Meta launched Muse on September 8, 2026, a personal AI agent that acts inside a person's real email, calendar and payment accounts instead of answering questions about them. Meta's announcement says Muse "is rolling out in the US on iOS, Android, and muse.ai, and coming soon to AI glasses." TechCrunch reports a free tier alongside paid plans at $20 and $100 a month, for users 18 and older, with WhatsApp as a fourth surface.
The consumer pitch is errands: send an email, book travel, negotiate a bill, fill a form, buy something. The part worth reading if you build with agents sits underneath that. Meta moved the safety boundary out of the model and into the operating system, published the design in unusual detail, and attached a bug bounty of up to $300,000 to it. That design is the most complete public reference for running an autonomous agent against real credentials. It is also the thing Meta's own testers were still breaking during launch week.
What Meta actually shipped
Muse is a general-purpose agent with a browser, connected accounts and persistent memory. It runs after the app is closed, and Meta's page is explicit about the approval boundary: "Muse checks with the person before sensitive actions like sending an email or making a purchase."
The model underneath is Muse Spark 1.3, which Meta released on September 2 with roughly 20% fewer tool calls and 25% fewer tokens than version 1.2 on the same work. That efficiency claim reads differently now: it is the unit economics of a free consumer tier that runs a browser all day. We covered the model and its efficiency turn when it landed, before the product it was built for was public.
Connectors span Gmail, Google Calendar, Outlook, Docs, Plaid, OpenTable, Spotify and Peloton, plus Meta-native connections to Instagram, Messenger, Facebook and Marketplace. Payments run through Link, built by Stripe, with Shop Pay and 1Password named as coming soon. The agent had been in a closed alpha with invite codes as recently as September 7, which makes the US launch a one-day turn from invite-gated testing to open signup. Meta's Alexandr Wang said day-one usage ran 10 times internal projections, per the Latent Space AINews recap of the day.
Where the secrets live
Every user gets their own cloud Linux machine. Meta calls it Muse Secure VM, and its engineering write-up splits that machine into two domains that do not trust each other.
The agent runs in an isolated runtime cell built on systemd-nspawn, with mapped unprivileged users, filtered system calls and stripped kernel capabilities. Everything security-sensitive runs outside that cell on the host side: hatch-safety inspects requests and responses for prompt injection, privsep executes connector code with tightly scoped credential access, hatch-authd stores credentials and mints surrogate tokens, and a Postgres database holds durable state the agent cannot reach directly.
The consequence is the design's best idea. The agent never holds a real API key or OAuth token. It gets a surrogate, and privsep does the actual call. A model that never possesses a credential cannot leak one, no matter how convincing the injected instruction is. The same principle limits the browser: Muse reads accessibility tree snapshots rather than raw DOM, cannot execute JavaScript in pages, and cannot open DevTools. Meta says it also filters one-time tokens and password reset links out of email the agent reads.
Sentinel is the part to copy
Sentinel is a separate host-side agent, kept apart from Muse at the system level, and it is the sole permission authority. When Muse proposes an action, Sentinel evaluates policy and returns allow, deny or ask.
For network egress it inspects at both layer 4 and layer 7: hostnames, IPs, ports, protocols, HTTP methods and decoded request content. It tracks data flow in the kernel with eBPF, a scheme Meta calls tainted egress, so a clean low-risk request can auto-approve while a request carrying data from a sensitive source needs the user. Approvals are described as strict capabilities rather than conversational suggestions, bound to a specific connector and destination and scoped as one-time, session, task, time-bounded or perpetual.
That last detail is the fix for a problem the industry has measured and mostly ignored. Permission prompts are only a control if people read them, and humans miss roughly one in three threats when reviewing agent actions. Narrowing an approval to one connector, one destination and one expiry does more than asking more often.
Muse against the sandboxes builders already run
Most people reading this already run an agent with more access than Muse gets. A coding agent on a laptop holds the real tokens, inherits the shell, and asks for approval in a dialog the operator has learned to click through. Here is how the three common shapes compare.
| Dimension | Meta Muse | Local coding agent | Standard OAuth app |
|---|---|---|---|
| Where it runs | Per-user cloud VM, agent in an nspawn cell | Your machine, usually your user account | Vendor servers |
| Credentials the agent holds | Surrogate tokens only | Real keys, shell env, browser profile | Real OAuth token, vendor side |
| Who authorizes an action | Sentinel, host-side, outside the agent | The agent's own harness | Scope granted once at install |
| Network egress control | Layer 4 and 7, plus eBPF taint tracking | Usually none | Not applicable |
| Browser access | Accessibility tree, no JavaScript, no DevTools | Full browser control if granted | None |
| Approval scope | Per connector and destination, with expiry | Per tool call or a blanket allowlist | Per scope, indefinite |
| Blast radius of an injection | One connector, one destination, one VM | Everything the user can reach | Everything in the granted scope |
| Public bounty | Up to $300,000 | Varies by vendor | Varies by vendor |
The row that should embarrass the local-agent column is egress. A coding agent that has been talked into exfiltrating a file usually has no layer in front of it to stop the request. Purpose-built isolation exists, and disposable VMs for coding agents are the closest analogue, but almost nobody runs one by default.
