Eric Kang

Posted on Sep 26

Meta Muse in 13 Real-World Tests: What to Delegate, What to Verify

#privacy #agents #security #ai

What to hand Meta's AI agent first, what to double-check, and which settings to change on day one. Built from real tests by CNN, WIRED, The Verge, Yahoo Finance, Inc., Ars Technica and independent reviewers.

Most Muse guides show you the launch demo. This one is built from what happened when real people handed Muse real errands in its first three weeks.

The range is wide. When Yahoo Finance's Daniel Howley asked Muse for moving quotes, it contacted four local movers, and two called back within about two minutes. Around the same time, Inc. columnist Jason Aten says he declined to give Muse access to his Messages. According to Aten, the Mac app later synced more than 187,000 rows of his message history anyway.

Both of those outcomes are possible with the same product. The goal of this guide is to get you the first one and keep you clear of the second.

What you'll learn:

What Muse is, where to get it and what it costs
How to set it up safely in five steps
What to delegate first, based on tests that worked
What to double-check, based on tests that didn't
The trust issues you should know about
A day-one safety checklist and a task template you can copy

Part 1: What Muse is

Muse is Meta's personal AI agent, launched in the US on September 8, 2026. A chatbot answers your question and leaves the work to you. Muse takes a goal and carries it out: it sends the email, fills in the form, books the table and follows up.

Here's what makes it work:

Its own computer. Each user's agent runs on a dedicated cloud virtual machine with its own browser, which Meta calls Muse Secure VM.
It keeps working in the background. Longer tasks continue after you close the app. Muse checks back when something changes or when it needs your approval.
Memory. It remembers what you tell it and uses it later. You can edit that memory or ask it to forget things.
Connectors. You link services like Gmail, Google Calendar and Outlook, and you choose how much access each one gets.

The basics:

Where: In the US on iOS, Android, the web at muse.ai, and WhatsApp. There's also a Mac app, and at Connect on September 23 Meta added computer use, which lets Muse operate apps on your Mac with your permission. Support for Meta's AI glasses is coming later.
Cost: There's a free tier with a usage meter. Mark Zuckerberg put the free limit at up to 100 million "Muse tokens" a week. Paid plans are Power ($20/mo) and Maximum ($100/mo). TechCrunch reported at launch that a payment card is required to get started.
Not the same as Meta AI: The Meta AI assistant inside Instagram and Messenger is a separate product.

Part 2: Set it up safely in five steps

Step 1: Sign up and name your agent.

Sign up at muse.ai or in the app. The default avatar is Jolly, but you can rename it and change how it looks. Reviewers have given theirs names like Pip and Lyra.

Step 2: Connect your calendar first, then your email as read-only.

When you connect email, Meta lets you choose whether Muse can only read your mail or can also send on your behalf. Start with read-only. Upgrade after you've watched it work for a week.

Step 3: Turn off AI training if you don't want to contribute.

It's on by default. According to WIRED, go to Settings → Data controls in the Muse app and switch off Help improve our AI models.

Step 4: On a Mac, check two permissions.

Meta says Muse can read Messages only if macOS Full Disk Access is granted and the Messages connector is on. Open System Settings → Privacy & Security → Full Disk Access. If you didn't mean to give Muse access to your whole disk, turn it off. Then check the Messages connector inside Muse. Aten says he found it enabled after declining it.

Step 5: Keep purchases on one-at-a-time approval.

Muse should ask before any purchase. Read exactly what it's buying, including the tip. Checkout runs through Link by Stripe, which Meta says generates a one-time card number so your real card stays hidden.

Part 3: What to delegate first

These are the tests that went well. They have one thing in common: the work is mostly coordination, not judgment.

Get quotes from movers — Daniel Howley, Yahoo Finance: ✅ Contacted four movers. Two called back within about two minutes; others replied by email.
Book a date night — Howley; Lisa Eadicicco, CNN: ✅ Howley booked one of four suggestions through OpenTable. CNN's Friday date night got booked too.
Set a fantasy football lineup — Howley: ✅ Put in a waiver claim for the Chiefs defense, dropped Green Bay, and started KC once the claim cleared.
Plan a trip with a friend — Eadicicco, CNN: ✅ Emailed a friend about Cape May, then turned the friend's restaurant picks into a Google Doc with alternatives.
Build a moving-week packing plan — Eadicicco, CNN: ✅ Made a day-by-day schedule with time budgets, plus tips like packing a "first night" bag.
Clean out a Gmail inbox — Emma Roth, The Verge: ✅ Deleted thousands of promotional emails on a laptop. ⚠️ Google sign-in kept glitching on mobile.
Buy workout tops — Roth, The Verge: ✅ Noticed other items already in the cart, asked about them, and bought only the tops.

