Muse Bought It: What Happens Between "Buy It" and the Charge

Somebody else's agent already made the mistake. A user of Instinct, one of the shopping agents that launched before Muse, asked it to book a restaurant, and it booked the wrong one, or the wrong night, and the cancellation charge was $200, and the user said the bot should cover it.

That is the whole question, in one small bill. When an agent spends your money and gets it wrong, who pays? Meta's answer is written down, in public documents that anyone can read, and it is not the answer most people would guess, because the company that built the agent, the company that moves the money, and the merchant that fills the order each point at somebody else when the purchase goes wrong, and the finger stops with you. Since September 8, Muse has been able to complete purchases on your behalf, not just find products and hand you a link. It searches, it picks, it fills in the checkout, and it pays. Before you let it do that with your card, you should know what happens between your words and your bank statement, because that stretch of pipeline is where the money actually moves, and where the responsibility lands.

Four steps, one tap

Here is the purchase, end to end. You tell Muse to buy something, and it searches retailers, compares options, and prepares a checkout, and then it stops, because before any money moves it has to show you the total and ask you to approve it, right in the chat. That approval is not a formality, because it is the only moment in the whole process when a human being looks at the number. One tap. That is the whole system.

Once you tap approve, the payment itself runs through Stripe's Link, the saved-payments wallet that now has more than 300 million users. At the more than one million businesses that accept Link, Muse checks out instantly with the payment method you already saved there. Everywhere else, Link issues Muse a single-use virtual card, scoped to the approved purchase. Your real card number never reaches the agent, and it never reaches the merchant either. Meta's safety team describes the credential as tied to one particular merchant, one particular dollar amount, and valid only for a limited period of time, and once you spend it, it is dead.

Behind that tap sits a second piece of machinery most users never hear about. Meta runs a separate process called Sentinel, outside the language model, that decides whether an action is allowed, blocked, or sent to you for approval, while Muse only proposes actions and Sentinel alone grants them. A purchase is classed as a sensitive write, and sensitive writes cannot be set to always allow, which means no setting exists that lets Muse buy things without asking you first. That is a real guardrail, and it is the only hard one in the system, because everything else that looks like a limit, a budget, a category block, or a spending cap, turns out on inspection to be a suggestion in the terms, a feature Stripe says is planned, or a tap you can repeat as many times as you like.

Two more rails arrived within two weeks of launch. Shop Pay went live on September 24, after Shopify added Meta as an AI channel in its Agentic Storefronts program, so Muse can search Shopify catalogs and check out with Shop Pay on any Shopify store, and PayPal joined on September 22. Meta has also said it expects, over time, to take a small fee from transactions, with no rate, no start date, no scope, and no statement of who pays. For now, merchants pay only standard processing fees.

Three rails, very different protection

Not every way of paying is equal, and the difference matters more than the checkout speed. Here is what each rail actually gives you.

Read that last row again, because Muse has no per-purchase cap, no monthly budget, and no category block anywhere in its settings. Meta's own terms hand that job to you, in plain language: you are solely responsible for setting appropriate limits and safeguards, including transaction limits and category restrictions. Stripe says expanded controls are planned, not shipped. Every purchase needs a fresh tap, and that tap is the entire budget.

The $1,200 ledger

Now run a purchase through the system the way it would actually fail. Say Muse books a hotel night for the wrong date, twelve hundred dollars, non-refundable. Same shape as the Instinct restaurant booking, just bigger, and hotels are the kind of purchase people actually ask agents to make.

Start at the top. Meta's liability is capped at the greater of $250 or whatever you paid Meta in the preceding twelve months, so on the $20-a-month plan that cap is $250, and it covers claims against Meta, not the money the merchant already took, which means the cap is a ceiling on what you can recover from the company that built the agent, not a refund of the charge itself. Next layer: Link's purchase protections, the ones Meta advertises when it calls Muse the first AI agent covered by them. Damage, loss and theft up to $500 per claim. No-fee returns up to $250. Price protection up to $500. Refund guarantee up to $1,000. Real money, real coverage, and none of it applies here, because services and travel are excluded from all four protections. Agent-initiated transactions are also excluded from Link's unauthorized-transaction protection, and Stripe's agentic terms are blunt about why: you are responsible for all agent-initiated transactions as if you had taken the action yourself, including transactions caused by bugs, hallucinations, or misinterpretations, or that differ from your provided instructions.

