Meta just gave the assistant inside its apps a memory, and the ability to build you a dashboard from one sentence. Muse and Meta AI now run on models trained by Muse Wonder, Meta's top model, and they forget a lot less. The same day, Muse learned to build small custom tools called Spaces. Meanwhile Shopify put hard numbers on AI shoppers, and Microsoft timed an AI-powered break-in at five minutes. Here's the one you can't ignore, then the rest.
Meta's Muse remembers more, and builds you a dashboard
On November 6 Meta started rolling out specialized models trained with Muse Wonder to everyone using the Muse agent and the Meta AI assistant. The upgrade is automatic and free. Wonder itself stays reserved for heavier subscriber workloads; what everyone gets is a smaller model that learned from it. Two features ride along. Active Memory carries details from one conversation into the next. Active Focus keeps the agent working when a task hits an unexpected problem instead of stopping to ask.
Meta's own numbers: the new models are about 2.4 times less likely to forget critical information, use critical context correctly in 90% of tasks (up from 76%), and are "67% better" at self-correcting on everyday tasks. Meta did not publish the baseline for that last one, and none of this has been checked by anyone outside Meta. Treat the numbers as a direction, not a measurement.
The same day Meta announced Spaces: you describe a tool in plain words and Muse builds it inside the app. Meta's own examples include a shopping hub that pulls together gift ideas, wishlists made from Instagram saves, and Facebook Marketplace listings with buyer messages; and a small-business order tracker. Once you connect other apps, a space refreshes itself in the background and surfaces things like price changes. Spaces are available "everywhere Muse is available", which today means the US on iOS, Android, the web and WhatsApp. Sharing a space with someone else is not possible yet. Zuckerberg said in October that more than 10 million people in the US and Canada had set up a Muse agent.
Why this matters for you comes in two halves. First, the customer. A shopper whose assistant remembers is a shopper who says "the beige one I asked about last week, in medium" and expects an answer. And a space built from their Instagram saves is a list of your posts, sitting in their shopping hub, re-checking your price in the background. Your product posts are about to be read by software that never forgets them. Second, the bar. Meta's pitch for its assistant is "it remembers you." If the assistant in your DMs forgets what the customer said two messages ago, that gap is now visible to the customer. One memory across channels is the whole job, and we wrote about what that looks like in the multichannel inbox: one place, one memory. Last issue covered Amazon blocking this same agent; this week Meta made it smarter anyway.
Shopify's numbers: AI shoppers convert 64% more often
Shopify's third-quarter call on November 3 was the first time a big platform put hard numbers on AI shopping traffic. President Harley Finkelstein: AI traffic to Shopify stores is up 2.6 times year over year, and orders from it are up 3.3 times, growing faster than the traffic. AI channels send shoppers straight to product pages at three times the rate of organic search, and those shoppers convert 64% more often. Revenue grew 32% to $3.74 billion.
Two more lines matter. Shopify Catalog, which rewrites more than a billion product pages into data that agents can read, powers product discovery inside ChatGPT, Microsoft's assistant and Meta's Muse, and the searches it powers convert at twice the rate of general AI search. And Q3 was the first quarter Shopify saw shoppers trying delegated purchasing: a personal agent finishing the order with the shopper's permission. Small volume, Finkelstein said, but growing. On the merchant side, Sidekick, Shopify's own assistant, wrote about two-thirds of all Flow automations in the quarter.
My take: AI traffic is not browsing traffic. Someone who asked an assistant a question and got sent to your product has already done the comparing. That is why it converts. The shops winning this traffic are not the ones with the prettiest page. They are the ones whose product data answers the question: price, variants, stock, shipping, in a form software can read. You do not have Shopify Catalog. You do have a product list and a DM inbox, and the same rule applies to both: if your assistant has to guess about stock or size, the AI shopper leaves. Start with training your assistant on your product catalog.
An AI agent went from GitHub to a company's secrets in five minutes
Microsoft Threat Intelligence published a report on November 5 about attackers using ARTEX, an open-source agentic penetration-testing framework, to scan public GitHub repositories for exposed passwords, app secrets and AI API keys. Microsoft has seen large volumes of these queries since August, often naming a target company or cloud keywords. In one case the agent went from scanning GitHub to pulling data out of an Azure Key Vault in about five minutes. Other cases used stolen credentials to drain storage accounts and run up bills on Azure AI services.
The security industry is pricing this in. TechCrunch reported the same day that Palo Alto Networks is in talks to buy Clutch Security, a startup that protects the API keys, tokens and service accounts used by AI agents, for about $500 million in cash plus milestone payments. Talks are early and nothing is signed. OpenAI, for its part, announced a partnership with Hacktron on November 6 to test the security of its models' connections to third-party services.
What this means for a shop, not a cloud company: a leaked key used to sit around for weeks before anyone found it. Now a bot finds it in minutes. Your shop has keys too: the payment gateway, the WhatsApp Business token, the Instagram access token your freelancer put in a repo, the SMS panel password in a Telegram group. Three things to do this week. Rotate any key that has ever been pasted into a chat. Give every tool the minimum access it needs. Ask every vendor that connects to your accounts where your tokens live and who can see them. Microsoft's advice to engineers is the same advice in bigger words: scan, rotate, least privilege.
Quick takes
- OpenAI closed the first $11 billion of its new round. Reuters, citing Bloomberg on November 6, reports a $1.25 trillion pre-money valuation, with SoftBank and MGX among the investors. The round is now aimed at about $20 billion, down from an earlier $30 billion target. My take: your AI tools stay cheap while this money lasts, and a company valued like this will want fees, ads and a cut of transactions eventually. Plan your margins for the day the subsidy ends.
- Airbnb will ship its own travel agent in the first half of 2027. The November 5 shareholder letter says the agent is still in development. The number worth stealing is elsewhere: about 40% of Airbnb's support issues in Q3 were resolved with no human, up from a third in Q2. If a $4.9 billion-a-quarter company gets to 40% with legal, refund and safety cases in the mix, a shop whose questions are mostly "price?", "in stock?" and "when does it arrive?" should be well above that.
- Google DeepMind's agents found two weaknesses in 1024-bit RSA. Presented November 6. Keys of 2048 bits and above, which is what your bank and your payment gateway use, are not affected. Nothing to do, but it is a sign of where AI agents are being pointed: at old locks.
The week's theme is memory. Meta's agent now remembers the customer; Shopify's data shows the customer who arrives through an AI has already decided; and the bots on the other side remember every key you ever leaked. The one memory you fully control is the one in your own inbox. If you want an assistant that remembers the customer, the catalog and the order across Instagram, WhatsApp and Telegram, see how Vardast does it.