Five Million Downloads Later, Who Guards the Agent

“Watermelon uses an order of magnitude more compute than Avocado.” That line, attributed to a Meta figure in Business Insider’s coverage ahead of the Muse Wonder launch, refers to internal codenames — Avocado for the earlier Muse Spark family, Watermelon for what became the model Meta shipped on October 12, 2026. It is a sentence about scale, and it tells you exactly what the company measured and what it did not.

I spend my days looking at how AI agents get tricked, hijacked, and turned against the people who deployed them. So when Meta positions Muse Wonder and Muse Wonder Full as its most capable models to date, and claims they perform competitively against OpenAI and Anthropic on selected coding and reasoning benchmarks, my first question is not whether the claim holds. My question is what happens when a model this capable is wired to a credit card.

The capability story is not the risk story

Benchmarks on coding and complex reasoning tell you how well a model performs when the input is cooperative. A coding task does not try to deceive the model. A reasoning problem does not embed hidden instructions in a footnote. Adversarial behavior is a different axis entirely, and the published numbers do not speak to it.

This matters more for Meta than for a lab shipping a chat window, because Meta already told us what the models are for. The Muse personal AI assistant launched on September 8, 2026, and according to Sensor Tower it hit five million downloads in 22 days. The app sends emails, books travel, fills out forms, and makes purchases on a user’s behalf.

Read that capability list again as an attacker would:

• Sending emails — an outbound channel for data the agent can read. Also a trusted identity to impersonate, since mail from your account carries your reputation.
• Booking travel — a transaction with real cost, real personal data, and a confirmation flow that looks routine enough that most people will not read it closely.
• Filling out forms — the agent decides what counts as the right value for a field. Hostile pages get a say in that decision.
• Making purchases — direct financial loss, executed with legitimate credentials.

Every one of those actions crosses a trust boundary. The agent reads untrusted content — a web page, an inbox, a PDF — and then takes an action with the user’s authority. That gap between untrusted input and authorized action is where prompt injection lives, and it is not a bug you patch once. It is a structural property of the design.

Scale changes the math

Five million downloads in 22 days is a fast adoption curve, and fast curves are the ones that outrun security review. A single working injection against a widely deployed assistant does not compromise one user. It compromises a population, because the attack travels through content rather than code. There is no malware to detect, no binary to sign, no CVE to patch. The payload is text, and the text looks like a sentence.

More compute makes this harder, not easier. A more capable model follows instructions better. It infers intent more aggressively. It chains steps without asking. Those are the same properties that make it useful and the same properties that make a well-crafted injection more likely to succeed end to end rather than stalling halfway through.

What I would want to see

I am not arguing Meta has shipped something reckless. I have no evidence either way, and the public material I have seen covers capability claims and selected benchmark comparisons, not defensive evaluation. That absence is the point. If you are shipping an agent that can spend money, the numbers worth publishing are:

• Injection resistance rates against adversarial content, with the test set described.
• Whether the agent separates untrusted input from operator instructions at the architecture level, or only through training.
• What actions require confirmation and what the confirmation actually shows the user.
• Spending limits, rate limits, and whether they are enforced outside the model.
• Audit trails detailed enough to reconstruct why the agent took an action.

If you are testing it

For anyone evaluating Muse Wonder in a work context, treat the assistant as a user with your permissions and your email access, not as a tool. Scope its credentials to the minimum. Give it a separate payment instrument with a hard cap. Assume anything it reads can instruct it, and design your approvals around that assumption rather than around the vendor’s confidence.

Meta spent an order of magnitude more compute to win on coding and reasoning. The industry still owes users a benchmark for the thing that actually costs them money.

🕒 Published: October 15, 2026