Meta launched Muse on September 8, 2026, with access to email, calendars, web browsers, connected services, and payment infrastructure. The assistant can send messages, book travel, fill out forms, shop, and continue working after its app closes. These capabilities move Meta beyond conversational chat into software that can perform significant actions using a user’s identity.
The launch also presents a demanding trust challenge. A useful personal agent requires broad access to private information, but each added permission increases the risk of model errors, prompt-injection attacks, or weak access policies. Meta addresses this by providing a dedicated cloud computer for each user, isolating credential handling, and including a separate Sentinel component that manages external actions. The design is substantial, but several privacy protections rely on policy until Meta releases its planned Confidential VM.
Key Takeaways for 2026
Key Takeaways:
Muse performs work across connected services, including sending email, booking travel, filling forms, browsing websites, and making approved purchases.
Each user receives a dedicated Secure VM containing the agent, browser, files, and connected-service data.
Sentinel controls connector actions and network egress, while a separate credential service keeps real passwords and tokens outside the agent’s context.
Meta’s launch materials say users can opt out of model training and that Muse data is not shared with its advertising systems.
Paid plans cost $20 per month for Power and $100 per month for Maximum, according to TechCrunch’s September 2026 launch report.
Muse Capabilities in 2026
Muse is designed to handle delegated tasks. A user gives it an objective through the Muse app, WhatsApp, or the web, and the agent creates a plan that can involve several tools. Meta’s September 2026 announcement says it can open a browser, complete forms, coordinate time and resources, and ask for approval when an action involves financial or communication consequences.
A travel request illustrates how Muse differs from a standard chatbot. A conversational assistant can suggest flights and write an itinerary. Muse can search available options, work through booking pages, and pause before payment to get user approval. A dinner-planning task can start with a saved Instagram recipe, turn into a grocery list, include remembered dietary restrictions, and produce invitations. The benefit comes from moving information between steps without requiring the user to copy every result manually.
Muse brings multi-step task execution into familiar chat interfaces instead of requiring users to set up an engineering workflow.
The agent can keep working after the app closes and return when it encounters a change or needs approval. This ongoing operation supports long-running searches, schedule coordination, and tasks that depend on third-party websites. It also increases risk because the user is not watching every intermediate step. Audit records and narrowly scoped permissions are therefore as important as the quality of the model’s final answer.
Purchases use Stripe’s Link infrastructure. Meta says Link generates a one-time-use card number, keeping the user’s actual card details away from the agent and merchant page. Eligible transactions receive Link purchase protections. Shop Pay and 1Password support are planned additions, according to Meta and TechCrunch.
Muse Secure VM Architecture in 2026
Each Muse instance runs in a dedicated cloud virtual machine that includes a browser, storage, CPU, memory, the user’s workspace, and connected-service data. Meta’s technical security description says the agent harness, called Hatch internally, runs inside a systemd-nspawn runtime cell. Root inside that cell maps to an unprivileged host user, limiting damage after a runtime compromise.
The cell has its own root filesystem and virtual network interface. Meta says it filters system calls, disables io_uring, and removes capabilities including CAP_SYS_PTRACE and CAP_NET_ADMIN. These operating-system controls restrict the software around the model even when the generated plan is incorrect or hostile content affects its behavior.
Security-sensitive components run outside the runtime cell. privsep workers run built-in connector code with limited privileges. Durable app state is kept in a separate PostgreSQL database. Communication between the runtime and host services uses Unix domain sockets with peer authentication and access controls.
This design addresses the “lethal trifecta” described by security researcher Simon Willison: access to private data, exposure to untrusted content, and a channel for sending data elsewhere. Muse still combines those conditions at the product level, but the Secure VM adds policy checks and technical boundaries between them.
Permissions and Credentials in 2026
Sentinel is the only permission authority for connector actions and network egress. When Muse wants to send an email, modify a calendar, or contact a website, it submits a request describing the destination, action type, scope, and user context. Sentinel allows it, denies it, or asks the user. The approval dialog goes directly between Sentinel and the client instead of passing through the model’s conversation.
The approval system supports one-time, session-scoped, task-scoped, time-limited, and ongoing permissions. This granularity helps prevent a single approved calendar action from becoming indefinite permission to change every calendar event. Read and write privileges can also be separated when the connected service supports them.
Real credentials stay outside the runtime cell. The agent receives a surrogate token, and Sentinel replaces it with the actual credential only after authorizing the outgoing request. Meta also says the email connector filters one-time passcodes, password-reset URLs, and login links using deterministic rules and a classifier. An attacker who places hostile instructions inside an email should therefore have a harder time turning inbox access into account takeover.
Protection layer
Documented role
Risk it reduces
Source
Runtime cell
Runs the Hatch harness, tools, browser access, files, and workspace inside systemd-nspawn
Limits host privileges after agent or tool compromise
Muse launched in the United States through iOS, Android, WhatsApp, and muse.ai. Meta says access through its AI glasses will come later. TechCrunch reported two paid plans at launch: Power at $20 per month and Maximum at $100 per month. Meta expects many users to stay on the free tier, and the app includes a meter showing remaining usage.
Plan
Monthly price
Documented position
Source
Free
$0
Everyday personal-agent use with a visible usage meter
SiliconANGLE separately reported a free allowance of 100 million tokens per week. Meta’s public launch post describes the service as free for most needs without mentioning that token figure, so users should rely on the in-app meter for the actual limit. A payment card is required at setup because the agent can complete purchases, TechCrunch reported.
