Meta Muse

Learning Objectives

• Understand what Meta Muse does and how a connected personal agent differs from a chatbot
• Explain the Muse Secure VM and Sentinel design, and what it does and does not protect
• Weigh the access Muse asks for against Meta's own record on personal data

What Is Meta Muse?

Meta Muse is a personal AI agent announced on September 8, 2026. Meta's framing is that it "doesn't just answer questions, it actually does the work" — you give it a goal, it makes a plan, and it carries the plan out across the applications you already use.

The distinguishing feature is not the model but the connections. Muse links to a person's email, calendar, payments, health and fitness, smart home, dining, shopping, music and events accounts, and then acts inside them: sending mail, booking travel, filling in forms, turning a saved recipe video into a grocery list, sending invitations, and completing purchases through Stripe's Link checkout. Where a service publishes an API, Muse can connect using credentials you supply; where none exists, it drives the site in a browser the way a person would. Long jobs keep running after you close the app, and it returns when something changes or when it needs approval to spend money.

Muse is getting its own hardware. At its Connect event on September 23, 2026, Meta announced Muse Charm, a palm-sized device with a small screen, microphones and a fingerprint sensor that wakes Muse without unlocking a phone or opening an app. It shows an animated avatar for the agent, appears to carry a small camera of its own, and Meta says it ships in December. Meta also said it is working on bringing Muse to its AI glasses, where a wearer would call it by name to guide a workout, log a meal or shop for something they are looking at. Both are announcements rather than products you can use yet, so judge them when they ship.

You can also build your own. On October 2, 2026 Meta published open-source software kits that connect Muse to hobbyist hardware, such as an ESP32 board or a Raspberry Pi, so builders can wire it to displays, buttons, sensors and motors. Its suggested projects include an E Ink screen for reminders and a stick that puts Muse on a television. Meta also made 5,000 units of a Muse Home Link device, which uses skills written by the community to switch on lights, control a TV or send a document to a printer, and is giving them away through a waitlist, with shipping due in October. Meta's own instruction to builders is to "proceed at your own risk", which is worth taking literally for anything wired to locks, heaters or appliances.

Muse is also now a business tool. On September 29, 2026 Meta extended Muse to small businesses, with new integrations including Shopify, Dropbox, Slack, Asana, Box, Canva, Figma, Intuit QuickBooks, Klaviyo and Notion, plus Instagram professional analytics, Facebook pages and Meta ad accounts. Meta's pitch is that an agent that knows what a business sells and what its customers ask about is more useful than a stand-alone chatbot. It arrived the same month Meta announced the Meta Enterprise Platform, a business unit whose first products include Muse.

Muse and Muse Spark are different things

The naming here trips people, and it is worth getting straight before anything else. Muse Spark is a Meta model, announced April 8, 2026 out of Meta Superintelligence Labs, code-named Avocado during development. Muse is the consumer agent launched five months later, and it runs on Muse Spark. Meta's larger Muse Wonder model, released October 12, 2026, will power Muse soon, starting with subscribers, though Meta gave no date. One is the engine, one is the car. Meta also ships Muse Code and Meta Muse Image under the same family name.

The security design

Muse runs on its own dedicated virtual machine, the Muse Secure VM — which is where the agent lives and where the credentials for every service you connect are stored. Meta says Muse itself has no visibility into your passwords or payment methods, and that Muse conversations are not shared with Meta's advertising systems.

The more interesting piece is the second agent. A separate system called Sentinel runs on the same machine but is kept apart from Muse at the system level, and Meta's own description is specific: nothing Muse does reaches the internet unless Sentinel approves it, and Sentinel asks the person for permission when it needs to. That is a meaningful architectural choice rather than a policy promise — it puts a separate process in the path of every outbound action, which is the standard defence against an agent being talked into something by a malicious web page.

Meta says a Muse Confidential VM will follow later in 2026, encrypted such that Meta itself cannot access it.

The first outside scrutiny of that design was not a security audit but a user noticing something. On September 17, 2026 Meta shipped Muse for macOS, which acts inside Files, Messages, Calendar, Notes and Mail as native applications rather than through a browser tab; access is granted per application, Full Disk Access is optional, and Muse asks before steps like deleting a file or sending a message. Days later Jason Aten, a contributing editor at Inc Magazine, posted screenshots in which Muse asked him about a conversation in Messages he says he had never given it access to. Pressed on how it knew, Muse said it had seen notification previews rather than message history, then conceded it could not explain the mechanism. David Singleton of Meta Superintelligence Labs answered that Muse syncs Messages only after a user explicitly enables it, that the Mac app needs Full Disk Access to do so, and that the assistant had simply described its own internals wrongly — "That's on us."

