Meta Launches Muse Personal AI Agent to Send Emails, Shop, Book Travel and Work in the Background
Meta has launched Muse, a new personal AI agent designed to do more than answer questions. Announced on September 8, 2026, Muse can send emails, book travel, browse the web, fill out forms, shop, negotiate on a user's behalf and keep working after the app has been closed. The service is rolling out in the United States through dedicated iOS and Android apps, the web and WhatsApp, with support for Meta's AI glasses planned next.
The bigger story is not simply that Meta has another chatbot. Muse is built around persistent action: users can give it a task or a longer-term goal, connect services such as email or calendar, and let the agent continue working until it needs a decision or approval. Meta is pairing that autonomy with a per-user cloud computer called Muse Secure VM and a separate security agent, Sentinel, that controls what Muse can send to the internet.
That architecture is ambitious, but the privacy story needs one important qualification. Meta says a stronger Confidential VM is coming later in 2026 that is intended to make the virtual machine inaccessible even to Meta. The Secure VM available at launch does not yet provide that cryptographic guarantee.
Key takeaways
- Muse is an action-oriented personal agent, not just a conversational assistant. It can use a browser and connected services to send email, fill forms, shop, book travel and advance longer projects.
- It can work in the background. Muse can continue after the user closes the app and return when something changes or a sensitive action needs approval.
- Muse Secure VM and Sentinel are central to Meta's safety design. Each user gets an isolated cloud computer, while Sentinel controls network access and connector permissions.
- Free and paid tiers are launching. Meta says Muse is free for most use. Reuters reported heavier-use subscriptions priced at $20 and $100 per month.
- The strongest privacy promise is not live yet. Meta's current Secure VM can still be accessed by Meta when needed to operate, secure or support the service. A Confidential VM designed to prevent that technically is planned for later in 2026.
What is Meta Muse, and what can it actually do?
Muse is Meta's attempt to turn a personal AI assistant into a persistent software operator. Instead of stopping after it gives an answer, it is designed to take actions across websites and connected apps, coordinate multi-step tasks and keep progress moving without requiring the user to direct every click.
Meta's launch examples range from straightforward errands to open-ended projects. Muse can draft and send an email, book travel, open a browser, complete forms and negotiate. It can also take a broader goal, develop a plan, coordinate time and resources and advance pieces of the work on its own. Meta says it can keep running when the user leaves the app, returning when there is a meaningful update or when it needs permission for an action such as sending a message or completing a purchase.
That background execution is what separates Muse from the familiar chat interface. A chatbot generally waits for another prompt. An agent can maintain a goal, call tools, use connected services and decide which intermediate steps to take. Muse is powered by Muse Spark, which Meta describes as its most capable model for real-world agentic work. We previously covered the model itself in our Muse Spark 1.3 benchmark and pricing breakdown.
Muse also has memory and proactive behavior. Meta says the agent can remember details from earlier conversations, use them in later tasks and make suggestions without being explicitly prompted each time. One launch example is turning a saved recipe into a grocery list while remembering dietary restrictions for people attending a dinner.
| Capability | What Muse does | Where the user stays involved |
|---|---|---|
| Reads, drafts and can send messages depending on granted permissions | Sensitive sends can require approval; access can be limited to read-only | |
| Browser work | Opens sites, navigates pages, fills forms and completes multi-step web tasks | Credential entry and higher-risk actions can pause for the user |
| Shopping | Finds products and can proceed through checkout | Purchases require approval; Link can create a one-time card |
| Travel | Researches and can book travel | Final sensitive actions can be gated by approval |
| Long-running work | Continues in the background and can return when progress changes | User can review activity and intervene |
| Long-term goals | Builds plans, coordinates tasks and adapts over time | User controls connected services and permissions |
Muse pricing and availability
Muse is launching first in the United States for adults, with a free tier and paid plans for heavier use. Meta says the product is rolling out on iOS, Android and muse.ai, and that people can also interact with Muse through WhatsApp. AI-glasses support is listed as coming soon.
Meta's public launch post does not spell out the detailed quotas or limits attached to every tier. It says Muse is free for most of what people need and that subscriptions are available for people who want to do more. Reuters reported, citing a company spokesperson, that the subscription tiers are $20 and $100 per month.
