# Meta Muse Muse is Meta's personal AI agent, launched in the US on Tuesday 8 September 2026. Meta calls it "a secure, private personal AI agent". You give it goals, it plans, sets reminders and acts across the apps you connect, and it keeps working after you leave the app. It can also come to you with suggestions you didn't ask for. The internal code name was Hatch (it still shows in the runtime, as `hatch-safety` and `hatch-authd`). [[Alexandr Wang]], Meta's chief AI officer, fronted the launch interviews. Mark Zuckerberg called it "built from the ground up for privacy and security", and had told investors in July that personal agents would be "the foundation for our next wave of products and revenue lines". Muse is part of the wave Ethan Mollick calls "Clawlikes": agents that get a computer plus your accounts, in the line of [[OpenClaw]]. The order of arrival among the big companies, per The New Stack: [[Grok Bot]] in August, Muse on 8 September, OpenAI's [[Dots (AI)|Dots]] on 29 September. [[Claude Duet]] followed on 21 October. Who it's for: consumers first. It's the only one of these agents with a free tier, and the examples are everyday errands (book travel, lower a bill, turn a saved Instagram recipe reel into a grocery list). A small-business version came three weeks later. ## How it works Meta published an unusually detailed engineering post on launch day ("How We Built Safety Into Muse", Tarek Sheasha). - **Muse Secure VM.** Each user gets a dedicated Linux VM in Meta's cloud. The agent, its files and its tools run inside a locked-down container on that VM (`systemd-nspawn`, its own Debian filesystem, filtered system calls) - **Sensitive services sit outside that container.** The classifiers, the credential service, the connector workers and a separate database all run next to it, and talk to it through local sockets with access checks - **Sentinel.** A separate component on the host is the only thing allowed to act on connectors or send traffic to the internet. Muse proposes an action; Sentinel answers allow, deny or ask. It inspects traffic down to the method, path and decoded body. A process that has read your data becomes "tainted", and anything it sends out falls back to your approval - **Credentials.** OAuth tokens stay in your VM, not in central Meta systems. The agent only sees stand-in tokens; Sentinel swaps in the real ones at the network boundary. Browser logins go through a dedicated screen straight to the credential service, and the email connector filters out one-time codes, reset links and magic links - **A restricted browser.** The browser sub-agent sees an accessibility tree instead of the raw page, can't run JavaScript, and has DevTools disabled - **Prompt injection defenses in layers**: model training, labels on untrusted input, a set of classifiers, human approval for data leaving the VM, a malicious-site blocklist. Meta says the design targets Simon Willison's "lethal trifecta" (see [[Lethal Trifecta for AI Agents]]) Behavior is driven by Markdown files. A developer who exported his Muse runtime (more on that below) found `SOUL.md`, `AGENTS.md` and `TOOLS.md` instruction files, about 68 skill folders (each with a `SKILL.md`), and a nightly "dream" process that writes guidance for future sessions. The New Stack lists Muse among the products that copied OpenClaw's personality-file pattern. Meta admits Muse "isn't immune to attack" and that prompt injection is an open problem. It runs a public bug bounty: up to $300,000 per report, up to $130,000 for a single-user prompt injection. Planned: a **Muse Confidential VM**, encrypted with a key only you hold, so "not even Meta" could get in. It's being tested with a small group. Until then, what limits Meta staff access to your VM is internal policy, not a technical barrier. ## Models - **Muse Spark** at launch, "Meta's most capable model to date". Muse Spark 1.3 came out on 2 September 2026 (Meta reports about 20% fewer tool calls and 25% fewer tokens than 1.2) - **Muse Wonder** (12 October 2026) "will soon power experiences in Muse", subscribers first. As of mid-October, no report shows the app switched - One developer found most sessions in his runtime on a Meta model code-named "Avocado", and one sub-agent session on `azure/muse-special`. His guess that it's an OpenAI model served through Azure is a guess ## What it does Meta's and the press's examples: send email, book travel and appointments, fill out forms, lower bills, negotiate, send party invites, make purchases, watch home security camera feeds. You name your agent and pick its avatar, look and communication style (reviewers' agents