Muse

Muse is a hosted personal AI agent developed by Meta Superintelligence Labs. Meta launched the service on September 8, 2026, powered by Muse Spark 1.3.^[1][2][6] At launch, Muse was rolling out in the United States for people age 18 or older through iOS, Android, the web, and conversations in WhatsApp. Meta said support for its AI glasses was planned but not yet available.^[1][4]

Muse is intended to do more than return text. With permission, it can use connected services, browse websites, fill forms, send communications, make purchases, create files and software, and continue scheduled work after its app is closed.^[1][3] Those abilities also expose it to consequential mistakes, malicious web content, and sensitive personal data. Meta therefore launched Muse with a dedicated cloud computer, a separate policy-enforcement service called Sentinel, credential isolation, and user approval controls. These are Meta's descriptions of the launch system, not independently verified security guarantees.^[2][10]

Launch and positioning

Meta said it had developed and used Muse internally since early 2026 under the codename Hatch.^[2] The public launch presented it as an agent for personal tasks and longer-running goals, such as handling email, planning travel, tracking information, and completing transactions. Meta's launch posts emphasized that the product could work in the background, use a browser, connect to applications, and become more personalized over time.^[1][6][7][8]

The initial release combined a free allowance with paid usage tiers. TechCrunch reported launch prices of $20 per month for the Power plan and $100 per month for the Maximum plan, while both TechCrunch and Axios said Meta expected ordinary users to remain within the free tier.^[9][11] These plans purchased more usage rather than a different underlying product. The service displayed a usage meter, and TechCrunch reported that a payment card was required during setup even for free use.^[9]

Muse was one part of Meta's broader Muse product family. It is a consumer agent, not the underlying language model and not the same product as Muse Code, Muse Image, Muse Glimmer, or Muse Voice Transcribe.

Capabilities and interface

Muse uses a main, long-running chat rather than treating every task as a separate session. Users can interrupt it, send several requests without waiting for the previous response, and open side chats when they want separate context. A Goals view tracks longer-running work, while an activity view shows current work, past actions, and permissions. Users can name the agent, choose an avatar and communication style, inspect and edit memory files, and adjust or disable proactive suggestions.^[3]

Meta described three main routes by which Muse acts:

The agent has a filesystem, terminal, and browser in its cloud environment. Meta says it can write code and build tools needed for a task, launch subagents, and produce documents, PDFs, web pages, dashboards, and other interactive outputs called Artifacts.^[2][3] It can also schedule work or respond to events after the client closes. Completion and notification are still model-mediated decisions, so background execution does not guarantee that a task will finish correctly or on time.^[3][4]

For actions that change external state, the launch design combines configurable permissions with explicit approvals. Meta's design article says default browsing can proceed without a prompt, while actions that are difficult to undo, such as sending an email or completing a purchase, stop for review. Users can choose stricter or looser settings.^[3] The Terms nevertheless require users to maintain meaningful oversight and make them responsible for instructions, communications, transactions, and generated Artifacts.^[4]

Muse Secure VM

The following architecture is documented by Meta for the system available at launch. No public, independent implementation audit accompanied the launch materials reviewed for this article.

Each user receives a dedicated Linux virtual machine called Muse Secure VM. The Hatch agent harness, user workspace, files, and agent-executed tools run in a systemd-nspawn container inside that VM. Meta says container root maps to an unprivileged host user, the container has a separate Debian root filesystem and virtual network interface, and risky system calls and Linux capabilities such as io_uring, CAP_SYS_PTRACE, and CAP_NET_ADMIN are unavailable.^[2]

Security-sensitive services run outside the agent's runtime cell:

Meta says these processes communicate over Unix-domain sockets using peer credentials and access-control lists. The agent sees surrogate tokens, while Sentinel inserts a real credential only after authorizing a concrete network request. Network traffic passes through a forward proxy that can inspect destinations and requests and apply server-side request forgery restrictions.^[2]

Sentinel evaluates the connector, action, destination, context, and user policy. It can allow, deny, or pause an operation for approval. Approval requests go directly from Sentinel to the client rather than appearing as ordinary text in the agent conversation. Grants can be one-time, session-scoped, task-scoped, time-limited, or persistent. This is a deterministic authorization boundary around the model's proposed actions, although the usefulness of the boundary depends on the policy, classifiers, connectors, and approval choices working as intended.^[2]