That pricing creates an interesting comparison point for the new agent market. The expensive part of an autonomous agent is not just the model response: it may involve long-running inference, repeated browser actions, subagents, tool calls and retries. Meta has not yet published enough usage detail to calculate what the paid tiers mean in terms of task volume, runtime or compute. For now, the useful takeaway is simply that Muse is being positioned as a mass-market product with a free entry point rather than an enterprise-only automation service.
How Muse Secure VM and Sentinel work
Every Muse user gets a dedicated cloud-based Linux virtual machine, and a separate Sentinel agent acts as the permission authority between Muse and the outside world. This separation is the most technically distinctive part of Meta's launch.
According to Meta's detailed security architecture write-up, the VM provides a browser, storage, CPU and memory and can support more advanced behavior such as compiling code, building skills, creating subagents and scheduling recurring work. That makes the environment much closer to a small personal computer in the cloud than a conventional chat session.
The security design then separates the agent runtime from security-sensitive services. Muse itself does not hold the raw credentials for connected services. Instead, it receives surrogate authorization material and sends requests through controlled boundaries where the real credentials can be inserted. Sentinel is the component that decides whether connector calls and network egress are permitted.
Permissions can also be scoped. Meta says users can grant different levels of access, including distinctions between reading and writing where a connector supports them. For example, someone could allow Muse to read email without giving it authority to send. Approvals can be structured around a single action, a session, a task, a time window or more persistent permission.
Meta also says its email connector applies additional filtering around highly sensitive messages such as one-time passwords, password-reset messages and magic links. In browser sessions, the agent primarily interacts through Chromium's accessibility representation rather than receiving unrestricted raw page code. When a user needs to take over for credentials or another sensitive interaction, Muse can pause while the person completes that step.
| Risk | Meta's protection | What it means in practice |
|---|---|---|
| Agent sees a password | Credential isolation and surrogate tokens | Muse can use connected accounts without directly reading the secret |
| Agent sends data to an arbitrary site | Sentinel controls network egress | Internet access is mediated rather than fully open |
| Agent takes a sensitive action | Human approval gates | Email sends, purchases and other actions can stop for confirmation |
| Malicious instructions on a webpage | Prompt-injection classifiers and layered defenses | Meta tries to identify hostile page content before the agent follows it |
| Payment-card exposure | Stripe Link one-time-use card | The merchant can receive an agent-specific card instead of the user's real card details |
Muse Secure VM vs. Confidential VM: the privacy claim needs nuance
The Muse available at launch is isolated per user, but it is not yet cryptographically inaccessible to Meta. This is the single most important detail to understand when reading the privacy claims around the launch.
Meta's newsroom announcement says a future Muse Confidential VM will encrypt the whole VM, including the user's data and conversations, with a key only the user holds so that not even Meta can access it. That stronger architecture is planned for later in 2026.
Meta's security team is more explicit about the present-day system. It says the current architecture isolates each user's data and limits employee access through operational controls, but does not technically prevent Meta from accessing data when that is necessary to support, secure or operate Muse. In other words, Secure VM and Confidential VM should not be treated as the same privacy property.
| Privacy property | Muse Secure VM at launch | Confidential VM planned for later 2026 |
|---|---|---|
| Per-user isolated VM | Yes | Yes, based on Meta's announced design |
| Credentials hidden from the Muse agent | Yes, through security services | Expected to retain this model |
| Meta technically unable to access VM data | No | Intended to be yes |
| User-held encryption key for the whole VM | No public claim of this at launch | Yes, according to Meta's announcement |
| Available now | Yes | No |
There are two other privacy details worth separating. Meta says Muse conversations and data in the user's VM are not shared with Meta's advertising systems. But the company also notes that browsing the wider web can still create normal advertising signals outside Muse. Visiting a merchant, for example, can result in that merchant using ordinary retargeting systems. Separately, Meta says inference trajectories can be sanitized for personally identifiable information and used for model training unless the user opts out.
That is a more precise description than simply saying "Muse data is private." The launch architecture meaningfully isolates the agent and credentials, but users still need to decide whether they are comfortable putting sensitive personal workflows inside a cloud service that Meta can operationally access today.