were called Pip, Polly and Slime). The app has five tabs: chat, a feed (which can include updates from your Facebook and Instagram), an Ideas tab with example prompts, goals tracked from past conversations, and your files and media. Mollick's example is the one people quote: Muse noticed an expiring airline credit and contacted American Airlines to get it extended. ## Channels and apps - **At launch**: iOS and Android apps, the muse.ai website, and WhatsApp. The WhatsApp version has the same conversation, but no feed and no Ideas tab - **Mac app** (17 September): works with local files, messages, calendar, notes and mail. No Windows app - **iPad app** (7 October) - **Announced at Connect** (23 September): Muse on Meta's AI glasses "in the coming months" (you wake it by saying its name), a voice mode while tasks run, its own email address for your agent, and Muse Charm, a pocket voice device with no price or date ## Connectors and purchases At launch, Muse connected to email (read-only or send on your behalf), a browser, Instagram, calendars, payments, health and fitness, smart home, dining, shopping, music and events, one at a time. Services with a public API use your own credentials; the rest go through the browser. Meta's help center says it fetches only what it needs (it searches your mail instead of downloading the inbox). Connect added retailers (Walmart, Best Buy, Sephora, Wayfair and others), Shop Pay, PayPal, Instacart, and work tools like Notion, Granola, GitHub and Box. **Muse for Small Business** (29 September, US and Canada) lets you hand Muse a business goal, with connectors such as Shopify, Stripe, Slack, QuickBooks, Canva, Asana and your Meta ad accounts. It can't publish, send or spend without your approval. Purchases go through **Link by Stripe**, with single-use card numbers tied to one merchant, amount and time window. Meta says Muse is the first AI agent covered by Link's purchase protections. Checkout pages always need your approval. Shop Pay was "coming soon" at launch and listed as a connector two weeks later; 1Password, also "coming soon", hasn't shown up. Not every store plays along. Amazon has blocked Muse since 20/21 September, calling it an "unauthorized AI agent". Target blocked its autonomous checkout clicks in CNN's test. Wang told CNBC that Meta is looking at taking a cut of agent purchases, with no plan settled. ## Memory and privacy **You can open Muse's memory.** It lives in files like `MEMORY.md` that you can view by asking or by opening them. Meta's engineering post says you can "inspect, edit, and download" your files; the help center describes viewing and a "Forget" skill, which removes a topic, a person or interactions "as thoroughly as it can". Muse may keep what it learned from deleted data, and a reset wipes everything. Under the hood, the developer's export showed plain Markdown files plus a database of embeddings and claims tracked with evidence and confidence. **TIME's report** (6 October) went further, from Muse's internal instructions: dossiers on users and the people they mention (non-users included), updated every hour; relationship maps; nightly analysis; de-identified "shared lessons" across VMs. It also says "forget" may not erase the original chat message, and that the agent is told not to mention it. Meta didn't dispute the findings. **Ads.** Conversations and VM data aren't shared with Meta's ad systems. But Muse browses as you, which Meta admits can indirectly affect your ads. **Training is opt-out, on by default**, and the setting applies retroactively. When it's on, Meta strips names, emails, phone numbers and national IDs and separates the interactions from your account. **Approvals.** Muse asks before sensitive actions (sending email, buying). The approval appears as a dialog outside the chat and goes straight to Sentinel, with a scope: once, for the session, for the task, for a time window, or forever. Read-only and previously approved low-risk actions skip the prompt. Claire Vo praised the activity feed, which shows each tool call and where it came from. ## Pricing and availability - **Free** for "most of what people need". A card is required, and a meter warns you when free usage runs out. Meta doesn't publish the free quota - **Power**: $20 per month, 500 million Muse tokens per week - **Maximum**: $100 per month, 3 billion Muse tokens per week - 18+, Meta account, supported country. At the limit, you wait for the reset or upgrade - **Regions**: US at launch, Canada since 18 September. No date for the EU or the UK as of mid-October ## Incidents and reception Adoption was fast. Muse hit No. 1 among