Meta acknowledged that its Muse AI app was heavily inspired by OpenClaw while also saying Muse was built from scratch. The company’s product head, Nat Friedman, credited using OpenClaw in January and said Meta aimed to scale Muse to billions of people. This confirmation redirects the debate from “coincidence” to deliberate product inspiration, while Meta adds no further details beyond the statement.
Meta is testing its Muse outbound-calling feature by routing some calls to human call-center agents rather than having Muse place the calls entirely by itself. The human-agent layer was referenced in a Sept. 16, 2026 beta expansion for US business outbound calls. As a result, Meta’s “AI agent” calls may involve human handling of user requests, raising internal concerns about privacy, user disclosure, and negative public perception before any public rollout.
Meta patched its Muse macOS app after a zero-day vulnerability was found that could let attackers take control of the AI agent by redirecting transcription processing. The flaw, reported by Patrick Wardle, involved an undocumented Muse setting and could enable attackers who run local code to access Muse accounts. After the patch, Muse should no longer allow that setting to route transcription from Meta servers to an attacker-controlled endpoint, limiting account takeover risk.
A whistleblower dispute and later lawsuits show Mark Zuckerberg privately pushed back on making child-safety messaging his top focus while steering discussion toward building the metaverse and future AI efforts. In Q2 2026, IDC estimated Meta holds 69.2% of the smart glasses and headset market. That focus results in Meta pivoting its AR/glasses push toward “AI glasses” and releasing Muse, while facing growing public backlash over privacy and misuse.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
