DEV Community: Shawn Todd

What 1 billion Muse tokens actually buys (measured from real usage)

Shawn Todd — Mon, 19 Oct 2026 16:34:11 +0000

What 1 billion Muse tokens actually buys (measured from real usage)

Token allowances are abstract until you burn through them. I tracked my own Muse usage for a full week, so here is what the numbers mean in practice: what the free tier covers, what eats tokens fast, and when paying actually makes sense.

The tiers, plainly

Muse has 3 tiers. The features are the same on all of them. You are only buying weekly usage.

Free: $0. Up to 100 million tokens a week, refreshed weekly.
Power: $20 a month. 500 million tokens a week.
Maximum: $100 a month. 3 billion tokens a week.

The free tier figure comes from Mark Zuckerberg's launch post. The paid figures come from Meta's own subscription pages. Meta does not publish what a single task costs in tokens, so everything below is measured from my own meter, not from their docs.

What I actually burn

I run background agents around the clock. Research sweeps, monitoring jobs, long unattended runs. My measured burn is 560 to 580 million tokens a day. That is 3.9 to 4 billion tokens a week.

Read that against the tiers. My weekly burn is about 39 times the free allowance. It is about 8 times the Power allowance. It even exceeds the Maximum allowance of 3 billion a week.

I am not a normal user. I am the extreme case, and I know it. But the extreme case is useful, because it shows exactly where the tiers break.

What the free tier covers

For a normal person, 100 million tokens a week is generous. It covers a few agent tasks a day: planning, errands, research, drafting. Short interactive sessions sip tokens. If you use Muse the way most people use a chatbot, with a few delegated tasks mixed in, you will likely never touch the ceiling.

For comparison, this is the most generous free agent tier among the big labs right now. ChatGPT, Claude, and Gemini all gate their free tiers harder. That is not marketing. It is just the published numbers side by side.

What burns tokens fast

Two things eat tokens an order of magnitude faster than chatting.

First, background agents. An agent working while you sleep does not stop to think about cost. Every page it reads, every tool call it makes, every retry after a failure, all of it meters. One overnight research sweep can burn more than a week of casual chat.

Second, long unattended jobs. Anything that runs for hours, fans out across subtasks, or retries on failure. My 580 million token days are almost entirely this: agents running while I am asleep or at work.

Rule of thumb from my meter: interactive use sips, autonomous use gulps. If your usage is mostly you asking questions and reading answers, the free tier will feel unlimited. The moment you set agents loose on schedules, watch the meter.

When paying makes sense

Do not pay before you hit the free cap at least once. The meter in the app warns you as you approach it, so you will know.

If you hit the cap regularly, Power at $20 a month gives you 5 times the free allowance. That covers heavy daily use and longer agent runs.

If you run agents overnight or keep several going at once, that is what Maximum is for. 3 billion a week is 30 times the free tier. Even at my burn rate, it covers most weeks.

One honest caveat: neither paid tier fixes the things that are not about tokens. Region limits, one Gmail account per connector, approvals that wait on you. Those are the same on every tier.

The takeaway

Invite codes grant 1 billion tokens, one time. That is roughly 10 weeks of the free allowance in a single grant. For a normal user, that is months of not thinking about the meter. For someone like me, it is under 2 days of burn, which tells you how far apart normal use and extreme use really are.

If you get a code, redeem it within 48 hours of joining. Join at muse.ai/join, then Settings, then Redeem Code. Miss the window and the tokens are gone. Mine is ZL1YRX, if you want it.

The broader point stands without any code: measure your own usage for a week before you pay for anything. The free tier is bigger than it looks, and the meter will tell you exactly which kind of user you are.

A Researcher Turned Meta's Muse Into "the Ultimate Backdoor" — the Flaw, the Fix, and 5 Lessons for Agent Builders

Shawn Todd — Wed, 23 Sep 2026 00:33:35 +0000

A Researcher Turned Meta's Muse Into "the Ultimate Backdoor" — the Flaw, the Fix, and 5 Lessons for Agent Builders

On September 21, 2026, macOS security researcher Patrick Wardle published a finding that should make every agent builder uncomfortable: a single undocumented setting in Meta's brand-new Muse AI assistant could turn the whole agent into, in his words, "the ultimate backdoor."

Meta shipped an emergency hotfix the next day. But the flaw itself — and what it reveals about agentic AI security — is worth understanding in detail, because this exact class of bug is coming for every AI agent you build.

What Wardle found

The Muse Mac app has a dictation feature: click the microphone, speak, and your audio gets transcribed into a prompt. Under the hood, that flow is governed by an internal setting called endo_voyager_dictation_endpoint — the URL your dictated audio gets sent to for transcription.

Two problems:

The setting was undocumented. It wasn't part of any public configuration surface. It was just... there, in the app's internals.
It could be redirected locally with no special privileges. Any code already running on your Mac under your user account could point that endpoint at an attacker's server instead of Meta's.