Take that explanation at face value, because it is probably true, and it is still the thing worth watching. The architecture above may be exactly what Meta says it is, while the agent sitting on top of it could not tell its own user which parts of the machine it was reading. For a product whose whole case rests on an approval boundary the user is meant to understand, an agent that misreports where that boundary sits is a usability failure with security consequences.

Apple has since weighed in, without naming anyone. On October 2, 2026 Apple told developers it will add controls so that a person can grant an app Full Disk Access only through "very explicit user action." Apple's notice says the permission, which exists so backup apps can work, "largely sidesteps" the Mac's privacy controls and can expose files, mail, messages and browsing history, and that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." That reads against Meta's explanation in one specific way: an app holding Full Disk Access can read the Messages database whether or not a separate connector inside the app is switched on, so the connector is a promise about what the app chooses to do rather than a boundary macOS enforces. Apple gave no date for the change.

The first outside security research followed on September 21, 2026, and it was worse. The macOS security researcher Patrick Wardle disclosed a zero-day flaw in the Mac app: any locally installed app or terminal command, whatever permissions macOS had given it, could change a list of undocumented Muse settings, one of which sets the server Muse sends voice dictation to. Pointing that at an attacker's own server hands over the token that controls the user's Muse account, and with it an agent the user has already connected to mail, calendars, messages, files, the camera and the microphone. Wardle said he built proof-of-concept attacks that wrote files to disk and took pictures, often with no sign to the user. Two design choices made it possible: dictation runs in Meta's cloud rather than on the device, and any app can change settings that were never meant to be public. Neither of those is the Secure VM or Sentinel, which is the point: the protected core can be sound while the app around it is not. Meta did not answer Ars Technica's questions about the flaw.

The same weekend, Amazon began blocking Muse from shopping on its store, telling users that access by an unauthorized AI agent violates Amazon's conditions of use. Amazon said Muse did not identify itself when it browsed and raised concerns about how it captured customer credentials, and Meta had not told Amazon that Muse would access the site. For an agent whose pitch is acting inside the services you already use, a large retailer refusing it is a real limit on what it can do.

Pricing

Meta's announcement says Muse is "free for most of what people need, with subscription plans for people who want to do more," and does not publish tier names or prices. TechCrunch, briefed at launch, reported two paid plans — Power at $20 a month and Maximum at $100 a month — plus a usage meter in the app and a requirement to put a payment card on file before you start. The Verge, covering the same launch, noted that Meta specified neither the cost nor the free-tier limits.

Because the tiers are metered rather than feature-gated, the practical question is not which features you need but how much delegating you actually do — and there is no published number to plan against yet.

The first usage figures came with Meta's third-quarter results. On October 21, 2026 Mark Zuckerberg said Muse had passed 10 million users, about a quarter of whom use it daily, and that more than a quarter of engaged users who shop through it average over 200 dollars a purchase. He said Meta's plan is to keep Muse free for most people, take a cut of the commerce it handles, and charge power users for more advanced models or more usage, and he forecast that Muse would eventually earn more per user than Facebook and Instagram do today. Those are Meta's own figures, reported to investors, not independent measurements.

The claim to check

Meta is marketing Muse as "the world's first personal AI agent built for everyone." That is a positioning claim rather than a fact, and it does not survive contact with the market: Gemini Spark targets much the same consumer audience, and Grok Bot, Claude Cowork and Microsoft's Copilot Tasks all shipped earlier, along with the open-source agent Moltbot. Since then OpenAI has shipped Dots and Anthropic has opened a waitlist for Claude Duet, so every major lab now sells or previews a personal agent of its own. What is defensible in the claim is the distribution — Muse reaches people inside WhatsApp, which nothing else in this category can do, and that is a genuine difference worth naming without the superlative.

Strengths

• Distribution nothing else has — an agent you message inside WhatsApp meets people where they already are, rather than asking them to adopt a new app
• A real isolation design — a second approving process (Sentinel) in the path of every outbound action is a stronger answer to prompt injection than a policy promise, and the credential store sits outside the agent's view
• Genuinely broad connectors — email, calendar, payments, health, smart home, dining, shopping, music and events out of the box, with a browser fallback when a service has no API
• No technical setup — the pitch is that there is no learning curve and nothing to configure, which is the actual barrier for most people in this category
• Free tier that is meant to be usable — Meta says most people will not need to pay, which is a different posture from the $20-and-up floor most agent products start at