So the merchant keeps the $1,200 unless its own policy allows a change. Your card's chargeback rights are the last resort, and a chargeback for "I approved it, but the agent picked the wrong night" is a weak dispute, because you did authorize the transaction, and the authorization record will show it. Add it up. Merchant: $1,200 kept. Meta: at most $250 in theory, zero in practice for a merchant's non-refundable policy. Link: zero. You: $1,200, minus whatever the merchant concedes out of goodwill.

None of this is hidden. Meta's help page states the rule in eleven words: "You're responsible for all transactions your Muse makes on your behalf." That sentence is the whole purchase agreement, and it sits one tap away from every order.

Why the tap is not enough

Fairness demands the other side of this, because the approval tap is a genuine control, and it is stronger than what most shopping already gives you. Every single purchase requires a fresh human decision with the exact total shown, which is more friction than one-click ordering, saved cards, and subscriptions that renew silently for years. Liability language like this is also standard. Every card network's terms make the cardholder responsible for authorized transactions, and "you approved it" has always been the line.

That argument has force, and it fails on two points. First, an approval tap is only as good as the attention behind it. An agent that prepares forty checkouts a week trains its user to tap Allow the way people click through cookie banners, and nothing in the system measures that degradation or slows it down. Second, and this is the point the terms never address, the old rule assumed the person tapping had done the choosing, that they had compared the options, weighed the price, and picked the merchant, the size, and the date, and when the agent does all of that choosing and the human only confirms, the human is authorizing a decision they did not make, under rules written for a world where the buyer and the chooser were the same person. No law has caught up to that distinction yet, and the terms are written as if it never will.

There is also a hole in the map that buyers should know about. On September 20, twelve days after launch, Amazon blocked Muse purchases outright, saying access by an unauthorized AI agent violates Amazon's Conditions of Use. Amazon's stated reasons were that Meta did not notify it, that the agent does not identify itself, and that it appeared to store customer credentials. Shopify took the opposite approach and built agents an approved route in. Between those two responses sits the real question for the next few years: whether a merchant gets to say no to an agent spending your money in its store, and what happens to your protections when you buy anyway. Juniper Research puts global agentic spending at $8 billion in 2026 and projects $1.5 trillion by 2030, a jump of nearly two hundred times in four years that would make agent-initiated purchases one of the largest new payment flows in history, and every one of those dollars will pass through the same unresolved question of who consents, who approves, and who pays when the agent gets it wrong. Somebody is going to have to answer that question at that scale. For now, the answer is written in terms of service nobody reads.

What I could not verify

Honesty requires saying what this piece did not prove. Meta's Supplemental Terms and Stripe's Link Agentic Terms were read through secondary reporting that quotes them directly, and the quotes used here are the ones that agree across at least two independent sources. I did not independently fetch the full terms text in this pass. The $1,200 hotel ledger is a worked example built from the published terms and protection limits, not a real Muse transaction. No Muse user has publicly documented a wrong purchase of this size with a dollar outcome, and the restaurant failure cited is from a rival agent. Link's protection limits are as listed by Link and reported by multiple outlets, but eligibility conditions and annual claim caps were not fully verified. Juniper's forecast is a vendor projection, not measured spend. And Meta's transaction fee has no published rate, date, scope, or payer, so anything about what Muse purchases will eventually cost the merchant is speculation.

What to do before your first order

Pay through Link's one-time card, never through a saved card on a merchant login. It is the only rail that adds protection, and the only credential that cannot be spent twice. Keep the Link wallet thin: one card with a modest limit, not your primary card, and never a debit card tied to your checking account. Read the approval total every time, because that tap is the moment liability transfers to you, and it is the only spending control that exists. Do not let Muse buy services, tickets, travel, or food on your behalf yet, because Link's purchase protections exclude all of them, and those are the purchases where getting it wrong costs the most. After any agent purchase, check the merchant confirmation email and your statement the same day. A wrong purchase caught in hours is a phone call, and a wrong purchase caught in weeks is a chargeback fight, with the authorization record sitting on the merchant's side of the argument. And if a store blocks Muse the way Amazon did, do not work around it. That block is the merchant saying it does not consent to agent purchases, and buying anyway puts you outside every protection in the stack.

Muse buying things for you is genuinely useful, and the machinery underneath it is better designed than most people realize. A one-time card number, scoped to one merchant and one amount, that dies after a single use, is a serious piece of engineering, the kind of design that only exists because somebody at Stripe sat down and asked what could go wrong when a machine spends a stranger's money, and then built the credential so the worst case is one purchase, not an open account. But engineering is not the same as accountability, and the accountability in this system sits in exactly one place, your thumb on a button once per purchase, and it will sit there whether you are paying attention or not, so the only advice that matters is the simplest one there is. Make sure it is awake when it taps.