Meta also describes a kernel-level mechanism called tainted egress. A process is marked tainted after reading user data. Tainted or unverifiable processes lose access to some automatic network allowances and fall back to the approval flow. Meta says the implementation uses eBPF programs for process attribution, network interception, and propagation of the taint state.^[2]

Browser, credentials, and purchases

Muse drives a Chromium-based browser behind a separate broker. According to Meta, the browser subagent receives an accessibility-tree representation rather than the raw document object model, cannot execute JavaScript in the page context, cannot execute commands in the browser process, and has browser developer tools disabled. When the user takes over the browser or enters credentials through the secure client interface, the agent pauses. Separate classifiers inspect pages, images, downloads, and form submissions for prompt injection, unrelated personal-data egress, and other high-risk activity.^[2]

Passwords and connected-service tokens are stored outside the runtime cell. Meta says browser credentials entered by a user travel directly to hatch-authd and are injected only when needed, so the main agent does not receive their values. This design can limit credential disclosure by the model, but it does not establish that every malicious action using an authorized credential will be detected.^[2][10]

At launch, purchases through new merchants used Stripe Link. Meta says Link issues a single-use card number limited to a merchant, amount, and period, and Muse requests approval for every such payment. The launch architecture article listed Shop Pay as planned rather than available. Sites where a user already has payment information on file use checkout detection and a purchase approval instead.^[2]

Prompt-injection defenses and evidence

Prompt injection is central to Muse's threat model because the agent combines private data, untrusted content, and external actions. Meta says Muse Spark 1.3 was trained to distinguish instructions from untrusted material, while the harness labels external data and an ensemble of independent classifiers looks for attacks. User approvals, the restricted runtime, credential separation, and Sentinel provide additional layers when model-level defenses fail.^[2]

Meta explicitly states that Muse can still make mistakes and is not immune to attack. Its technical article calls prompt injection an open industry problem.^[2] Academic work supports that caution. Greshake and colleagues demonstrated that instructions hidden in retrieved data can redirect language-model applications, manipulate API calls, and exfiltrate data.^[12] AgentDojo later evaluated agents on 97 tasks and 629 security test cases and found that contemporary models failed many ordinary tasks even without an attack, while available attacks and defenses protected some properties but not all.^[13]

Muse's placement of policy enforcement outside the model resembles the broad direction of systems research that separates trusted control flow from untrusted data. For example, the CaMeL paper uses explicit control and data flows plus capability-based tool authorization to provide security guarantees for a subset of AgentDojo tasks.^[14] Muse is not documented as implementing CaMeL, and that result does not validate Muse. It is research context for why model-only resistance is insufficient.

At launch, Meta said it had used internal dogfooding, agentic red teaming, and a private bug-bounty program, and it opened a public bounty offering up to $300,000 for qualifying reports.^[2] The company did not publish the underlying Muse system evaluations or an independently reproduced end-to-end security score in the launch materials. A bug bounty and architectural disclosure can surface flaws, but neither proves that prompt injection, unwanted actions, or data leakage are impossible.

Data handling and privacy

Meta says files, generated material, memories, credentials, and connected-service tokens are stored in the user's dedicated VM, with credentials isolated from the runtime cell. Users can inspect, edit, and download files and memory, and VM data is continuously backed up.^[2] The current Secure VM is not an end-to-end confidential environment, however. Meta states that operational policy restricts employee access but that the launch architecture does not technically prevent Meta from accessing data when needed to support, secure, or operate the service.^[2][10]

Model inference requires information to leave the VM. Meta calls the conversations, tool calls, and subagent handoffs sent for inference trajectories. It says these trajectories are sanitized to remove key personally identifiable information and are used for training by default. Users can opt out in Data Controls.^[2][4] The word sanitized is Meta's description; the launch article does not publish a measured removal rate or an independent evaluation of the process.

Meta says it does not send Muse conversations or VM data to its advertising systems. It also identifies exceptions in effect: activity created when Muse browses a merchant's site can be used by that merchant for advertising, and actions through Facebook Marketplace or restaurant services may indirectly influence ads.^[2] Axios reported that Muse itself had no advertising at launch, while Meta was exploring commerce as a possible revenue source.^[11]

Linking Muse to the same Accounts Center as other Meta products is optional. The Terms say that, if a user links it, Meta may combine information across the profiles and devices in that Accounts Center under the applicable Meta policies. A user can keep Muse separate by registering with an email address not associated with another Meta account.^[4]

Connecting an external service also sends data beyond the VM under the user's direction. Meta's Terms warn that third-party availability, security, reliability, and data practices vary, and place responsibility for connector settings and transfers on the user.^[4] Muse's own isolation cannot supply privacy guarantees for a service after data has been sent to it.