Limitations & Considerations

• The trust question is the product's central risk, not a footnote. Muse asks for more personal access than any assistant Meta has shipped, from a company fined $5 billion by the US Federal Trade Commission in 2019 over privacy violations, charged with breaching the resulting order in 2023, and which settled multistate claims over social-media harms for $18 billion less than two weeks before this launch. None of that makes the engineering wrong. It does mean the engineering is the only thing carrying the argument
• United States only at launch, with no announced timeline for other countries
• The training opt-out's default is unstated — and for an agent that reads your mail, the default is the whole question
• On a Mac, Full Disk Access is the whole disk — Muse's Messages integration needs it, and Apple says that permission exposes mail, messages, files and browsing history to the app that holds it. Meta's Messages connector decides what Muse reads, but macOS does not enforce that choice. Grant it only if you accept that, and expect Apple to make the prompt harder to click through
• "Allow Always" means what it says — in September 2026 a YouTuber who let Muse answer his Facebook Marketplace messages found it had given his home address to a buyer, agreed a lowball price and told him only after the buyer had come and gone. He had supplied the address for pickups and clicked "Allow Always" on the messaging prompt, which let Muse send a template containing it to anyone who made an offer. Muse's own summary said it never asked for consent, and Meta says it will make sharing permissions clearer. Treat any standing permission to message on your behalf as permission to share whatever you have told the agent
• The Mac app shipped with a zero-day — on September 21, 2026 the researcher Patrick Wardle showed that any local app or terminal command could redirect Muse's cloud dictation and take over the account. Meta patched it the following week, but it was the first outside security finding against the product
• Shared conversations were findable without the link — in October 2026 the security firm Claroc found 6,800 shared Muse conversations by searching public DNS records, because each share address put the conversation's title into the web domain, which DNS logs the moment anyone opens it. Among the few hundred it opened were a loan application, a company's internal revenue review and a staff vacation calendar. Meta paused sharing on October 20 and turned it back on two days later. Its executive David Singleton said the flaw was in the addresses of shared artifacts, the documents and images Muse creates, rather than in chat sharing, and that it is fixed. Every artifact shared before the fix now has a new address, and the old links show a note asking the visitor to get the new one. That closes the old addresses, but a title already written into DNS logs stays there, so treat anything shared before October 22 as having been exposed
• Amazon blocks it — since September 20, 2026 Muse cannot shop on Amazon's store, which Amazon calls unauthorized agent access
• The core design is still untested from outside — the Secure VM and Sentinel are credible as described, but no outside review of them has been published, and the first outside looks found the agent misdescribing its own access, a flaw in the app around it and shared content anyone could find, which Meta has since fixed
• Pricing is not officially published, so the figures above could move before you read this
• Metered, not feature-gated — heavy delegation is where cost appears, and Meta has published no allowance you can plan against

Getting Started

1. Open muse.ai, or install the iOS, Android or macOS app — United States only for now
2. Expect to add a payment card before the free tier will start, per launch reporting
3. When Muse asks for messaging permission, choose Allow One Time until you have seen what it sends. "Allow Always" lets it message on your behalf with anything you have given it, including an address
4. Connect one service first, not all of them. Permissions are granted per app and per scope, so start with something low-stakes — calendar or a shopping account — rather than mail
5. Check the training opt-out in settings before you connect anything sensitive, since Meta has not said which way it defaults
6. Give it a task you can verify end to end, and watch where Sentinel stops to ask permission — that tells you where the approval boundary actually sits
7. Only widen access once you have seen it handle something correctly

Key Takeaways

• Meta Muse is a connected personal agent, launched September 8, 2026 in the United States on iOS, Android, muse.ai and WhatsApp, with a macOS app on September 17 that acts inside Files, Messages, Calendar, Notes and Mail, running on Meta's own Muse Spark model
• It acts inside your accounts rather than returning drafts — mail, calendar, payments, shopping, smart home — using a browser where a service offers no API
• The security design is the notable engineering: a dedicated Muse Secure VM holds connected credentials outside the agent's view, and a separate Sentinel agent must approve anything Muse sends to the internet
• Meta has not published pricing. Reported tiers are Power at $20 a month and Maximum at $100 a month, with a free tier Meta expects most people to stay on
• "World's first personal AI agent built for everyone" is marketing — Gemini Spark, Grok Bot and Claude Cowork all preceded it; the real differentiator is reaching people inside WhatsApp
• Judge it on the trust trade. The access it needs is the access that makes it useful, and Meta's privacy record is the reason that trade deserves more scrutiny here than it would elsewhere
• The first security research found a serious flaw. A zero-day disclosed on September 21 let any Mac app redirect Muse's dictation and take over the account, and Amazon began blocking Muse from its store the same weekend. A month later researchers found shared content through public DNS records; Meta paused sharing, fixed the share addresses and restored it on October 22
• A standing permission leaked an address. A user who clicked "Allow Always" to let Muse handle Facebook Marketplace found it had sent his home address to a buyer and agreed a lowball price without telling him until afterwards
• An agent should be able to explain its own access. Days after the Mac app shipped, Muse gave a user an incorrect account of how it had seen his Messages. Meta says the access was authorised and only the explanation was wrong, which is believable, and it still leaves the approval boundary harder to verify than the design implies. In October 2026 Apple said it will make Full Disk Access harder to grant, naming AI agents as the reason