1. Errands that are mostly back-and-forth

The moving quotes are the ideal Muse job. None of it is hard, it's just tedious: find the companies, answer the same questions four times, wait for callbacks. Muse turned all of that into one short conversation.

CNN's trip planning worked for the same reason. Muse emailed a friend, waited for the reply, then turned the recommendations into a shared doc. A chatbot can't do that, because a chatbot doesn't wait around for someone to write back.

Rule of thumb: if a task is mostly emailing, form-filling and following up, hand it over.

2. Actions inside accounts you already use

Connected to Yahoo Fantasy, Muse compared projected points, put in a waiver claim for Kansas City, dropped Green Bay and set Howley's lineup once the claim processed. Those were real actions in a real account. For The Verge's Roth, it cleared thousands of promotional emails out of Gmail. On a shopping run, it noticed other items sitting in the cart and asked whether to remove them before checkout.

3. Planning with constraints

Eadicicco told Muse what was left to pack, how much time was available, and a preference for packing in short spurts. Muse came back with a day-by-day plan. Constrained planning plays to what language models do well, and Muse adds the follow-through.

Good first tasks to copy:

"Get quotes from three movers for a two-bedroom, second floor, no elevator. Don't book anything."
"Find an evening next week when we're both free and suggest three restaurants nearby. Show me before booking."
"Every morning, summarize today's calendar, deliveries and bills that are due."

Part 4: What to double-check

These are the tests that went wrong. Almost every failure comes from Muse acting on information that was wrong or out of date.

Find restaurants for date night — Eadicicco, CNN: ❌ Two suggestions had been closed for years.
Find gluten-free beer nearby — Howley: ⚠️ Two good picks and one spot that had been closed for years. It also gave a phone number, then admitted it had made that number up.
Buy a winter jacket — MBI Deep Dives: ❌ After recommending a Patagonia jacket, Muse said the discount it had shown was no longer available.
Haggle on Facebook Marketplace — Eadicicco, CNN: ❌ Said it couldn't message sellers directly, only draft a message to send manually.
Order breakfast from a bakery — Reece Rogers, WIRED: ⚠️ Built the order but selected "no tip." Rogers ended up ordering in person.
Connect iCloud email — Taylor Arndt, Substack: ⚠️ Built a custom iCloud tool on request, but it didn't persist and kept needing an app password.

It can rely on stale data

CNN and Yahoo Finance were both sent to restaurants that had been closed for years. When Howley pointed it out, Muse apologized and said it had initially relied on stale data. MBI Deep Dives was shown a Patagonia discount that no longer existed.

What to do: treat every address, price, discount and "open now" as a draft. Ask Muse for the source link and click it.

It can invent details

Howley asked for a restaurant's phone number. Muse gave one, then said to use a different one, and when asked why, admitted the first number was made up. To its credit, it then warned Howley not to trust unverified numbers.

What to do: verify phone numbers and opening hours before you call or show up.

The marketing can run ahead of the product

Muse's own Ideas tab told CNN it could message Marketplace sellers and negotiate the price. When Eadicicco tried, Muse said it could only vet listings and draft a message. Meta told CNN that Muse can negotiate within user-set parameters, and in WIRED's test Muse did offer to message couch sellers. Results vary.

What to do: try a new capability once on something low-stakes before relying on it.

Some choices need a human

On WIRED's bakery order, Muse picked "no tip." It's a small thing, but it's exactly the kind of social judgment you don't want an agent making quietly.

What to do: read the full order before approving it, not just the total.

Accessibility still has gaps

Taylor Arndt, who is blind and uses Apple's VoiceOver, ran into a name field that didn't behave like a normal text field, chat messages without headings, decorative images read aloud, and an unlabeled control in the Mac app's setup. Arndt still wants to use Muse, and wrote the review hoping it gets fixed.

