What exactly Meta released
Meta presented Muse as a personal AI agent that does more than respond in chat: it can keep working after the app is closed, return for confirmation before a sensitive action and use services connected by the user. The first wave is available to adults in the US on iOS, Android, the Muse website and WhatsApp; integration with Meta glasses is planned for the future. [1 · Meta] [2 · Reuters]
The company says Muse can use a browser, fill out forms, send emails, book travel and pay for purchases. Payments use Stripe’s Link with a single-use card; the free version is intended for ordinary use, while Reuters reports paid tiers at $20 and $100 per month. [1 · Meta] [2 · Reuters]
How access is protected
Muse runs in a dedicated cloud virtual machine, Muse Secure VM, which stores data and credentials for connected services. Meta says the agent cannot see the passwords or payment details themselves, while an isolated Sentinel checks its actions and requests user confirmation when necessary. [1 · Meta]
Users can choose which apps Muse can access, restrict permissions and disconnect a service; interactions can also be excluded from training Meta’s models. For the second half of the year, the company promises a Confidential VM option with an encryption key inaccessible to Meta itself. [1 · Meta] [2 · Reuters]
Sources
- Meta — launch of the Muse personal agent — September 8, 2026
- Reuters — Muse launch and internal testing results — September 8, 2026
Expert commentary
Muse’s value is determined by its ability to safely complete a sequence of actions in other apps, rather than the quality of individual answers. That makes Reuters’ reports of private photos being exposed after restrictions were bypassed, ticket monitoring stopping and repeated account logouts more important than demonstration scenarios: they show that reliability cannot yet be considered proven. [2 · Reuters]
The launch turns Meta from a chat-assistant provider into the operator of an environment where AI has prolonged access to personal data and can take external actions. Key measures will include the frequency of erroneous operations, the quality of confirmations, resistance to malicious instruction injection and the transparency of the action log, as well as the number of connected apps. [1 · Meta] [2 · Reuters]