So the attack looks like this: malware (or anything running as you) flips one setting. You click the microphone and dictate a prompt like normal. Your audio goes to the attacker instead.

Why this is worse than a normal app bug

Wardle laid out the blast radius plainly:

🎙️ Steal your dictated audio — everything you say to your agent
💉 Inject prompts Muse trusts and executes — the attacker doesn't just listen, they can drive
🔑 Steal your auth token and invisibly control Muse directly

That last point is the one that matters. Muse isn't a chatbot — it's an agent. Users are meant to give it access to messaging, email, calendars, and online accounts so it can do multi-step tasks for them. As Wardle put it: "Anything you gave Muse access to? Now the (local) attacker has it too: msgs, emails, finances..."

A compromised chatbot leaks a conversation. A compromised agent hands over the keys to everything it was trusted to touch. The blast radius of an agent vulnerability scales with the agent's permissions — which is the entire point of agents.

Wardle published a proof of concept on his GitHub so anyone can verify the finding.

The remote vector: ClickFix

Strictly speaking, this was a local attack — the attacker needs code already running on your machine. That mitigates it somewhat.

But Wardle flagged the realistic escalation path: ClickFix attacks. That's the social-engineering technique all over the news lately — a fake CAPTCHA that tricks you into pasting a command into your terminal, which gives the attacker a foothold on your machine in one move. macOS now warns before you paste commands into Terminal, but researchers note it's easily bypassed, and the warning doesn't exist on other OSes at all.

Local-only is a speed bump, not a wall. And Wardle's finding is a reminder that "requires local access" stops being comforting the moment social engineering enters the picture.

Meta's response: fast, and honest about the limits

Credit where it's due — Meta moved fast. On September 22, David Singleton of Meta Superintelligence Labs confirmed on X that a hotfix had shipped to the Muse Mac app:

"This was a local privilege escalation attack, not a remote exploit. Using it to do harm therefore requires malicious code already running on the user's machine under their user account and the practical risk to users of the Muse Mac app was therefore quite low. Nonetheless, we have issued a hotfix to the app to address the issue."

That's a fair characterization. It was local, not remote. But "quite low risk" depends on your threat model — and for an agent holding your email, messages, and accounts, even local-only deserves the emergency patch it got.

The deeper irony: Meta's launch materials describe Muse's security as "first-of-its-kind privacy, safety, and security protections" — a Secure VM on Meta's servers, a separate Sentinel agent policing what leaves your machine. All of that architecture was intact. The bug wasn't in the fortress. It was in an undocumented side door on the client — the part of the system closest to the user and hardest to lock down. Meta has also said confidential-computing protections are still on the roadmap, not yet built in.

5 lessons for agent builders

1. Your agent's permissions ARE the blast radius. Every connector you add — email, calendar, payments — multiplies what a compromise yields. Design permission scopes like they'll be abused, because eventually one will be.

2. Undocumented settings are undocumented attack surface. If a debug or internal endpoint exists in the shipped client, assume attackers will find it. Wardle found this one in days. Ship with internal knobs either removed or authenticated.

3. The client is the soft underbelly. All the server-side sandboxing in the world doesn't help if the local app can be pointed at a different server. Harden the client config path: sign it, verify it, or don't have it.

4. "Local only" is not a severity downgrade anymore. ClickFix-style social engineering has industrialized the local-foothold step. Rate your local bugs as if the attacker gets one free terminal paste — because increasingly, they do.

5. Patch speed is a feature. Meta went from public disclosure to hotfix in about 24 hours, with a named engineer communicating openly. That's the standard. Your incident response is your security story now.

Try Muse yourself — free

For all the drama, there's a reason Muse hit No. 1 on the US App Store ahead of ChatGPT within a week of launch: a genuinely useful agent you can poke at yourself. If you want to kick the tires (on the patched version — make sure your Mac app is updated), here's a free invite code:

My Muse invite code — free 1 billion AI tokens. Join at muse.ai/join, then go to Settings → Redeem Code and enter the code within 48 hours of joining — miss the window and the tokens are gone.

Code: ZL1YRX

Limited uses, first come first served. After redeeming, you've got a billion tokens to burn testing whatever you want — including, if you're security-minded, how the permission and approval flows hold up.

The flaw described here was disclosed by Patrick Wardle on September 21, 2026, and patched by Meta on September 22, 2026. Details via Wardle's public disclosure and Meta's response; the technical summary above is the author's own.

Muse AI: Meta's Personal AI Agent, Explained — Plus How to Claim 1 Billion Free Tokens With an Invite Code

Shawn Todd — Tue, 22 Sep 2026 23:22:30 +0000

Muse AI: Meta's Personal AI Agent, Explained — Plus How to Claim 1 Billion Free Tokens With an Invite Code

By Shawn Todd (@daprodusa) · Updated September 22, 2026

This post includes a live invite code at the end — 1 billion free Muse tokens for you if you redeem it within 48 hours of joining.

