A personal agent that only answers the last message is a chatbot with a longer memory. Muse is Meta’s attempt to make the other thing: an agent that stays on a goal after you close the app.
The category is not settled. Does it live in the cloud or on a machine you own? Is the surface iMessage, a bot, or its own app? Can it browse, call tools, spend money? Muse is simply the product moving fastest, so its design choices are the ones worth stealing. They come from Muse’s public design and safety writeups, and from Mark Zuckerberg’s comments in an interview compiled by Founder Park on September 24, 2026. This is not a transcript.
Three tensions run through all of it. The agent has to act without becoming another notification app. It has to do real work without going past what you approved. It has to know enough to be useful without making you afraid to connect anything.
One long conversation is not enough
Muse’s main surface is one ongoing conversation, not a fresh prompt every time. You can interrupt it. You can hand it several jobs before the first one replies. Memory is supposed to survive the thread.
That breaks a flat transcript. Messages arrive out of order. So Muse went back to chat bubbles, and it gave the agent a face, because talking to a logo for months feels wrong. In internal tests people invented their own Muse. Naming it, and giving it a look, became one of the features people actually got excited about.
Chat is still the front door. It is not the only room. A trip should come back as an itinerary, not a 2,000-word reply. Spending should come back as a dashboard, not a daily ping. Muse calls these artifacts. The activity under the avatar says what it is doing now. Open it and you get the log, the permissions you already granted, and a Goals tab for the long jobs.
The early surprise was the opposite of a missing feature. Muse could do so much that people did not know where to start. So it suggests the next useful job from what it already knows. Zuckerberg’s version of that: he and his daughter were playing Civilization, the agent offered a strategy guide, he said yes, and it came back asking whether to add a history tab. He said yes again.
Proactive is the product. Interruption is the tax.
Muse has its own computer, a browser, and a clock. It can keep working after you leave. The design rule is that a finished background job is not automatically a message. It notifies you when something meaningful changed, or when it needs you.
The school-prep story is the clean version. Mona Sarantakos, Muse’s design lead, had it watch school email and the district site, put dates on the family calendar, and fill a cart. It found a sports tryout with twelve hours left, messaged her before a flight, and her husband filed the form four hours before the deadline. That is the product. A ping that does not change the day is just another app.
Zuckerberg’s own uses are smaller and more personal. He is trying to be a better father, husband, and friend, which in practice means staying in touch. His three-year-old wanted to bake. He cannot bake. He asked the agent for a weekend project a three-year-old and a hopeless adult could do together, then to order the ingredients. The first cake-pop attempt was too hard. He told it. The next plan changed. His older daughter wanted to hike peaks that need permits. The agent watched the application window and told him which day to take off.
He also pointed a camera at his MMA gym and asked for feedback. It pulled a clip and said he had given up. He had. The coaches laughed, because they would not have said it. An agent with no social sense is not a feature. Zuckerberg treats discretion as something the model has to be trained for: book a restaurant that suits an allergy or a pregnancy without announcing either. It has to judge what is sensitive. It cannot ask on every step.
The permission is not a sentence in the chat
Meta handed an inbox, a calendar, and a shell to software that runs when nobody is watching. Most of the project, by the team’s account, went into not letting that go badly.
The harness sits in an isolated unit and cannot see real credentials. Every connector call and every outbound network request goes through Sentinel, a separate gate. Muse can propose. Only Sentinel can allow, deny, or ask. Approval cards are explicit accept or reject. A yes in chat is not a permission.
Read access comes before write access. “Check my calendar for conflicts” is an easier yes than “book the meeting.” The mailbox connector is supposed to strip verification codes and password-reset links, because an inbox that can reset your other accounts is not a connector, it is a master key. Checkout on a known site stops for a human. A new merchant gets a one-time card bound to that seller, that amount, and a short window.
Simon Willison’s “lethal trifecta” is the threat they are designing against: private data, untrusted content, and a way to send something out. If an agent has all three, a prompt injection can ask it to read your life and forward it. Muse’s answer is layers: treat outside text as untrusted, run separate classifiers, and make the user approve anything that leaves the machine. They do not claim this is solved. The goal is to limit the blast and not train the user to tap Allow on everything.
What you can give an agent before you give it your inbox
Muse’s bet is that the agent becomes a person in your life because it can see your mail, your calendar, and your goals, and because Meta will not read that the way a normal cloud app would. Zuckerberg pointed at WhatsApp’s encryption, and at hiring Signal’s Moxie Marlinspike to work on Muse’s confidential virtual machines. He also noted the OpenClaw pattern, a Mac Studio at home, and the obvious limit: billions of people will not rack a studio in the living room.
That is Meta’s stack. It is not a connector you can drop into Codex this week.
The part that transfers is smaller, and it is the part most agents are still missing. A model that only knows its training cut-off will invent this week. Muse stays useful because it can look things up and keep watching. You do not need its inbox to give your own agent the public half of that habit.
BeatAPI’s Social Data API is that read. One key, the platforms a working agent actually opens: X, Instagram, TikTok, YouTube, Reddit, LinkedIn, and WeChat articles. This piece started as a Chinese post that was already moving. An agent should be able to read that post, not wait for someone to paste it into a prompt. The same call shape covers a creator’s last month of posts, a Reddit thread, or a YouTube title, which is the raw material for “what are people doing with Muse this week,” not a guess from memory.
Web search is the other read, for everything that is not a social post. web_search returns leads. web_read gets the page. web_map lists a site instead of inventing URLs. web_research is the slower call when the answer needs several sources weighed. Page text is untrusted data. An instruction inside a fetched article is not an instruction to your agent. That is the same rule Muse is enforcing, at the scale of a public page rather than a private inbox.
Do not confuse the two. Social Data and web search do not grant email, calendar, payments, or a Sentinel. They do not make your agent Muse. They stop it from answering a live question with a stale memory. Permissions, approvals, and anything hard to undo still belong in your code.
If you are building the agent Zuckerberg is describing, start with what it is allowed to see. Read one live post through BeatAPI before you ask it to remember a life.
Top comments (0)