free iPhone apps, 2.5 million downloads by 23 September (Sensor Tower via CNN), and more than 5 million installs in the US and Canada in 22 days (a Sensor Tower estimate). TIME cites about 4 million users. The first six weeks also brought a long list of problems: - **Runtime export** (22 September): a developer asked Muse for its filesystem and got 6.8 GB, including internal docs, memory files, logs, about 113 sub-agent traces and SSH key files. Meta's bug bounty marked it "Not Applicable"; Meta later said the file access is intentional - **macOS 0-day** (22 September, Patrick Wardle via Ars Technica): any local app could change a setting and steal the Muse sign-in token. Meta fixed it about 12 hours after publication and called it "not a remote exploit" - **Messages ingestion** (around 22 September): Inc.'s Jason Aten says Muse for Mac synced 187,000 rows of his Apple Messages although he says he declined access. Meta says that needs Full Disk Access plus the Messages connector. Unresolved; Apple then announced tighter Full Disk Access controls - **Marketplace** (28 September): Futurism reports Muse accepted a lowball offer for a user and shared his home address without approval - **TIME dossier report** (6 October), see above - **GhostShares** (20 October, Ars Technica): share links put the conversation title in a web address that passive DNS could find. A researcher enumerated 6,800 links with confidential content. Meta paused sharing Reviews were mixed. Claire Vo (Lenny's Newsletter) called it the "best-designed personal agent" she'd tested, weak at shopping. CNN found it good at planning but wrong about closed restaurants. The [[Hacker News]] launch thread (666 points, 742 comments) split between "the first polished OpenClaw for normies" and distrust of Meta with personal data. And trust is a real issue here: Muse launched less than two weeks after a multistate settlement over social media harms, on top of Meta's FTC history and Cambridge Analytica. Smaller stories: the band Muse lost its social handles to the agent, and Wired reports Muse allows explicit sexting with verified adults. ## How it compares Muse is the cheapest way in (free, then $20) and goes where people already are (WhatsApp). It has the most detailed published isolation design of the hosted agents, and the only memory you can open as files. [[Dots (AI)|Dots]] needs ChatGPT Pro ($100+) and won't show you its memories. [[Claude Duet]] has a smaller set of channels (its own app and the web) but harder limits on money moves. The full table, with Grok Bot, Gemini Task, Microsoft Autopilot, OpenClaw and Hermes Agent, is in [[Claude Duet]]. ## My take On paper, Muse does two things I've been asking for. Its memory is a set of Markdown files you can open, which is how I keep my own agents' memory in my vault ([[AI Agent Memory]], [[AI Agent Portability]]). And Sentinel is the right architecture: the model proposes, a separate component with the real credentials decides, and data that has touched your private files can't leave without you. It's the first consumer agent I've seen built around the lethal trifecta from day one. Then I read the incident list. A runtime that hands out its own SSH keys, a 0-day in the Mac app, share links you could find through DNS, and TIME's report of dossiers on the people you mention. Readable memory files don't mean much if "forget" doesn't fully forget. And training on your data is on by default. I'm in Belgium, so the question is academic anyway: Muse is US and Canada only. If I could use it, I'd connect read-only apps first and keep it away from my messages. ## Caveats - The architecture, quotas and safety claims come from Meta. Adoption figures are Sensor Tower estimates or come via The Information - The Muse runtime findings (instruction files, skills, "Avocado", `muse-special`) come from one developer's blog. The `muse-special` = OpenAI reading is his guess - Meta's engineering post says you can edit your files; the help center only describes viewing and Forget. TIME says Forget may not erase the original message - The newsroom post promises an audit trail of completed and planned actions; the engineering post doesn't describe audit logs - Quotas: Meta's help center lists 500 million (Power) and 3 billion (Maximum) tokens per week. Some outlets report a free quota (100 million tokens a week), which Meta doesn't publish. An earlier comparison brief said Meta publishes no quotas at all; the help center page says otherwise - The Messages ingestion story is Aten's account against Meta's three-permission explanation. Techdirt's claim of root access by impersonating