Muse Puts a Meta Computer Between You and the Web

Meta on September 8 launched Muse, a personal AI agent that shops, sends email, and runs on its own cloud computer. The US app talks like a chatbot, lets people pick a name, and keeps working after they close it. Most of that run is free, with two premium tiers for heavier use.

The pitch is ease. The machinery underneath is a dedicated Linux box, a second agent that gates the network, and a Stripe checkout path that never shows Muse a real card.

Muse Leaves the Chat Window for a Dedicated App

Muse is not a new tab inside Facebook or Instagram. It ships as its own iOS and Android app and as a site at muse.ai, with WhatsApp chat and AI glasses listed as follow-on surfaces. Meta is rolling out in the US on iOS, Android, and the web first.

People talk to it the way they message a person. Share a goal, and Meta says Muse builds a plan, times the work, then advances it on its own. It can open a browser, fill forms, and negotiate. Long jobs keep going after the app is closed. Muse comes back when something changes, or when it needs a yes before it sends mail or pays.

That is a different product from Meta AI, the assistant already sitting in the company’s apps. Muse is built to act across the open web and third-party accounts, powered by Muse Spark, which Meta calls its most capable model for this kind of work. Vishal Shah, Meta’s VP of AI Products, said the agent can also write its own software, so a public API is enough for it to grow a new hook. “Because it is a very capable AI product that can also build its own software, it isn’t really limited in what it can do,” Shah said. Comfort with access, he added, is the real limit.

Mark Zuckerberg, posting as @finkd, called Muse “the personal agent that understands your goals and works 24/7 to get things done for you.” The company account @Muse put the same demo in a launch video.

Introducing Muse, your personal AI agent from Meta that gets things done across every part of life.

Download the Muse app and get started: https://t.co/KBjYWfshGo pic.twitter.com/1exp56xj93

— Muse (@Muse) September 8, 2026

Your Own Linux Box in Meta’s Cloud

Personal agents, Meta argues, need a new kind of computer. Muse Secure VM is that computer: one isolated Linux machine per person, with a browser, CPU, memory, and storage, living in Meta’s cloud. Credentials for connected services sit there. No other person’s agent can reach it, according to the company.

MUSE AT LAUNCH

• Free compute: Zuckerberg said Muse is free up to 100 million tokens a week, with paid plans above that.
• The box: Each account gets a dedicated cloud VM, internally nicknamed Hatch, with its own browser and room to compile code the agent writes.
• The gate: A separate Sentinel process, not Muse itself, is the only thing allowed to approve network egress and connector actions.
• Where it runs: United States on iOS, Android, and the web; glasses come later.

Tarek Sheasha, a software engineer and VP at Meta Superintelligence Labs, wrote that staff have used Muse internally since early 2026, including inboxes, calendars, and a shell left running unattended. That trial, he said, did not always go as planned. The product that shipped assumes the agent may be under attack: the harness runs in an isolated cell, it does not see real credentials, and it cannot override Sentinel.

Passwords and payment methods go into secure storage. Muse can use them without reading them, including passwords a person types into the VM’s browser. People can tell Muse to forget a detail, opt out of training, and disconnect any service. Meta says conversations and VM data are not shared with its ad systems, though shopping activity can still color ads in an indirect way.

Stripe Link Puts Meta in the Checkout

The consumer demo that will get used first is buying. Muse can check out with Link, Stripe’s wallet. Meta says it is the first AI agent covered by Link’s purchase protections on eligible buys, which Stripe lists as coverage for damaged or lost items, price drops, no-fee returns, and a return guarantee. Link mints a one-time-use card so the real number never sits in the agent.

That rail is older than Muse. Stripe opened a Link wallet for agents on April 29, built on Issuing for agents, so an approved bot can receive a one-time card or a Shared Payment Token after the owner taps yes in the Link app. Stripe has said Link reaches more than 200 million consumers. Other agents already ride the same track. Muse is the version Meta can put in front of people who will never install a hobbyist agent stack.

HOW MUSE PAYS AND LOGS IN

Shop Pay and 1Password are promises, not buttons. Until they ship, the live money path is Link, and the live control is a tap in Link plus Muse’s own purchase prompt. The agent can still browse, compare, and fill a cart. It cannot finish a buy until a person says so.

Email Write Access Is the Trust Test

Shopping is a card tap. Email is identity. Muse can connect Meta’s own apps and a first batch of outside services, then write custom connectors when a public API or CLI exists. For email, the person picks the depth: read only, or send on their behalf.

THE FIRST HOOKS MUSE SHIPS WITH

• Meta apps: Instagram and Facebook, including saved recipe reels turned into grocery lists.
• Work stack: Google Workspace, with calendar and mail as the obvious pair.
• Going out: Ticketmaster, OpenTable, Spotify, and Apple Health.
• Mail rules: Read and write are split; one-time codes, password-reset links, and magic login links are filtered so the agent cannot replay an inbox into account takeovers.
• Homegrown hooks: If a service has an API or CLI, Muse can write its own connector rather than wait on a partner deal.