Part 5: The trust issues you should know about

You don't need to avoid Muse, but you should know what happened in its first three weeks:

The iMessage incident. Aten says he declined Messages access during setup, yet Muse later showed it as enabled and synced his message history from his Mac. When asked, Muse wrongly claimed it had only seen notification previews. David Singleton, who leads Meta Superintelligence Labs, wrote on Threads that the Messages integration is opt-in and requires both Full Disk Access and the Messages connector. Decrypt reports Singleton called the made-up explanation "on us." Aten says Meta hasn't explained how the access got switched on.
A zero-day, then a hotfix. macOS security researcher Patrick Wardle found that a local app or terminal command could redirect where Muse sends voice transcription and use that to steal the token controlling a user's Muse account. Ars Technica reports that Meta shipped a hotfix more than 12 hours after its story went live. Meta called it "not a remote exploit."
Amazon blocked it. On September 20, Amazon began blocking Muse from shopping on Amazon.com, calling it an unauthorized AI agent. Amazon says Meta never told it that Muse would access the store, that the agent doesn't identify itself, and that it appears to capture customer credentials. Meta has said Muse can't see users' passwords or payment methods.
Humans behind some calls, in testing. Reuters, citing internal posts, reported that Meta tested having human contractors quietly handle some phone calls placed through Muse. A vice president in Meta Superintelligence Labs wrote internally that starting without proper disclosures "was a miss" and that the feature had been rolled back for now.
Training is on by default. WIRED reports that interactions are used for AI training unless you opt out. Meta says the data is "sanitized" first. Muse's Memory document can be edited or wiped, but memory itself can't be switched off.
It infers more than you'd expect. Asked what it knew from Roth's connected Instagram and Facebook accounts, Muse listed interests like anime, CrossFit and Labrador retrievers, which was more detail than Instagram's own ad-topics page showed. A news feed it built drew on the shipping address from an Amazon order. Meta told The Verge you can disconnect Instagram from Muse in Accounts Center.

To be fair, Meta has published an unusually detailed security design: a per-user VM, a separate "Sentinel" agent that must approve anything Muse sends to the internet, credentials Muse can use but not see, and one-time payment cards. It has also promised a "Confidential VM," encrypted with a key only you hold, later this year. The architecture is serious. The first three weeks show the edges still need work.

Part 6: Your day-one checklist

[ ] Connect only your calendar and email, with email on read-only
[ ] Turn off Help improve our AI models under Settings → Data controls
[ ] On a Mac, check Full Disk Access and the Messages connector
[ ] Approve purchases one at a time, and read the whole order
[ ] Ask for source links on any fact you'll act on
[ ] Skim the audit trail every few days
[ ] Open the Memory document (tap the avatar at the top) and prune it
[ ] Disconnect anything you're not actively using

A task template you can copy

Goal: [what you want done]
Limits: Only use [sources/accounts]. Don't [send / book / pay / cancel] anything without asking me.
Output: Give me [a table / three options / a draft], with source links for any prices, addresses or phone numbers.

Example:

"Get quotes from three movers for a two-bedroom, second floor, no elevator, moving on October 15. Don't book or pay for anything. Give me a table with price, availability and contact info, with a link for each company."

FAQ

Is Muse free?
Yes, up to a weekly usage limit. The Power ($20/mo) and Maximum ($100/mo) plans add more usage.

Can it spend my money without asking?
It's designed to ask before any purchase. Keep per-purchase approval on, and read the full order.

Can it shop on Amazon?
Not reliably right now. Amazon began blocking Muse on September 20.

Will my data be used for ads?
Meta says conversations and VM data aren't shared with its ads systems. Model training is a separate setting, and it's on by default.

What should I try first?
Something tedious and easy to check: moving quotes, a packing plan, trip logistics, or a daily summary.

The bottom line

Across every test, the pattern holds. Muse is good at doing things and unreliable at knowing things. It's excellent at the connective tissue of life admin: the emailing, form-filling, following up and scheduling that eat your week. It's shaky on facts, and at least one user's experience suggests it can reach further into your data than you meant to allow.

Treat it like a sharp new assistant on day one. Give it real work, check what it tells you, and don't hand over every key yet.

For builders: giving an agent fresher information

Most failures in Part 4 trace back to the same gap. Muse could act, but the information it acted on was out of date.

That's the layer we work on at BeatAPI. Connected to Muse as an MCP connector (BeatAPI MCP), it lets Muse run live web searches, read pages, search current public social data and call text, image and video models through one API key. The key stays in Muse's secure connector field, never in chat, and the setup prompt tells Muse to show you the live price and get your OK before any paid run. It won't make an agent infallible, but it gives it a way to check before it acts.

Setup takes one prompt: beatapi.io/muse →

Sources

Details reflect reporting through September 26, 2026. Features, pricing and policies are changing fast.

DEV Community