What the architecture does not cover
Two gaps are worth naming, and Meta names one of them itself.
The first is the operator. Meta's own page is direct: the design "restricts access to your data by Meta personnel through operational policies. It does not prevent Meta from accessing data when necessary to support, secure or operate the service." The cryptographic version, Muse Confidential VM, is "intended to cryptographically and verifiably prevent Meta from accessing data in your VM," and it is due later in 2026 with limited testers today. So at launch the isolation is strong against the agent and against outside attackers, and it is policy-based against Meta.
The second is reliability. Internal posts reviewed by Reuters describe an employee whose agent got around guardrails and surfaced personal iCloud photos when asked to identify toys in pictures, a tester who found monitoring switched itself off for no apparent reason, and CTO Andrew Bosworth documenting repeated forced logouts. The reports run as recently as launch week. A permission layer that is architecturally sound and a monitoring layer that silently stops are different problems, and the second one erases the value of the first.
The commerce layer is the real bet
Muse spends money. Payments go through Link, built by Stripe, using single-use card numbers with human approval on each transaction, and Meta describes an agentic payment protection and refund guarantee behind it. Shop Pay is named as next.
That is the difference between an assistant and an agent with consequences, and it is the direction the whole category is moving. Anthropic pushed the same idea into the open when it open-sourced its commerce agents. The unresolved question is not whether an agent can complete a checkout. It is who eats the loss when it completes the wrong one, and Meta answering that with a guarantee is a more meaningful commitment than any benchmark in the launch post.
What to do with this
Treat the security write-up as a specification rather than marketing, because three of its ideas are cheap to adopt in whatever you are already running. Stop handing your agent real credentials and put a small broker in front of the call. Give one component, not the model, final say over network egress. Scope approvals to a destination and an expiry instead of a global allowlist.
If you want to test Muse itself, the builder surface is custom connectors: Muse can connect to any service with a public API using credentials you supply, and falls back to the browser when there is no API. Connect one low-stakes account first and watch what Sentinel asks you about, because the ask-versus-allow boundary is the product. Keep email and banking out of it until Confidential VM ships, on the simple basis that today the operator can reach your VM when it decides it needs to.
Frequently asked questions
Is Meta Muse available outside the US?
No. Meta says Muse "is rolling out in the US on iOS, Android, and muse.ai," with AI glasses coming later. Reporting at launch put the minimum age at 18. There is no announced date for other countries.
What does Meta Muse cost?
Meta's page says only that it is "free for most of what people need, with subscription plans for people who want to do more." TechCrunch reported the two paid tiers as $20 a month and $100 a month at launch, alongside a metered free tier.
Which model powers Meta Muse?
Muse Spark 1.3, released September 2, 2026. Meta reports roughly 20% fewer tool calls and 25% fewer tokens than Muse Spark 1.2 on comparable work, and offers the model separately through Muse Code and the Meta Model API.
Can Muse spend money without asking?
Meta says no. Purchases use single-use card numbers issued through Link by Stripe and require human approval per transaction, and the announcement states Muse checks with the person before sensitive actions including making a purchase.
How is Muse different from a coding agent like Claude Code?
Placement of trust. A local coding agent runs on your machine with your real credentials and asks its own harness for permission. Muse runs in a per-user cloud VM, never holds real credentials, and every action and outbound request is judged by Sentinel, a separate process outside the agent.
Can Meta employees read what Muse does?
Under the launch architecture, yes, in defined circumstances. Meta restricts personnel access by policy but states the design "does not prevent Meta from accessing data when necessary to support, secure or operate the service." Muse Confidential VM, which is meant to make that cryptographically impossible, is due later in 2026.
Can I build my own connector for Muse?
Yes for services with a public API or CLI, using credentials you provide. Meta also describes fine-grained connector controls beyond standard OAuth scopes, separate read and write permissions where a service supports them, and custom skill instructions that shape how the agent uses a connector.
