power users have meanwhile invented a guardrail no vendor gave them, draft-then-approve for outbound texting, and Meta's own retreat points the same way: it killed a planned human-concierge feature over data-leak concerns ^[11].

Muse topped the App Store on September 18. Three days later a proof-of-concept for the flaw nicknamed not-a-mused was on GitHub ^[14]. The mechanism was mundane and devastating: an undocumented setting, endo_voyager_dictation_endpoint, could be rewritten by any unprivileged local process to hijack voice-dictation traffic and capture the agent's authentication token, handing an attacker account-level control over every service the agent had been granted ^[13][14]. Meta shipped a hotfix removing the setting the next day ^[14], but the two sides never agreed on what had happened. Patrick Wardle called it "the ultimate backdoor," while Meta's David Singleton framed it as "a local privilege escalation" ^[14]. Both readings are technically defensible, which is precisely the problem with always-on agents: a low-severity local bug inherits the blast radius of everything the agent can touch. The quieter finding in the same disclosure is arguably worse for companies - no enterprise controls, no SIEM exports, no admin console and no documentation for monitoring which employee accounts had been connected to Muse ^[14]. Investor Jason Calacanis responded with a demand that doubles as the category's missing standard: "tight defenses and 3rd party testing" ^[12].

The adoption numbers are real and also nearly uninterpretable. Muse hit number one on the US App Store on September 18 and topped Google Play the next day ^[8][10], reached 2.5 million downloads in 13 days and beat ChatGPT's own launch record ^[11], yet trackers could not agree on the total: 2.3 million from Appfigures, roughly 3.4 million from Sensor Tower, 4.3 million from Apptopia ^[10][11]. A two-million-spread estimate is a measure of interest, not of whether the agent works. Hands-on verdicts are more useful and more hedged: Yahoo Finance's technology editor found Muse "generally a solid AI agent for the average person" while explicitly noting it makes mistakes ^[15]. Financial video coverage circulated a viral story of a user who got a delayed flight refunded in about two minutes, then immediately asked the unanswered question - who is liable when the agent botches the refund instead. Community reaction splits along exactly that line. Builder forums treat Dots and Muse as a spec to reverse-engineer and catalog use cases for, from read-only financial monitoring to watch-only wallet alerts. Mainstream AI forums were skeptical to dismissive, with the sharpest pushback aimed at over-broad permission requests, including one account of Muse asking for Shopify write plus full Gmail access and being refused outright. Amazon made the institutional version of that refusal, blocking Muse under policies against shopping automation ^[11]. Bloomberg's framing is the fair one: both companies are testing public trust ahead of settled oversight ^[18].

Meta shares went from $613.48 on September 8 to $777.59 on September 24, a 26.8% run including an 11.43% single-day surge on September 21 ^[11], capping roughly 27% to 36% for the month and Meta's strongest monthly performance in over a decade ^[17]. Wells Fargo lifted its target from $640 to $796 ^[11], and in financial video commentary an Evercore analyst reaffirmed an outperform with an $860 target on the thesis that Muse could become Meta's first meaningful consumer AI revenue stream outside advertising. Set against that, the cash picture inverts: Meta is projected to post negative free cash flow of $6.4 billion in 2026 and negative $29.2 billion in 2027, after $46 billion positive the prior year ^[17]. The rally is therefore a bet that a free agent with 100 million weekly free tokens ^[11]converts into something billable before the buildout bill lands. The surrounding theater reinforces how early this is - Zuckerberg's Roman-general avatar Agrippa ^[12], life-size Jolly cutouts at Connect and a Tamagotchi-style Muse charm keychain ^[10]. On X, independent commentary framed Dots not as a breakthrough but as OpenAI's reactive answer to Muse and rival assistants, with a recurring question about whether Dots will ever be free. That is the real competitive pressure: Meta has set the consumer price at zero while burning cash, and OpenAI has to justify $100 a month against it.