If you've been seeing "Muse AI" pop up and wondering whether it's just another chatbot, here's the short version: it's not. Muse is Meta's personal AI agent, launched September 8, 2026, and the whole point is that it does things instead of just answering questions.

This is a technical walkthrough of what Muse actually is, how it works under the hood, how the token economy functions, and how the invite program works — including a live invite code at the end (limited uses, first come first served).

What Muse Actually Is

Muse is an autonomous personal agent built on Meta's Muse Spark model family — the model stack Meta describes as its most capable for agentic, multi-step work. It launched first in the United States on iOS, Android, the web at muse.ai, and WhatsApp, and expanded to Canada on September 18, 2026, beginning with iOS and web.

The core difference from a standard chatbot: you give Muse a task or a goal, and it breaks the request into a plan, takes actions across connected services, and keeps working in the background after you close the app — returning when something changes or it needs your approval.

Three pieces make Muse different from a chat window, and they're worth understanding:

1. Muse Secure VM. Each agent runs inside its own virtual machine — a cloud-based emulation of a personal computer with its own browser, file system, and terminal. That's what lets Muse keep carrying out requests after you've moved on. It's also the isolation boundary: your sensitive work happens inside the VM rather than on your device.

2. Connectors. Muse plugs into categories of apps you choose: email, calendar, payments, health and fitness data, shopping, smart-home services, Instagram, and more. You opt into each connection individually and can revoke access at any time. Where a service has a public API, Muse connects with your credentials; where it doesn't, it uses its browser to do what you'd do by hand.

3. Sentinel + approval cards. Sensitive actions — sending an email, completing a purchase — require your approval via a structured approval card before anything irreversible happens. Meta's Sentinel program screens outgoing requests, and checkout runs through Link by Stripe with one-time-use card numbers, so the agent (and the merchant) never sees your real card details. Passwords and payment details are stored separately, out of the agent's visibility.

Practical upshot: real example tasks Meta and press coverage describe include reading school emails and adding dates to a family calendar, assembling a grocery list from saved Instagram recipe reels, booking travel and restaurant tables, filling out forms, lowering bills or negotiating prices, tracking subscriptions, and assembling documents, PDFs, and interactive "Artifacts" like spending trackers or study guides.

One honest caveat before the next section: the safeguards above are Meta's stated design — the company's account of its own security, not independently verified fact. Reuters reported internal concerns during testing that Muse mishandled sensitive personal data. Treat the above as what Meta says it built, and decide your own comfort level with what you connect.

The Token Economy

Muse runs on tokens. Usage of the agent consumes tokens from your balance, and the pricing model is layered:

A free tier covers everyday use.
Paid plans at roughly $20 and $100 per month (reported launch pricing) exist for heavier users who need higher daily task limits. (Meta hasn't published detailed tier-by-tier limits, so treat exact quotas as "check the app for current terms.")

Where tokens matter for this article: Meta seeded an invite program that puts a large token grant in the hands of new users.

How the Invite Program Works

The mechanics, as Meta structures them:

Every Muse user gets an invite code — in the app, look for the Invite button on the main chat screen.
A new user joins Muse and enters a friend's code under Redeem invite code in Settings.
The code must be redeemed within 48 hours of joining. This is the critical rule — miss the window and the bonus is gone.
Once redeemed: the new user receives 1 billion Muse tokens.
Each code is capped at 30 total uses — first come, first served.

That 48-hour window is strict, so don't join and plan to redeem "later." Join, then go straight to Settings.

The Invite Code (Still Active at Time of Writing)

Code: ZL1YRX

How to use it:

Join at muse.ai/join and create your account.
Open Settings.
Go to Redeem Code and enter ZL1YRX.
Do it within 48 hours of joining — miss it and the tokens are gone.

1 billion free tokens. Limited uses, first come first served.

FAQ

Is Muse free?
Yes, there's a free tier for everyday use. Paid plans ($20 and $100/month tiers have been reported) exist for heavier use. The invite code above gives you 1 billion free tokens regardless of plan.

What does "48 hours of joining" mean exactly?
The countdown starts when your account is created. Redeem the code in Settings → Redeem Code within that window or the bonus is gone — there's no grace period.

Does Muse work outside the US?
It launched US-only on September 8, 2026, and expanded to Canada on September 18, beginning with iOS and web. Availability elsewhere hasn't been announced — check muse.ai for your region.

Can Muse see my passwords or card numbers?
According to Meta, no: the design keeps credentials and payment details in separate storage the agent can't see, and purchases use one-time card numbers through Link by Stripe. That's the company's stated design — not independently verified.

Can I opt out of training Meta's models on my Muse conversations?
Yes — you can opt out of having your Muse interactions used to train Meta's AI models in settings.

What's the difference between Muse and the Meta AI app?
Meta AI is the chat/voice companion (also in Ray-Ban glasses). Muse is the agentic layer: its own VM, app connectors, goal tracking, and the ability to keep working after you close the app.

Code status last verified September 22, 2026. If the code shows as exhausted, all 30 uses are gone — I'll update this post the moment that happens.