Close the app, and Meta Muse keeps working on the travel booking you requested, according to Meta. The company introduced its personal AI agent (software that takes actions for you) on September 8. Muse from Meta is rolling out in the US, with messaging through its app and WhatsApp. It asks permission before sending emails or buying something. How much access does that convenience require? [1]
Meta Muse Starts With a Message
Meta has built Muse around a familiar exchange: tell someone what needs doing, then let them get on with it. The company says its agent can open a browser, complete forms, and negotiate on your behalf. Muse Spark powers the system. Meta describes it as its most capable model yet, designed for work that involves taking actions. Those are company claims; the announcement provides no comparative performance results. [1]
Meta Muse can also work toward a goal across several steps. Meta gives examples such as selling a car, lowering a bill, and adapting a training plan. The agent helps develop a plan and coordinate time and resources, then continues after the user leaves. Closing the app does not end the task. Muse returns when something changes or when it needs approval. Meta says that includes checking before an email goes out or a purchase proceeds. [1]
A saved Instagram recipe offers a smaller example of the same ambition. Meta says Muse can turn it into a grocery list and suggest a dinner menu. It can remember friends’ dietary restrictions before sending invitations, using details someone mentioned earlier. These examples describe Meta’s intended experience, rather than results from an independent test. They also bring the agent closer to personal information, from food preferences to the accounts needed to complete a task. [1]
Hacker News readers also picked up the launch, linking to Meta’s Muse product page. The September 8 feed snapshot recorded 177 points and 167 comments on that submission. The listing identifies the official page; it offers no independent performance test. [4, 5]
Shopping Reaches the Checkout
Muse can make purchases using Link, Stripe’s payment infrastructure. Link creates a card number for one use, keeping the user’s real card details hidden during checkout. Meta says Muse is the first AI agent covered by Link’s purchase protections for agents. The stated protections include coverage for damaged or lost items, price drops, and returns. Eligibility matters: Meta specifies a return guarantee on eligible purchases, so the announcement does not promise coverage for every transaction. [1, 2]
Meta also plans to add Shop Pay as another payment option. Support for 1Password is coming too, so Muse can use logins people already have. Neither feature appears as available at launch in the announcement. For now, Meta names Link as the checkout option. The agent still needs permission before sensitive actions such as purchases, even when it has already spent time finding an item and preparing the order. [1]
A purchase crosses from conversation into spending. Who checks the agent before it takes that step?
Sentinel Watches the Exit
Meta Muse runs inside a dedicated cloud computer called Secure VM (a virtual machine). Meta says each user’s environment holds the agent, personal data, and credentials for connected services. Other users’ agents cannot reach it, according to the company. A separate agent named Sentinel runs on the same machine, with separation at the system level. Muse cannot send anything onto the internet without Sentinel approval, Meta says. [1]
Sentinel checks outgoing activity against permissions the user or system has already granted. When necessary, it asks the user to approve the action. David Singleton, Meta’s engineering vice president for consumer products at Superintelligence Labs, described the process to WIRED. He said approval prompts reach users directly rather than passing through the model. The design aims to resist prompt injection (malicious instructions in material an agent encounters), which could otherwise steer the agent toward an unwanted action. [2]
Users decide which services Muse can connect to and how much access each connection gets. For email, Meta says someone can permit reading without allowing sending. Users can change permissions or disconnect a service whenever they want. Meta also promises an audit trail of completed and planned actions. Passwords and payment details go into secure storage that Muse can use without seeing them, according to the company. That includes passwords someone enters into its browser. The controls give users several places to limit access before handing over a task. The next question reaches beyond the agent itself: what can Meta access inside that computer? [1]
Meta Still Has Technical Access
Singleton told WIRED that Meta policy bars the company from accessing users’ Muse data. He also acknowledged that access remains technically possible under Secure VM. Meta has not technically locked itself out. Users should therefore distinguish the current system from the stronger access barrier Meta has promised for later. The dedicated cloud computer and Sentinel checks do not make the contents inaccessible to the company operating the service. [2]
Meta says Muse does not share conversations or data inside the virtual machine with its advertising systems. Users can also opt out of having their interactions train Meta’s AI models. They can ask Muse to forget particular things it has learned. These controls cover different uses of information: advertising, model training, and the agent’s memory. Choosing connected apps is another control, governing what information and services Muse can reach while working. [1]
Meta says Confidential VM will arrive later this year. The planned system encrypts the whole virtual machine with a key held only by the user. Meta says that will prevent even the company from accessing its contents. WIRED reports that Meta is working with Signal creator Moxie Marlinspike on the technology. Unlike the protections available at launch, this stronger privacy architecture remains a future release. Meta gives no specific launch day in its announcement. [1, 2]
US Rollout Leaves Details Open
Meta Muse is rolling out in the US on iOS, Android, and muse.ai (its web interface). Users can also message it through WhatsApp. Meta says access through its AI glasses is coming soon. The company offers free use and subscriptions for people who want to do more. Its announcement does not specify subscription prices or exact usage allowances. Separately, 9to5Mac reports weekly limits for free users and higher access for paying customers. [1, 3]
WIRED reports that Meta has tested Secure VM through internal security teams and its private bug bounty program. The company is adding Muse to its public program, with rewards up to $300,000 for valid vulnerabilities. That includes up to $130,000 for successful prompt injection attacks affecting one user. For the planned Confidential VM, WIRED also reports plans for outside security audits, published software binaries, and a transparency log. Those checks will matter as Meta introduces the promised architecture. [2]
US users trying Meta Muse can start by choosing which apps it may access. They can review email permissions, the training opt-out, and the activity history before expanding its duties. Confidential VM is still ahead. Anyone waiting for the promised protection against Meta’s own technical access will need to watch for that release, alongside the subscription details missing from the launch announcement. [1, 2]
- PRESS RELEASE Meta. (2026, September 8). Introducing Muse: The world’s first personal AI agent built for everyone. Meta Newsroom. [Article Link]
- ONLINE NEWS Newman, L. H., & Zeff, M. (2026, September 8). Muse, Meta’s new personal AI agent, needs you to trust it. WIRED. [Article Link]
- ONLINE NEWS Hall, Z. (2026, September 8). Meta AI launches Muse personal agent, including a new mobile app for iPhone. 9to5Mac. [Article Link]
- WEBSITE Meta. (n.d.). Muse: Meta’s personal AI agent, features & capabilities. Meta AI. [Article Link]
- WEBSITE [Discussion linking to Meta’s Muse product page]. (n.d.). Hacker News. [Article Link]
2 comments