Muse launched September 8: a Meta agent that emails, books, fills forms and pays. US only, 18+
Free up to 100M tokens a week, card required, then 20 USD Power or 100 USD Maximum
Each user gets a Linux VM with its own browser, and a separate Sentinel agent approves every network call
Reuters saw internal posts about exposed iCloud photos, and Meta admits it can technically read your VM
The architecture is the most serious I have seen from a consumer agent, the company is the open question
Meta announced Muse yesterday and started rolling it out today. Not a chatbot with a shopping plugin. A thing that gets its own computer in Meta's cloud, logs into your email, and spends your money once you say yes. It is US only for now, so I spent the evening reading everything Meta published about it, plus the things Meta would rather not have published.
What Muse Does and Who Can Use It
Muse is the consumer product built on Muse Spark, the model family Meta Superintelligence Labs has been shipping since April. Spark 1.0 arrived on April 8 as the first closed-weights model in Meta's history, 1.1 followed in July, and Meta's own safety write-up names Muse Spark 1.3 as the model inside Muse. Alexandr Wang, who joined as chief AI officer after Meta paid 14.3 billion USD for a 49 percent stake in Scale AI, runs the lab.
The pitch is short. You give Muse a goal, it makes a plan, and it does the steps. Meta's launch list: send email, book travel, lower bills, fill out forms, build plans, turn a saved recipe reel into a grocery list, send party invitations, and check out at a store. It connects to your email, calendar, payment method, health and fitness apps, smart home, dining, shopping, music and events services. When a task takes a while, it keeps running after you close the app and comes back when it needs a decision, for example before it sends a mail or pays for something.
What separates this from the "agent mode" buttons other apps have bolted on? Muse remembers. It keeps preferences across conversations, and Meta says it will make unprompted suggestions, which is either the most useful or the most annoying feature depending on how well it reads you. It also lives in a real environment: a Linux machine in Meta's cloud with a browser and a shell it can run code in. Gizmodo's reviewer had it draw a portrait in a Paint clone via Python, compose a MIDI tune from the drawing, and build a fake bootable Mac OS with a working paint app. None of that is a "personal errand." It does show the box has a computer in it.
Access: United States only, adults 18 and over, on iOS, Android, muse.ai and inside WhatsApp. Meta's AI glasses get it "soon." Nobody in Europe can sign up today, and Meta has given no date.
Free Up to 100M Tokens a Week, Then 20 or 100 USD
Mark Zuckerberg posted the number himself on Threads: free for up to 100 million tokens per week, "with subscription plans for those who use even more compute." The paid tiers are Power at 20 USD a month and Maximum at 100 USD a month. Meta has not published a token ceiling for either tier, and every outlet I checked repeats the same two prices with nothing behind them. What you pay for is volume, not features.
Two catches. TechCrunch reports the free tier still requires a payment card on file, which makes sense for an agent that can check out at a store but also means "free" comes with a card number. And 100 million agent tokens are not 100 million chat tokens. An agent burns tokens on planning, tool calls, sub-agent handoffs and browser snapshots you never see.
In practice the allowance looks huge. Gizmodo's writer spent an evening deliberately wasting compute: a side-scroller, a first-person shooter with levels, a website, 50 genre variations of a theme tune, 50 animations, a 3D adventure game, then the fake Mac OS. After the games and the site, Muse reported 6 percent of the weekly allowance used. After the operating system, 11 percent. The reset date was September 15. Their conclusion: "so much it's disturbing."
The entry price lands exactly where everyone else already sits. ChatGPT Plus is 20 USD, Claude Pro is 20 USD, Google AI Pro is 19.99 USD, and all of them now ship an agent inside that plan. If you want the deeper context on how OpenAI priced its own top model last week, see GPT-6 Astra Costs 2.5x Sol. Meta's difference is the free tier: the others give you a chatbot for free and gate the agent behind the subscription, Meta gives you the agent for free and gates volume.
Do not confuse this with the Muse Spark API, which has its own developer pricing and a contributor tier. Different product, different numbers, nothing in this article applies to it.
The Secure VM and the Sentinel, Explained
This is where Meta spent its engineering budget, and it is worth reading even if you never touch Muse.
Every user gets a dedicated virtual machine, the Muse Secure VM, that holds the agent, your data and your credentials. Inside it, the agent runs in a systemd-nspawn container: root inside maps to an unprivileged user on the host, io_uring is filtered out of the syscall table, and capabilities like CAP_SYS_PTRACE and CAP_NET_ADMIN are dropped. The database, the credential store and the safety classifiers run as separate services outside that container and talk to it over Unix sockets with peer credentials checked.
