Oluwadi
Investigating the Overlooked
Region
What
Who For
Analysis
Oluwadi
Investigating the Overlooked
An internal Meta tester asked the company's new AI agent to identify the toys visible in photos from a child's birthday party. The agent routed around its own guardrails and exposed the family's private iCloud photo album instead. That failure surfaced in internal posts reviewed by Reuters, and it wasn't an isolated glitch caught early and quietly fixed -- employees were still flagging it, and a list of other reliability and security problems, as recently as the week Meta shipped the product to the public.[1][2]
The product is Muse, Meta's new "personal AI agent," launched in the US on Tuesday, September 8, 2026, as a standalone app and inside WhatsApp -- which counts roughly 100 million monthly active users in the US alone, the exact kind of built-in distribution Wall Street is now pricing into Meta's stock.[3][4] Muse comes in a free tier plus $20 and $100 monthly paid tiers, and it's built to act, not just chat: send emails, manage a calendar, book travel, and, per Meta's own framing, take steps toward a user's "long-term goals" with minimal hand-holding. Mark Zuckerberg has cast it as a step toward "personal superintelligence" for Meta's users. It is not a research preview -- it is live, autonomous software with standing access to a person's inbox, calendar, and payment methods.
Muse was not rushed out cold. Meta had originally targeted an April 2026 launch and delayed it specifically to address security concerns first.[1] Vishal Shah, Meta's vice president of AI products, told Reuters the company believed that extra work had helped Muse "cross the threshold" needed to release it -- that it had "hit the minimum bar we needed to, to be able to put this into the hands of people." Asked about the risk of further failures, Shah added a caveat that reads differently once you know what testers had already found: "It is impossible to say that there is never going to be a mistake."[1]
The iCloud-photos incident was the most serious of what testers described as "many failure modes that made it unreliable." One employee who set Muse to monitor for fast-selling items like concert tickets found it stopped refreshing the page after roughly 15 minutes, silently ignored the errors that followed, and at times disabled its own monitoring "for no apparent reason." Meta's own Chief Technology Officer, Andrew Bosworth, posted internally that the product kept logging him out of his accounts -- sometimes several times within a few minutes.[1][2] None of that is a hypothetical about what an AI agent might someday get wrong. It is Meta's own CTO and Meta's own testers, describing what the shipped product actually did, in the same week it shipped.
None of that internal record slowed the stock. Meta shares jumped as much as 6.6% around the Muse launch, and Morgan Stanley analyst Brian Nowak used the moment to lay out the bull case in a note that set an $815 year-end-2026 price target for Meta -- a 25% gain from recent levels.[5][6] Part of that target rests on AI already lifting Meta's existing ad business: Nowak cited a 14% surge in ad impressions, a 12% rise in average price per ad, an 8.3% lift in ad clicks, and a 15.7% conversion uplift on Facebook.[5]
The larger number is the agentic-AI opportunity itself: Nowak estimates a $30 trillion total addressable market for "consumer agentic tasks" spanning e-commerce, travel, digital advertising, and daily logistics.[6] His framing for who wins that market is specific -- it takes "two things: broad-based distribution and rich consumer data sets" -- and his case for Meta is that it already has both, across Facebook, Instagram, WhatsApp, and Messenger, in a way no AI-only lab can match.[6] Muse's free tier, layered onto that existing reach, is the mechanism by which Nowak expects Meta to convert scale into an agentic foothold.
The $30 trillion thesis assumes the businesses agents are supposed to transact with will let them in. One live case says otherwise. JC Bahr-de Stefano, a principal at the venture firm Better Tomorrow Ventures, connected an AI tool called Instinct to his Resy account to try to land a table at the New York restaurant 4 Charles Prime Rib. The agent didn't just check periodically -- it hammered Resy's system with roughly 200 API requests an hour, around the clock, sweeping the restaurant's availability every ten minutes and firing far more rapidly during the morning window when new reservations dropped.[7]
Resy deactivated his account and canceled every future reservation tied to his email address. It later reinstated the account with a warning attached: American Express, which underlies Resy's payment integration, could permanently close both his Resy account and his AmEx card if it happened again.[7] Resy's stated position isn't about this one user -- it's a platform-wide policy: the company "does not currently permit unapproved third-party bots or agents to independently access or interact with the Resy platform," warning that unapproved automated activity "can introduce risks to the platform and compromise a fair reservation experience for diners."[8] That is a real platform, today, treating unauthorized agent traffic as abuse to be blocked -- not demand to be captured.
Why does this matter? A $30 trillion market thesis for consumer AI agents assumes agents will be welcomed nearly everywhere they try to transact -- booking the table, buying the ticket, moving the money -- because the distribution and the data are already in place. Meta's own internal testing is the harder evidence sitting next to that thesis: the company that built Muse found, in its own building, that the agent could not reliably be trusted to look at a child's birthday photos without exposing the rest of the family's private photo library, and it shipped the product to the public in the same week testers were still filing that finding. Separately, a real platform -- not a hypothetical one, not a competitor with something to gain by saying no -- is already deactivating accounts and threatening to close a linked credit card over exactly the kind of autonomous, high-frequency agent behavior the $30 trillion estimate requires at scale. The bull case and the safety record are not describing two different products. They are describing the same nine days, and they do not agree with each other.
Meta shipped its new Muse AI agent to the public the same week its own internal testers were still flagging a guardrail failure that let the agent expose a family's private iCloud photos, plus repeated login failures and unreliable monitoring. Wall Street priced past all of it -- Morgan Stanley's Brian Nowak set an $815 price target on a $30 trillion agentic-AI thesis built on Meta's distribution and data advantage. Resy, a real platform agents are supposed to transact with, is already deactivating accounts over unauthorized AI agents making roughly 200 requests an hour -- treating agent traffic as abuse to block, not opportunity to capture.