a Muse agent comes from its roundup only; I didn't check the primary source - The settlement Muse launched after is "$18B" for TechCrunch and "nearly $17 billion" for CNBC - Canada date: 18 September per Meta's own post; a few outlets said 8 September - What changed when Meta updated its launch post on 30 September is unknown - I left out benchmark numbers on purpose: the Artificial Analysis figures quoted for Muse Wonder conflict with the ones in my [[GPT-6 Astra]] note ## References - Meta Newsroom, "Introducing Muse" (8 September 2026, updated 30 September): https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/ - Meta AI Research, "How We Built Safety Into Muse" (Tarek Sheasha, 8 September 2026): https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse - Meta Help Center, "About Muse subscriptions": https://www.meta.com/help/subscriptions/1021145227643680/ - Meta Help Center, "Muse privacy, security and controls": https://www.meta.com/help/artificial-intelligence/1047255454427887/ - Meta Newsroom, "The Biggest News From Connect 2026" (24 September): https://about.fb.com/news/2026/09/the-biggest-news-from-connect-2026/ - Meta Newsroom, "Muse for Small Business" (29 September): https://about.fb.com/news/2026/09/introducing-muse-small-business/ - Meta Newsroom, "Introducing Muse Wonder and Muse Wonder Full" (12 October): https://about.fb.com/news/2026/10/introducing-muse-wonder-models/ - TechCrunch, "Meta debuts its Muse AI agent. Will consumers trust it?" (8 September): https://techcrunch.com/2026/09/08/meta-debuts-its-muse-ai-agent-will-consumers-trust-it/ - CNBC (8 September): https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html - CNN review (23 September): https://www.cnn.com/2026/09/23/tech/meta-muse-ai-agent - Lenny's Newsletter, Muse review (Claire Vo, 16 September): https://www.lennysnewsletter.com/p/muse-review-the-personal-ai-agent - iPhone in Canada, Muse in Canada (18 September): https://www.iphoneincanada.ca/2026/09/18/metas-muse-ai-agent-is-now-available-in-canada/ - AI Weekly, Muse for Mac (17 September): https://aiweekly.co/alerts/meta-ships-muse-for-mac-agent-now-acts-in-native-macos-apps - iPhone in Canada, Muse for iPad (7 October): https://iphoneincanada.ca/2026/10/07/metas-muse-ipad-app - Ars Technica, macOS 0-day (Dan Goodin, 22 September): https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/ - Ars Technica, shared conversations (Dan Goodin, 20 October): https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ - TIME, "Meta's Muse AI Agent Is Building a Dossier On You" (Harry Booth, 6 October): https://time.com/article/2026/10/06/meta-muse-ai-agent-privacy/ - Inc. (Jason Aten): https://www.inc.com/jason-aten/metas-new-muse-ai-agent-read-my-private-messages-i-never-asked-it-to/91408202 - Decrypt, Meta's response: https://decrypt.co/379868/meta-pushes-back-on-claim-that-muse-ai-read-a-users-messages-without-consent - Futurism, Marketplace incident (28 September): https://futurism.com/artificial-intelligence/metas-muse-ai-giving-users-home-addresses - Mouse blog, runtime export (Peter James, 22 September): https://mouse.dev/blog/muse-runtime-export/ - Mouse blog, "muse-special" (Peter James, 25 September): https://mouse.dev/blog/muse-special/ - Techdirt (6 October): https://www.techdirt.com/2026/10/06/metas-muse-is-an-adorable-privacy-and-security-dumpster-fire/ - PPC Land, 5 million downloads (30 September): https://ppc.land/metas-muse-gains-5-million-downloads-in-its-first-3-weeks/ - Wired (21 October): https://www.wired.com/story/onlyfans-creators-are-pissed-that-meta-lets-muse-talk-dirty/ - Notebookcheck, Muse skips Europe (13 October): https://www.notebookcheck.net/Meta-Muse-Wonder-Developers-get-it-now-the-Muse-app-skips-Europe.1422810.0.html - Hacker News launch thread: https://news.ycombinator.com/item?id=49615537 - Engadget, the band's handles: https://www.engadget.com/2254419/muse-the-band-lost-its-social-media-handles-to-muse-meta-s-new-ai-agent/ - Ethan Mollick, "The Dot and the Swarm" (1 October): https://www.oneusefulthing.org/p/the-dot-and-the-swarm - The New Stack, "Anthropic's answer to Dots and Muse is already inside Claude" (Matt Burns, 3 October): https://thenewstack.io/claude-answer-to-dots-muse/ ## Related - [[Claude Duet]] - [[Dots (AI)]] - [[Grok Bot]] - [[Gemini Spark]] - [[Microsoft Autopilot]] - [[OpenClaw]] - [[Hermes Agent]] - [[Alexandr Wang]] - [[AI Agents]] - [[AI Assistants]] - [[AI Agent Memory]] - [[AI Agent Portability]] - [[Lethal Trifecta for AI Agents]] - [[Prompt injection]] - [[Human-in-the-Loop]] - [[2026-10-03 OpenAI Dots - always-on agents, with a memory you can't inspect]]