Then there is Sentinel. Meta describes it as "the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network." Nothing leaves the VM unless Sentinel says so. It inspects hostname, resolved IP, port, HTTP method, path and the decoded request body, and it refuses anything that resolves to private infrastructure. Grants can be one-time, session-scoped, task-scoped, time-bounded or perpetual, and Sentinel checks that later calls match the granted scope exactly. Where a service supports it, read and write are split, so you can let Muse read your calendar without letting it create events.
The credential trick is the clever bit. The agent never holds your real tokens. It sees surrogate tokens, and Sentinel swaps in the real credential at the network boundary, just in time. The email connector strips one-time codes, password reset links and magic links before the model reads the inbox. Purchases go through Link by Stripe with single-use card numbers tied to one merchant and one amount, valid for a short window. Meta says Muse is the first agent covered by Link's purchase protections. Shop Pay and 1Password are announced, not shipped.
Approvals happen in the app UI, not in the chat. That matters, because a prompt injection cannot fake a "yes" in a channel the model does not control. The browser gets an accessibility tree instead of the raw DOM and cannot run JavaScript in the page. On top sit classifiers watching for injection hidden in page content or files, for exfiltration of personal data unrelated to the task, and for high-risk form submissions.
Anthropic went a different route with a browser inside the desktop app, which I covered in Claude Cowork Now Opens Its Own Browser. Meta's design puts more distance between the model and your machine. On paper it is the more paranoid one, and I mean that as praise.
Where the Trust Story Has Holes
Now the other half.
Meta's own security document says the Secure VM "restricts access to your data by Meta personnel through operational policies. It does not prevent Meta from accessing data when necessary to support, secure or operate the service." David Singleton, the Superintelligence Labs VP who runs consumer engineering, told Wired the same thing more plainly: policy forbids looking inside your VM, but technically the company can. The fix is a Confidential VM running in a trusted execution environment with keys you hold, so that even Meta is locked out. Meta says it is testing that with a small group, has started handing the source to external auditors, and plans to ship it "later this year." Until then, the isolation protects you from websites and from the model. Not from Meta.
Ads: Meta commits that conversations and VM data do not feed its ad systems. Training is a different matter. The back-and-forth "trajectories" between you and Muse train new checkpoints unless you flip the opt-out switch in settings, and Meta says personal identifiers are scrubbed first. Flip it on day one if that bothers you.
Then there is what happened inside Meta before launch. Reuters saw internal posts from employees testing Muse as recently as this week. CTO Andrew Bosworth wrote that he kept getting logged out, sometimes several times in a few minutes. Another tester described an agent routing around its guardrails and exposing a person's private iCloud photos after being asked to identify toys in pictures from a child's birthday party. One employee, on the other side, said Muse handled so much of a three-week honeymoon in Indonesia that it became "the third participant." Meta had already pushed the launch back once, in April, to harden it. Vishal Shah, Meta's VP of AI products, gave Reuters the honest answer: "It is impossible to say that there is never going to be a mistake."
TechCrunch's launch piece spent most of its length on Meta's record, from the 5 billion USD FTC penalty in 2019 to the 2023 charges for violating that same order. I do not think that history is irrelevant to a product that asks for your inbox and your card. I also do not think it settles the question, because the engineering here is better than anything Meta has shipped for consumers before. Both are true at once.
The bug bounty is real money: up to 300,000 USD per report, with up to 130,000 USD for a prompt injection that affects a single user. I expect that program to be busy.
Bottom Line
I cannot use Muse. It is US only and I am not there. So this is a reading of the documents, not a field test, and I will say so again the day I get access.
What the documents tell me: Meta built the most defensible consumer agent architecture on the market and attached it to the company people trust least with their data. The free tier is large enough that most people will never pay. Before I recommended it to anyone in my family, I would want the training default flipped and the "we technically can" admission replaced by the Confidential VM that is still months out.
If you run a small studio like I do, the better question is how Muse stacks up against the agents you already pay for. I put ChatGPT Work, Claude Cowork and Gemini Spark next to it in Meta Muse vs ChatGPT vs Claude vs Gemini. Meta's earlier agent work, including the 50-agent code swarm from April, is in Meta Built a 50-Agent AI Swarm. Everything else I have written on AI tools this year is collected on the Lab overview.
Top comments (0)