Meta's Muse Is a Personal AI Agent That Wants Your Passwords and Your Purchases

Meta introduced Muse on September 8, 2026, describing it as an agent that does not only answer questions but actually does the work: reading your mail, booking your trips, negotiating your bills and, when you let it, buying things with your money. It is the company's first personal AI agent, and it arrives well behind rivals that have spent two years shipping agentic products to consumers and coders alike.

Related reading: Nvidia Puts $3 Billion Into Meta's Equity Sale and Expands the Muse Partnership · Amazon Blocks Meta's Muse From Shopping, Testing Who Controls the AI Agent.

Meta's pitch is that it built Muse from the ground up to be safe, secure and private, and that a new kind of secure computer is what personal agents require. The claim is not that Muse is smarter than the competition. It is that Muse is safer to trust. Whether readers accept that depends less on the architecture diagram than on Meta's record, and on what the company's own employees were reporting internally just days before launch.

What Meta actually launched

• Muse is a "proactive personal AI agent" that Meta says helps with goals and volunteers suggestions, built under the internal codename Hatch and powered by the Muse Spark family of foundation models from Meta Superintelligence Labs (Meta Newsroom; WIRED).
• It runs on "Muse Secure VM," a dedicated cloud virtual machine per user that houses both the agent and the user's data, isolated so no other user's agent can reach it (Meta Newsroom).
• Availability starts in the United States on iOS, Android and the web at muse.ai, and through WhatsApp. Meta says it is coming to its AI glasses (Ray-Ban Meta) later this year (TechCrunch; The Verge).
• Meta says the free tier covers everyday tasks, with subscriptions at $20/month ("Power") and $100/month ("Maximum") for heavier use. A payment card is required to sign up, and the app includes a usage meter that warns users before usage requires payment (TechCrunch; CNBC).

For a company whose last big consumer platform was built on feeds and ads, Muse is a different kind of product. It needs access to the systems where your life actually happens (email, calendar, payments, health, shopping, the smart home) to be useful at all, which is exactly what makes it a test of trust rather than of features.

How the agent works

The interaction model is deliberately unremarkable: Meta says talking to Muse works like messaging a person, in the Muse app or directly inside WhatsApp. Users describe a goal, and Muse develops a plan and then advances it on its own. According to Meta, it can open a browser, fill out forms, send emails, book travel, make online purchases and negotiate bills on a user's behalf (Meta Newsroom).

Longer jobs keep running after the app is closed. Meta says Muse returns when something changes or when it needs approval, for instance, before it sends an email or makes a purchase. It also remembers details users mention once and uses them for unprompted suggestions, such as turning a saved recipe reel into a grocery list or remembering a friend's dietary restrictions before sending invitations (Meta Newsroom).

On payments, Meta partnered with Stripe's Link. Meta says Muse is the first AI agent covered by Link's purchase protections (coverage for damaged or lost items, price drops, no-fee returns and a return guarantee on eligible purchases) and that Link's agent wallet generates a one-time-use card so a user's real card details stay hidden. Shop Pay and 1Password support are coming, Meta says (Meta Newsroom).

The security architecture, as Meta describes it

Meta's central design choice is that the agent and the user's credentials live in different security domains even when they share a machine. A separate "Sentinel" agent runs on the same VM but is kept apart from Muse at the system level. In Meta's telling, nothing Muse does reaches the internet unless Sentinel approves it, and Sentinel asks the user for permission when needed (Meta AI Research).

The company's technical write-up adds several specifics:

• Muse never sees passwords or payment methods; credentials go into secure storage and are injected only at the point of need.
• Users choose which apps Muse connects to and exactly how much access each gets, and can disconnect a service or change access at any time.
• Muse shows a complete audit trail of what it has done and plans to do, and asks before sensitive actions.
• Meta says Muse does not share a user's conversations or VM data with its ad systems, and users can tell it to "forget" specific things.

Meta published a lengthy engineering post describing isolation primitives, a proxy-based egress gatekeeper and "credential surrogation," in which the model only ever handles surrogate tokens that Sentinel swaps for real credentials at the network boundary (Meta AI Research).

That last detail matters. Prompt injection (untrusted text or images steering an agent into acting against its user) remains an unsolved problem, and Meta acknowledges as much. Its answer is defense in depth: model training, input classifiers, a restricted browser that sees an accessibility tree rather than the raw page, and the Sentinel gate. Meta is also opening a public bug bounty that pays up to $300,000, including up to $130,000 for a successful prompt injection affecting a single user (Meta AI Research).