Planned Confidential VM

Meta announced a separate Confidential VM mode for later in 2026. It is intended to place the VM in a trusted execution environment and use user-controlled keys so Meta cannot read its contents. At launch, Meta said a small trusted-test group was using the system and that design information and source code had begun to reach external auditors.^[1][2][10]

Confidential VM was not part of the general September 8 release. Its promised properties, public transparency log, continuous auditing, and user-verifiable binaries were future plans, not protections available to ordinary launch users. No public audit report for that mode was identified in the launch sources.^[2][10]

Limitations and user responsibility

Muse's Supplemental Terms draw a sharper boundary than the product marketing. They warn that outputs and actions may be inaccurate, incomplete, or materially wrong even when they look specific and convincing. Meta does not guarantee successful completion, timeliness, reversibility, continuous availability, compatibility with connected services, or error-free execution.^[4]

The Terms require meaningful human oversight, especially before communications, payments, deletions, or system changes. They assign the user legal responsibility for the agent's instructions, actions, transactions, and Artifacts, and advise independent confirmation of results. Meta also reserves rights, depending on configuration, to monitor, log, review, block, or modify activity for safety, security, compliance, and operations.^[4]

Independent coverage at launch centered on whether users would trust Meta with the broad access a useful personal agent requires.^[9][10] That concern is not resolved by either marketing claims or a list of security mechanisms. Muse was one day old when this article was verified, so there was not yet a public record of long-term reliability, real-world incident rates, adoption, or the effectiveness of its approval design at consumer scale.

References

1. ^1 ^2 ^3 ^4 ^5Meta. "Introducing Muse: The World's First Personal AI Agent Built for Everyone." September 8, 2026. about.fb.com/...introducing-muse-personal-ai-agent
2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20Tarek Sheasha. "How We Built Safety Into Muse." Meta AI Research, September 8, 2026. research.meta.ai/...-agents-our-approach-with-muse
3. ^1 ^2 ^3 ^4 ^5Mona Sarantakos and Christine Awad. "How We Designed Muse." September 2026. introducing.muse.ai
4. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8Meta. "Muse Supplemental Terms of Service." Last updated September 8, 2026. muse.ai/terms
5. ^Meta. "Muse." Accessed September 9, 2026. muse.ai
6. ^1 ^2AI at Meta. "Introducing Muse, a personal agent that gets things done for you, powered by Muse Spark 1.3." X post, September 8, 2026. x.com/...2097401493770956808
7. ^AI at Meta. "Today we launched muse.ai, a personal AI agent, and published a deep dive on how we built safety into its system." X post, September 8, 2026. x.com/...2097406461118943599
8. ^Alexandr Wang. "Today we're rolling out Muse, our new personal AI assistant." X post, September 8, 2026. x.com/...2097402344061510004
9. ^1 ^2 ^3Sarah Perez. "Meta debuts its Muse AI agent. Will consumers trust it?" TechCrunch, September 8, 2026. techcrunch.com/...ai-agent-will-consumers-trust-it
10. ^1 ^2 ^3 ^4 ^5 ^6Lily Hay Newman and Maxwell Zeff. "Muse, Meta's New Personal AI Agent, Needs You to Trust It." WIRED, September 8, 2026. wired.com/...l-ai-agent-with-privacy-built-into-it
11. ^1 ^2Ina Fried. "Meta debuts Muse, its long-planned personal AI agent." Axios, September 8, 2026. axios.com/...meta-debuts-muse-personal-ai-agent
12. ^Kai Greshake et al. "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection." arXiv:2302.12173, revised May 5, 2023. arxiv.org/...2302.12173
13. ^Edoardo Debenedetti et al. "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents." arXiv:2406.13352, revised November 24, 2024. arxiv.org/...2406.13352
14. ^Edoardo Debenedetti et al. "Defeating Prompt Injections by Design." arXiv:2503.18813, revised June 24, 2025. arxiv.org/...2503.18813