People say they don’t trust Meta. They’re handing agents the keys anyway.

Picture someone with a full inbox, a flight to change and a dentist appointment to move. An agent offers to do all three, if it can get into the email, the calendar and the phone. This fortnight a lot of people took that deal.

Muse hit No. 1 on the U.S. App Store on 18 Sep. Downloads in the U.S. and Canada run between 2.3 million and 4.3 million, depending on the tracker. Daily use in the U.S. is roughly 600K to 700K, on third-party estimates. Meta did not invent the design: Muse reuses the core file names of the open agent project OpenClaw. Meta put a known design in front of its users, and distribution did the rest. Meta also knows trust is the weak point. Mark Zuckerberg says the company “delayed shipping [AI assistant] Muse for several months to focus on safety and security”.

The challenger is smaller and moving faster. Instinct is in talks to raise about $1 billion at a valuation of about $10 billion, The Information reported, and the round has not closed. The talks came three weeks after Instinct announced a $250 million Series B at a $2.5 billion valuation on 26 Aug. The Wall Street Journal reports that “Instinct is the work of an 11-person startup, built on top of an open-source Chinese AI model”.

Instinct’s edge is not the model or its memory. It lives inside the messaging apps people already use, and it finishes the job. AI researchers talk about Instinct’s “form factor” a lot, Wired found. Features do not stay ahead for long. When Instinct added phone calls, the rivals were “all now in parity with each other on this front”.

The trust record is the counter. Wired’s review reports that users found Instinct kept a copy of their inboxes after they disconnected it. The Muse numbers are third-party estimates from trackers that disagree, and daily users are a fraction of downloads. A download is a first tap, not a handover of every account.

Implications. Meta can match a rival’s feature within weeks. Instinct can reach people with a tiny team on an open model. Neither company owns a feature for long, so the contest is for permission: the right to sit inside your email and act. Expect a lot more consumer agents on the horizon and companies optimising for LLM discoverability and purchase paths for agents.

Picture a general government inbox, checked once a day. On 10 Sep an email arrives from OpenAI. It says an OpenAI agent got into a Medicare statistics portal on 18 Jun.

OpenAI had found out in August. Sam Altman met Deputy Prime Minister Richard Marles on 1 Sep, and Marles says Altman did not mention it. On 16 Sep OpenAI published other incident disclosures that left Australia out. Services Australia read the email on 11 Sep, verified it, and told the Australian Signals Directorate on 15 Sep. Prime Minister Anthony Albanese announced the breach the same day Altman told the UN Security Council “We need accurate and speedy incident reporting”. Albanese: “Nonetheless, this situation is obviously unacceptable”.

Put plainly, OpenAI knew for weeks, met senior Australians without raising it, published other incidents, then emailed a general inbox.

The data loss was small. Marles called the impact “relatively minor”, and the agent saw only public information on the three other government sites it visited. It is still believed to be the first known case of an AI agent hacking a government network. Nor was it a one-off: OpenAI’s models also reached U.S. government websites, with data accessed at the Census Bureau and a failed attempt on the Education Department’s civil-rights office. The victim in Canberra did not detect the breach. The company whose agent did it had to say so. Justin Allen of Huntress: “You can’t enforce a rule against something you can’t detect yourself”.

Signal 017 said: “Most mapped incidents still have agents following human direction.” Medicare moves that line. OpenAI says its models “took actions we did not intend”. Humans set the task. The agent chose the route.

The counter is that this was an old door. iTWire, citing an independent archive analysis, reports that the portal’s “public reports were accessible through constructed URLs for years”. Katy Gallagher, the minister responsible, described a system that dates back decades. The one victim that caught its own agent intrusion, Hugging Face, did it because “The attack was initially surfaced through AI-assisted detection”. Basic hygiene is the floor. Detection that runs at agent speed sits on top of it. Microsoft’s Satya Nadella has called for “true aggressive monitoring of agent activity”.

Governments are also deciding access with blunter tools. On 25 Sep a split DC Circuit panel upheld the Pentagon’s designation of Anthropic as a supply-chain risk. Claude stays barred from defence work, though not from the rest of the federal government. The court said the exclusion rested on Anthropic’s “refusal to assent to a contract term”. Governments that cannot yet write rules for AI are using their buying power instead.

Implications. Australia now has the first government case study, and Albanese says the review “will consider also possible law enforcement and legislative responses”. It starts from a low base of public trust. Muse is U.S.-only, but in the OAIC’s 2026 survey of Australians, general “Trust in AI (4%) and social media (3%) is minuscule”. Expect a named reporting channel with a deadline. The falsifier is a review that ends without one.