The privacy promise Meta has not fully delivered yet

The "secure" VM in Muse's name is isolated, but it is not, at launch, private from Meta. Meta's own engineering post says the architecture "restricts access to your data by Meta personnel through operational policies" but "does not prevent Meta from accessing data when necessary to support, secure or operate the service" (Meta AI Research). WIRED reported that while Meta is barred by policy from accessing user Muse data, it would still be technically possible (WIRED).

Meta says it plans a "Muse Confidential VM" later this year, in which the whole VM (data and conversations) is encrypted with a key only the user holds, so that not even Meta can access it. Meta says it is already testing it with a small group of trusted testers and has begun making the design and source code available to external auditors (Meta Newsroom; Meta AI Research). Until that ships and is independently audited, the privacy guarantees rest on policies and code that only Meta currently operates.

Training data is another open question. Users can opt out of their interactions being used to train Meta's models, but CNBC reported that opting out is not the default: users must actively choose it. If they do not, Meta says it scrubs "critical personally identifying information" before using conversations to improve its models, Singleton told CNBC (CNBC). Meta said the app would not share conversations or VM data with its ad systems, though its technical post notes that when Muse browses as you, that browsing can still indirectly influence what ads you see (Meta AI Research).

The trust problem, and what Reuters found

Muse lands less than two weeks after Meta agreed to a massive multistate settlement (reported at roughly $17–18 billion) with attorneys general over social-media harms to consumers. Meta still faces related personal-injury and school-district lawsuits. In that context, asking users to connect their email, payments and calendars is a significant ask (CNBC; TechCrunch).

Reuters, citing internal posts from Meta employees testing the tool, reported mixed results as recently as launch week. Employees described cases in which Muse disconnected without explanation and uploaded sensitive information without permission. One employee, who had asked Muse to monitor for fast-selling tickets, reported "many failure modes that made it unreliable": the product stopped refreshing a page after about 15 minutes, silently ignored errors and at times disabled monitoring "for no apparent reason," according to Reuters. Another said the agent was useful enough while planning a three-week honeymoon in Indonesia to have become "the third participant" on the trip (Reuters; The Hindu/Reuters).

Meta did not respond to Reuters' request for comment on the specific incidents. The company has said it postponed the launch, originally expected in April, to strengthen safeguards; Vishal Shah, Meta's vice president of AI products, told reporters the extra work brought the product to the minimum necessary level of security, privacy and model performance (Mezha/Reuters).

None of this means Muse will fail. It means the gap between Meta's documented safeguards and its internal test results is the story readers should weigh.

Why Meta thinks it can still win

The competition is real. The Verge noted that Muse is very similar to a growing array of agents (OpenAI's ChatGPT Work, Anthropic's Claude Cowork, Microsoft's Copilot Tasks and Google's Gemini Spark) and that Meta is late to shipping a consumer personal agent (The Verge).

Meta's advantage, if it has one, is distribution and ease of use. WhatsApp alone reaches billions of people, and Meta frames Muse as usable out of the box with "no learning curve" (Meta Newsroom). Reuters describes Muse as the centerpiece of CEO Mark Zuckerberg's plan to supply "personal superintelligence" to the billions of people who use Meta's services daily (Reuters via Khaleej Times; CNBC).

CNBC also reported that Meta is exploring ways to monetize agent-driven commerce, such as taking a cut of shopping transactions, though AI chief Alexandr Wang said no concrete plan is settled. Wang described the app as running in "its own isolated environment" that "never sees your actual passwords or payment details and asks before doing anything sensitive" (CNBC).

The strategic logic is straightforward: if agents become the interface to the internet, the company that supplies the agent (and the checkout) captures enormous value. The price is a level of access to personal data that no previous Meta product has required.

What to watch

• The Confidential VM. Meta says the fully encrypted version, with user-held keys and third-party audits, is coming later this year. Watch whether it ships on schedule and whether independent auditors confirm Meta cannot access encrypted VM data, the current architecture's privacy rests on policy, not cryptography, per Meta's own post.
• Real user incidents. The architecture is designed to bound damage when the agent is wrong. The test is what happens when a real purchase, email or reservation goes badly, and how quickly Meta responds.
• The training default. Confirm whether opt-out of model training is on or off by default in shipped builds, and how scrubbing of personally identifying information is verified (CNBC).
• The bug bounty's signal. How many prompt-injection and credential-handling findings researchers report (and how fast they are fixed) will be a more honest measure of Muse's safety than any marketing claim.
• Whether trust is measurable. Meta's recent settlement and pending lawsuits make Muse an unusual experiment: a product whose success depends not on capability alone, but on persuading skeptical users that the company's promises this time match its practices.