Buying through Muse: Link today, Shop Pay and 1Password next
Meta wants Muse to complete transactions, not merely recommend what to buy. At launch, Muse can use Stripe's Link checkout. Meta says Muse is the first AI agent covered by Link's purchase protections for eligible transactions, and Link can generate a one-time-use card so the user's real card number is not exposed to the agent or merchant flow.
Every purchase still requires user approval under Meta's safety design. This is important because shopping agents create a different risk profile from recommendation bots: a mistaken answer is annoying, but a mistaken purchase can move money, create obligations and expose personal information.
Meta says Shop Pay support is coming soon. It also plans 1Password integration so Muse can use logins the user already has without the model itself needing to see the credentials. If those integrations work as intended, Muse could become a single orchestration layer across identity, payments and everyday web services.
The launch still comes with real reliability and security concerns
Meta has built substantial safeguards, but neither Meta nor independent reporting suggests that autonomous agents have become predictable or attack-proof. Meta's own security team says prompt injection remains an open problem and that Muse will make mistakes.
Reuters reported that Meta originally intended to launch Muse in April but delayed the release for additional security work. The report also described mixed internal testing. Some employees reportedly found the agent useful for complicated logistics, while other tests surfaced reliability failures, repeated logouts and monitoring tasks that stopped refreshing. Reuters also reported an internal security flaw in which guardrails were bypassed in a test involving personal iCloud photos. Meta did not respond to Reuters' questions about the specific internal incidents.
Those details do not prove the public version will fail in the same ways, and internal red-team findings are part of how security systems are improved before release. But they do underline why approval gates, least-privilege permissions and audit trails matter. An agent with access to email, calendars, cloud storage, shopping and payments has a much larger blast radius than a chatbot confined to a text box.
Meta is also putting significant external-security incentives behind the platform. Its security documentation says its bug bounty can pay as much as $300,000 for qualifying findings related to Muse. That is a useful signal that the company expects adversarial testing to continue after launch rather than treating the release as a solved security problem.
Why Muse matters in the AI-agent race
Muse is one of the clearest attempts yet to make autonomous computer use a mainstream consumer product. The important competitive advantage is not only the underlying model. Meta can distribute an agent through WhatsApp, eventually through AI glasses and potentially across a network of services people already use every day.
The product also shows where frontier AI competition is moving. Better chat answers still matter, but the next battleground is whether a model can reliably operate software, retain goals, work asynchronously and ask for help only when necessary. OpenAI's GPT-6 Astra release similarly pushed computer-use capabilities into the foreground; our GPT-6 Astra breakdown covers that shift from the model side.
The hard problem is trust. A personal agent becomes more useful as it gains more permissions and more context, yet every additional permission increases the cost of a mistake. Meta is trying to solve that tension architecturally with isolation, Sentinel, scoped connectors and human approvals. Whether everyday users will trust a Meta-operated cloud agent with inboxes, purchases and personal goals is a separate question that no benchmark can answer.
Should you give Muse access to sensitive accounts on day one?
For most people, the sensible way to adopt a powerful personal agent is progressively rather than all at once. Start with tasks where a mistake is reversible and permissions can remain narrow, then expand access only after the agent proves reliable for your workflow.
That means read-only email or calendar access is a lower-risk starting point than permission to send messages, delete data or make purchases. Review the audit trail, keep approval requirements on for consequential actions, and disconnect services that Muse does not need. For accounts involving health, finance, legal documents or highly private personal data, the fact that the current Secure VM does not yet technically block Meta access should factor into the decision.
Users who do not want their interactions used to improve Meta's AI models should also review the training opt-out Meta says it provides. And when the Confidential VM arrives, it will be worth checking whether Meta publishes technical verification, threat-model documentation and independent research supporting the claim that the company itself cannot access the protected VM data.
The strongest case for Muse is clear: a capable agent that can quietly handle low-value digital work could save meaningful time. The strongest reason for caution is equally clear: the same autonomy that makes an agent useful gives software permission to act in parts of your life that used to require you to be present.
Sources and methodology
This article distinguishes Meta's product claims from independent reporting. Product features, availability and announced privacy architecture were checked against Meta's September 8, 2026 Muse launch announcement. Security architecture and the current limits of Meta's access protections were checked against Meta AI Research's technical security write-up. Subscription prices and reported internal-test issues come from Reuters' September 8 report. Age and U.S.-availability context was cross-checked with The Associated Press.