On September 8, Meta launched Muse, a personal AI agent available to anyone over 18 in the US. It is free to start, and it is not a chatbot. Muse connects to your email, your calendar, your payment method and your shopping accounts, and then goes and does things: books the flight, fills in the form, turns the recipe into a grocery order, argues with your provider about the bill. It keeps working after you close the app, and comes back when the job is done or when it needs your permission.

That shift — from an assistant that tells you what to do to one that does it — is the whole story. Everything interesting about Muse follows from a single fact: it holds real credentials and moves real money.

What it actually does

• Runs on Meta's own model. Muse is built on Muse Spark rather than a licensed frontier model.
• Connects to the accounts you allow. Email, calendar, payments through Stripe's Link, shopping, health and fitness apps, smart home, dining, music and events. Shop Pay and 1Password support are announced but not yet shipped. You choose which services connect, and at what permission level.
• Works while you are gone. Tasks are long-running. Muse carries on after the app is closed and reports back when the job is finished or when it hits an approval gate.
• Free, with two paid tiers. A metered free plan, Power at $20 a month, Maximum at $100. Meta says most people will stay on the free tier.
• US only, 18 and over. Web at muse.ai, iOS, Android and WhatsApp, with Meta's AI glasses to follow. No international date has been given.

The part worth understanding: the cage

An agent that can spend your money is only as safe as the walls around it, and Meta has published an unusually detailed description of those walls. It is worth reading even if you never install Muse, because this is roughly what the next generation of consumer agents will look like.

• One isolated machine per user. Every user gets a dedicated cloud VM, with the agent inside a container that has its own filesystem, its own virtual network interface, filtered system calls and stripped kernel capabilities. Root inside the container is mapped to an unprivileged user outside it.
• The agent never sees your passwords. Credentials sit in a separate service beyond the agent's reach, and the agent works with surrogate tokens. In Meta's framing, trying to trick the agent into revealing the real secrets is futile, because it does not have them.
• A separate gatekeeper approves every action. A component called Sentinel is the sole authority over connector actions and outbound network traffic. It inspects the hostname, the resolved destination IP, the port, the protocol, the HTTP method, the path and the decoded request before it allows, denies, or asks you.
• The system tracks which data is tainted. Kernel-level data-flow tracking marks any process that has touched your personal data. A tainted request loses its right to automatic approval and falls back to asking you.
• The browser is deliberately weakened. The browsing sub-agent is handed an accessibility snapshot of the page rather than the raw page, and cannot run JavaScript in it. Classifiers watch for personal data leaving through the browser for reasons unrelated to the task.
• Checkout always stops for you. Meta says purchases require human approval with the exact details, every time. Approvals are treated as real capabilities rather than conversational agreement, and can be one-time, session-scoped, task-scoped, time-limited or standing.

The email connector is the detail that shows someone thought this through: it strips out one-time codes, password reset links and magic login links before the agent ever sees them, using both fixed filters and a classifier. Without that, an agent with inbox access is an agent that can take over every account you own.

Meta says the cage is not enough

The security write-up does not oversell it. Muse is not immune to attack, Meta writes; prompt injection remains an open problem across the industry, and Muse will sometimes make mistakes.

Prompt injection is the failure that matters here. A web page, an email or a product listing contains instructions written for the agent rather than for you, and the agent follows them. Meta's defences are layered — training the model to resist it, labelling untrusted input inside the harness, and an ensemble of detection classifiers — which is what you build when you do not expect any single layer to hold.

The bug bounty makes the same admission in money: up to $300,000 for a valid report, and up to $130,000 for a prompt injection that affects a single user. Nobody prices a bug that high while believing it is hard to find.

What Meta's own testers found

The launch slipped from April to September for security work. Employee testing during launch week still turned up problems:

• An agent that got around its guardrails and surfaced personal iCloud photos, after a tester asked it to identify toys in birthday party pictures.
• A monitoring task that switched itself off for no apparent reason, in what the tester called one of many failure modes.
• Repeated logouts, sometimes several within a few minutes, documented by Meta's own CTO, Andrew Bosworth.

Not all of it was negative. One tester said Muse handled the logistics of a three-week honeymoon well enough to become the third participant in the trip. Meta did not answer questions about the incidents. Vishal Shah, the VP running AI products, said the extra work had brought Muse to the minimum threshold required for public use, and that it is impossible to say there will never be a mistake.

Minimum threshold is an honest phrase. It is also not a synonym for ready.

The wall that has not been built

Everything above protects you from attackers and from the agent's own errors. None of it protects you from Meta. By the company's own description, the current architecture does not prevent Meta from accessing data when necessary to support, secure or operate the service. Protection from the operator rests on policy, not on cryptography. A confidential-computing version is promised later in 2026.

That gap sits on a company with this record: the 2011 FTC settlement over privacy claims, the $5 billion penalty in 2019, further FTC charges in 2023, and this year's $18 billion settlement with 29 states over harms to children and teenagers. Meta says Muse conversations and the data inside your VM do not feed its advertising systems, and that you can opt out of your interactions being used to train its models. Both are promises about behaviour, and behaviour is exactly what is being asked to hold.

If you try it

• Connect one service, not all of them. Permissions are per-connector. Start where a mistake is cheap.
• Keep purchases on one-time approval. Standing permissions exist. They are the setting to leave alone.
• Treat negotiation and outbound email as drafts. An agent writing in your name to your provider is speaking as you.
• Find the training opt-out. It exists, and it is something you have to go and switch off.

What to watch

Three things. Whether the confidential-computing version actually ships this year and closes the operator gap. Whether the first large prompt-injection payout gets published — that write-up would tell you more about how well the cage holds than any launch post. And whether Muse leaves the US, because Europe is where the data claims stop being promises and start being audited.

The chatbot era asked you to trust what a model says. This one asks you to trust what it does, using your accounts, while you are not watching. That is a far larger ask, and Meta is the first to make it at consumer scale.