Meta launches Muse AI agent in the United States as a consumer assistant that can browse websites, fill forms, send emails, book travel and keep working after its app closes. The September 8 release puts a general-purpose agent inside both a standalone Muse app and WhatsApp.

 

The launch combines four elements that separate Muse from a conventional chatbot:

  • A dedicated cloud computer for each user
  • A separate Sentinel that controls network activity and approvals
  • Muse Spark 1.3 for long-running agentic work
  • One-time payment cards and mandatory purchase confirmation

 

Further Reading

 

Meta Launches Muse AI Agent in the US

Meta is rolling Muse out to adults on iOS, Android and the web, with WhatsApp access built around a familiar messaging interface. The company says the basic service is free for most uses, while subscriptions will support heavier workloads. Support for Meta’s AI glasses is planned later.

 

Muse is designed to advance a goal rather than answer a single prompt. A user can ask it to organize a schedule, prepare a long-term plan, negotiate a bill or complete a purchase. It can divide work among subagents, create tools and continue operating in the background until it finishes or needs approval.

 

The release is powered by Muse Spark 1.3, which Meta introduced on September 2. Meta says the model was trained for tool use, long-context instruction following, multi-agent coordination and resistance to prompt injection. The same model is also available through Muse Code and Meta Model API.

 

Meta’s launch follows consumer interest in agents such as OpenClaw and Instinct. Unlike a chatbot that drafts an email for the user to send, an agent can connect to other services and execute the surrounding workflow. That increased authority also creates a larger security problem when the agent reads untrusted web content.

 

Muse Secure VM Separates the Agent From Credentials

Each Muse account receives a dedicated Linux virtual machine with its own browser, storage, processor and memory. Meta’s technical explanation says the main agent runs inside an isolated runtime cell, while credentials, durable data and security-sensitive services remain outside that cell.

 

Root access inside the runtime is mapped to an unprivileged host user. The cell also receives a separate filesystem, filtered system calls, limited kernel capabilities and a controlled network interface. Built-in connector code runs through workers with narrowly scoped privileges, rather than exposing service credentials directly to the model.

 

Passwords and third-party authorization tokens are stored by a separate service. Muse receives temporary surrogate tokens when it needs to act, while the real credential is inserted only at the network boundary after approval. Meta says the agent never sees the underlying password, payment method or API token.

 

Email receives additional filtering because inboxes often contain one-time codes, password-reset links and sign-in links. The connector is designed to withhold those items so that access to an inbox does not automatically become access to every account that can be recovered through it.

 

Sentinel Governs Every External Action

A host-side agent called Sentinel is the sole permission authority for connectors and internet access. Muse proposes an action, but Sentinel evaluates its destination, method, scope and the permissions the user previously granted. It can allow the request, block it or pause execution for a direct user decision.

 

Approval prompts travel from Sentinel to the Muse app without passing through the language model. Grants can be limited to one action, one session, one task, a period of time or an ongoing permission. Read and write access can also be separated where a connected service supports that distinction.

 

Meta says every outgoing request is inspected at the network boundary, including the destination, protocol, path and decoded request. Processes that touch user data lose automatic permission to transmit unless the action matches an approved policy. Independent classifiers also look for prompt injection in pages, images and downloaded files.

 

The design does not make Muse immune to errors or attacks. Meta explicitly acknowledges that prompt injection remains an open problem and that the agent will make mistakes. The architecture aims to limit the consequences when the model misinterprets a task or follows hostile instructions embedded in content.

 

Payments, Privacy and the $300,000 Bug Bounty

Muse can make purchases through Stripe Link, which generates a single-use card tied to a merchant, amount and limited time window. The agent must obtain approval for every purchase. Meta says eligible transactions also receive Link’s purchase protections, while Shop Pay and 1Password integrations are planned.

 

Users decide which services Muse can access and can revoke a connection later. Meta says Muse conversations and VM data are not sent to its advertising systems. Activity performed on external websites can still affect advertising indirectly, because those sites may treat the agent’s visit as the user’s own activity.

 

The current Secure VM also is not a cryptographic barrier against Meta itself. Company policy restricts employee access, but Meta may access VM data when needed to operate, support or secure the service. Training data is sanitized to remove key personal identifiers, and users can opt out of model training in settings.

 

A Confidential VM option is planned for later in 2026. Meta says it will use user-controlled keys and a trusted execution environment intended to prevent even the company from accessing the contents. The design and source code are being shared with external auditors before release.

 

Meta has also opened Muse to its public bug bounty. Valid reports can earn up to $300,000, including as much as $130,000 for a successful prompt-injection attack affecting one user. That program gives independent researchers a direct financial incentive to test the safeguards under real-world conditions.

 

The central test is whether those controls remain understandable as Muse gains more connections and autonomy. Consumers must evaluate not only whether the agent saves time, but also which accounts it can read, which actions it can execute and where a mistaken approval could propagate.