“돈 다루는 사이트는 신중히”…내 계정 맡기는 AI에 물어볼 여섯 가지“Sites that handle money” - six questions for an AI you trust with your accounts

Meta's AI agent Muse is drawing attention in the US. It does not stop at answering questions - it makes bookings and payments using the user's own accounts.

Meta launched Muse in the US on September 8. Ten days later it topped the free app chart on the US Apple App Store, passing ChatGPT, Gemini and Claude. The data firm Apptopia estimated 642,000 daily active users in the US - an outside estimate, not a figure Meta published.

The notable part is elsewhere. As an agent that pays and books began spreading, financial, insurance and travel stocks fell together. This does not stay a foreign story, because the same question is coming here: how far do you open your own accounts?

■ What startled the market was friction disappearing

On September 22 the S&P 500 financials index fell about 2%, its lowest close since July. JPMorgan Chase and Wells Fargo each dropped more than 3%, insurer Allstate fell 5.5% and broker Charles Schwab more than 6%. Travel platform Booking Holdings fell 2.6% and gym chain Planet Fitness 9.5%.

What the market saw is "consumer inertia" - staying with a product because comparing, cancelling and signing up again is a hassle, even when something cheaper or better exists. Insurance premiums, phone bills and subscriptions have profited from that behavior.

So what happens when an agent handles the hassle?

Goldman Sachs argued that the better agents get at price comparison, travel booking and negotiating with customer service, the more pressure falls on industries relying on recurring payments and negotiable prices, naming telecom, insurance and utilities. Its "consumer inertia" basket fell 2.6% that day.

Korean coverage read this alongside the software selloff that followed Anthropic's Claude Cowork release in February.

■ Muse's approach - the agent never sees your password

So how did Meta handle that risk?

For an agent that pays, a single mistake is hard to undo. That is why Meta's announcement spends so long on design.

Muse runs on Muse Secure VM, a dedicated virtual machine in the cloud holding both the agent and the user's data, with credentials for connected services stored there - contained, Meta says, so no one else's agent can reach it.

A separate Sentinel agent runs on the same machine, kept apart at the system level. Meta says nothing Muse does reaches the internet unless Sentinel approves it, and it asks the person for permission when needed.

The key point follows. Meta states Muse has no visibility into passwords or payment methods: shared credentials go into secure storage and Muse uses them without seeing them, including passwords typed into the browser directly. Checkout runs through Stripe's Link, which generates a one-time-use card so real card details stay hidden.

It also confirms before acting. Meta says Muse checks with the person before sensitive actions like sending an email or making a purchase, and shows a complete audit trail of what it has done and plans to do. Access is chosen per app - for email, whether Muse only reads mail or can also send on the user's behalf. Access can be changed or disconnected at any time, and interactions can be opted out of model training.

■ But you cannot use it in Korea yet

If you were about to go check your settings - not yet.

Meta's announcement says Muse is rolling out in the US on iOS, Android and muse.ai, with AI glasses coming soon. No Korean launch date appears in it.

So for now Muse is not something to configure here; it is a baseline. One company has written down what an agent trusted with payments should have: credentials invisible to the agent, confirmation before sensitive actions, an audit trail, per-app permissions, instant disconnection, and a training opt-out.

■ What you can actually adjust today

So what can you check today?

Among tools usable here, the one that handles accounts on your behalf is Claude Cowork. Anthropic's help pages show where the same items live.

Cowork has a browser built into the Claude Desktop app. When a task involves a website, a browser opens in the side panel and Claude opens pages, reads, clicks and fills forms while you watch. It is rolling out this week on Pro, Max and Team plans, and on Enterprise where an owner has enabled it.

Credentials work differently from Muse. Anthropic says the built-in browser is separate from your own and that Claude does not see your saved logins unless you choose to import them. The first time it opens, it offers to import cookies from Chrome, Edge or Firefox - all three on macOS, Firefox only on Windows and Linux. Safari is not supported.

A warning in that same document lands exactly on this article's point: anything you sign in to inside the built-in browser is available to Claude in future Cowork sessions on that computer, so be deliberate about which sites you sign in to - especially sites that handle money or personal information.

Connection types split too. Remote connectors attach to cloud services you sign into, like Slack or Notion, and once connected work everywhere - web, mobile, Cowork, Desktop and Claude Code. Desktop extensions attach to local files or programs and work only in Desktop and Claude Code. The reach differs, so it is worth checking which kind you are attaching.

■ Questions to ask before granting access

Muse or Cowork, the questions for any tool handling your accounts are the same.

• Can the tool see your passwords and payment methods - Meta says Muse cannot; Anthropic says Cowork cannot until you import cookies
• Does it confirm before money moves - purchases and outgoing mail are the test cases
• Is there a record of what it did - Meta says Muse shows a complete audit trail
• Can you grant read-only - reading mail and sending on your behalf are separate choices
• Do logins persist into later sessions - in Cowork's built-in browser they do
• Is there a single way to cut it off - find where disconnection and training opt-out live in advance

One closing note. There is still no public data comparing agents' task success and error rates under the same conditions. Rather than connecting an account with money attached because it looks convenient, it is better to start with work you can undo if it goes wrong.