Muse Spark 1.3 and Developer Access in 2026
Muse runs on Muse Spark 1.3, which Meta describes as its model for agentic and coding tasks. Meta says the update asks clarifying questions, confirms important actions, handles long threads, and can maintain several workflows in one conversation. Its published efficiency comparison against Muse Spark 1.2 reports about 20% fewer tool calls and 25% fewer tokens in Meta’s engineering tests. These are vendor measurements rather than independent results.
Developers should distinguish the consumer assistant from Muse Code. Muse Code exposes Spark 1.3 for software work through Meta Model API and a command-line installation path. Meta’s published installation command is:
curl -fsSL https://dev.meta.ai/install.sh | bash
# Note: production use should inspect downloaded scripts, pin versions,
# test in an isolated environment, and avoid running installers on
# machines containing unrestricted credentials.
This command does not install the consumer personal assistant or reproduce its Secure VM. It installs Muse Code on macOS or Linux. The distinction matters because the containment described for Muse depends on Meta’s host services, Sentinel, credential surrogation, and connector policies. A developer calling the model through an API must build separate authorization and secret-handling controls.
This separation also relates to our analysis of agent coordination and containment failures. Model quality alone does not define agent safety. Network policy, credential scope, approval routing, logs, and the ability to stop background work determine how far an error can spread.
Meta’s Trust Problem in 2026
Muse requires more personal access than Facebook or Instagram alone. It becomes more useful when connected to an inbox, calendar, payment method, health service, vehicle, or home system. Each connection gives the assistant more context and increases the value of a compromised workflow.
Users can start with low-risk, read-only tasks before granting permission to communicate, purchase, or modify records.
Meta says users select each connected app and can revoke access later. They can also tell Muse to forget remembered information, opt out of training, and keep VM conversations separate from Meta’s advertising systems. Those controls are useful, but WIRED reported that Meta can still access data in the launch version of Secure VM, even though company policy forbids that access.
The planned Confidential VM will change this setup. Meta says it will encrypt the entire VM with a key held by the user, preventing Meta from accessing conversations and stored data. WIRED reported that Meta is working with Signal creator Moxie Marlinspike, plans to publish binaries and a transparency log, and will give selected security firms access for audits. Until that version is released and externally reviewed, privacy from Meta depends partly on policy and internal controls.
Meta has opened Muse to its public bug bounty. Its maximum reward is $300,000 for a valid vulnerability, including up to $130,000 for a successful prompt-injection attack affecting one user. Bug bounties do not prove a product is secure, but they provide a financial incentive for independent researchers to test the claims.
Limitations and Trade-offs in 2026
Muse can still misinterpret instructions, choose the wrong service, complete a form incorrectly, or misunderstand an approval. Meta explicitly says the agent will make mistakes. Sentinel limits authority and network access, but it cannot guarantee that an authorized action matches the user’s unstated intent.
Browser operation creates another weak point. A browser lets the assistant work with services that lack dedicated connectors, but websites contain advertisements, comments, documents, and other untrusted text. Prompt injection can hide instructions in that content. Meta addresses the threat with labels, classifiers, network controls, and approvals, but no launch evidence confirms these defenses block every attack.
The system is also cloud-based. Users who want local execution or direct control over model weights will find different trade-offs in open-source agents such as Moltbot. Hosted isolation reduces operational burden, while local software gives its operator more control over storage and network access. Local deployment also shifts patching, secret management, monitoring, and incident response to the user.
Comparisons with ChatGPT Work, Claude Cowork, Copilot Tasks, Gemini Spark, Grok Bot, and Moltbot should focus on completed tasks and permission boundaries instead of feature checklists. Published model benchmarks do not measure whether an agent booked the correct refundable fare, preserved a calendar constraint, or stopped before an unintended purchase.
Evaluating Muse Safely in 2026
Start with read-only tasks. Calendar conflict detection, itinerary research, and grocery-list creation carry less risk than sending email or completing checkout. Review the audit trail after each task and compare it with the original instruction. A successful answer is not enough if the agent visited unrelated sites, requested unnecessary access, or prepared a broader action than requested.
Connect one service at a time: Begin with a low-risk account and examine every requested permission.
Separate reading from writing: Grant calendar or email reading before enabling changes or outbound messages.
Use one-time approvals: Avoid ongoing authorization until repeated tasks behave consistently.
Inspect purchase terms: Check merchant, amount, refundability, dates, and delivery address before approving payment.
Test hostile content: Include a document or email containing irrelevant instructions and confirm that Muse ignores it.
Review memory: Ask what the agent remembers and delete details that no longer need to influence recommendations.
The immediate technical achievement is the separation between model intelligence and operational authority. Muse can propose actions, but Sentinel, credential services, connector workers, and the user decide whether those actions reach the outside world. That pattern provides engineers a useful reference for agent design even if they never use Meta’s product.
For consumers, the deciding factor is narrower. Muse has to save enough time to justify access to sensitive accounts, and its audit trail must make errors easy to detect before they become transactions. The 2026 launch provides a serious containment design. The next test is whether ordinary users can understand and control it without becoming security administrators for their own assistant.
Related Reading
More in-depth coverage from this blog on closely related topics:
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...