Shah’s point lands here. The product gets more useful as people hand it more of their life, which is also how it gets more dangerous. A read-only calendar that flags conflicts is a small grant. A send-capable inbox that can reset passwords elsewhere is a large one. Meta’s filter on reset mail is an admission of that, not a flourish.

The same pattern shows up in the launch examples. Muse can turn a saved Instagram reel into a shopping list, suggest a wine, remember a friend’s diet, and draft the invite. Each step is harmless until the send or the charge. Those two beats are where Meta has inserted a human stop.

What Sentinel Can and Cannot Stop

Sentinel is a second agent on the same VM, kept apart at the system level. Muse proposes. Sentinel alone can let a connector method run or let a packet leave the box. Approvals do not travel through the chat as a polite suggestion. They pop in the client UI, then route straight back to Sentinel as a scoped capability: one-time, session, task, time-bounded, or standing.

Muse can and will still make mistakes, but we expect they’ll be much less frequent and cause much less damage due to the safety systems we’ve built in.

Tarek Sheasha, VP, Meta Superintelligence Labs, in Meta’s Muse safety post

Low-risk, read-only, or already-allowed actions can pass without a tap. Anything that has touched user data and then tries to talk to the network loses that auto-allow. Credentials never enter the model. Connector workers run outside the agent’s cell with tight allowlists, so a calendar worker cannot ask for an email token by editing a field. The public bug bounty of up to $300,000 now covers this stack, including up to $130,000 for a prompt-injection that hits one user.

That is a serious harness. It is also a bet that people will trust Meta to host the computer that holds the tokens. The Sentinel design follows a year in which Meta’s agent stack has already been tested in public, including a Muse Spark configuration incident. The new product answers that class of failure with isolation. It does not answer the older question of whether a company built on ads should sit in Gmail and Stripe.

WHAT WE KNOW

• The free band: Zuckerberg set the complimentary cap at 100 million tokens a week.
• Paid overflow: Subscription plans exist for people who burn more compute; Meta has not posted dollar prices on the consumer Muse plans.
• The stop: Purchases and outbound email require a person’s approval.

WHAT’S UNCONFIRMED

• The two tiers: Power-user plans are real; their names and monthly prices are not on the launch pages.
• Glasses timing: AI glasses support is promised, with no ship date.
• Shop Pay and 1Password: Both are “coming soon,” with no calendar attached.

The recurring objection on launch day was not latency or a missing skill. It was the grant itself: a Meta-hosted box with a path into mail, health, tickets, and a wallet. Shopping and local picks are the jobs early testers already treat as real. Making Muse a daily driver means handing it the rest.

Five Months From Spark to a Consumer Agent

Muse the app is new. The name has been on Meta’s models since spring. Muse Spark, the first release from Meta Superintelligence Labs under AI chief Alexandr Wang, arrived on April 8. Five months later the same family is driving a consumer agent with a browser and a card.

THE STACK THAT BECAME MUSE

1. April 8, 2026: Muse Spark ships as MSL’s first model and takes over Meta AI.
2. July 7, 2026: Muse Image launches; Muse Video is previewed.
3. July 9, 2026: Muse Spark 1.1 adds stronger tool use and a public Model API preview.
4. July 24, 2026: Meta AI in the main app starts making plans, touching email and calendar, and following through.
5. August 5, 2026: Muse Code, a coding agent, goes out to developers.
6. August 10, 2026: Muse Glimmer, a 30-billion-parameter open-weight model under Apache 2.0, is released to run local agents on a single consumer GPU.
7. September 2, 2026: Muse Spark 1.3 lands with a focus on long-horizon agent work.
8. September 8, 2026: The consumer Muse app opens in the United States.

Zuckerberg spent August arguing that superintelligence should live with people, not in a few labs. He published a personal superintelligence essay in August the same day Glimmer dropped, describing an always-on agent for health, money, work, and home. Muse is the first consumer shape of that claim that does not require a GPU under the desk. Glimmer is the local twin. Spark 1.3 is the brain Meta says is now good enough to leave running.

Rivals already sell agentic chat and hobbyist boxes that drive a browser. Meta’s edge is distribution plus a VM it can mint per account. The cost of that edge is the trust receipt: every useful skill is another OAuth screen.

Glasses, WhatsApp, and the Locked VM

Two sequels are already on the calendar, if not on the clock. Muse is coming to AI glasses, which would put the same agent on a face-mounted camera. And later this year Meta says it will ship Muse Confidential VM, a mode where the whole machine, data and chats included, is encrypted with a key only the person holds, so Meta itself cannot read it. That is the WhatsApp-style private mode the August essay previewed, delayed until after a launch that still lets Meta see enough to run the model.

Until that key exists, Muse is a helpful cloud PC that Meta operates. It can lower a bill, shop a grocery list, and draft the dinner invite. It can also sit in the two places the social apps never fully owned: the inbox and the pay button. The free 100 million tokens a week are there to make that sit feel cheap. Sentinel is there to make it feel contained. The person still has to decide which of those feelings is the one that matters when the approval dialog appears.