Meta launched a new AI product on September 8, 2026, and it's a different kind of animal than the chatbots we've gotten used to. It's called Muse, and instead of just answering questions, it's built to go off and actually do things for you: book a flight, pay a bill, fill out a form.
The timing is a little awkward. Meta announced this less than two weeks after agreeing to an $18 billion settlement over social media harms, and it's asking people to hand over access to their email, payment services, and even home security cameras. Here's what Muse actually does, how Meta says it's keeping that data safe, and why plenty of people are still skeptical.
So What Is Muse, Exactly?
Muse is Meta's personal AI agent. You talk to it in a dedicated app or through WhatsApp, and it works in the background on tasks and longer-term goals, not just single questions.
It runs on Muse Spark 1.3, which Meta describes as its most capable model yet, built specifically for this kind of multi-step, real-world work rather than back-and-forth conversation.
You can also personalize the agent itself. Give it a name, pick an avatar, tweak how it talks to you — a lot like how Grok has leaned into giving its assistant a persona.
What It Can Actually Do
Meta has demonstrated a surprisingly broad range of tasks for Muse, but there's an important distinction between what Meta has shown in demos and what is confirmed as generally available at launch.
The task list Meta has demonstrated includes:
Booking travel, buying movie tickets, and scheduling things like tennis lessons
Sending emails and filling out forms — Meta's own example was a kid's school permission slip
Paying bills, and reportedly even negotiating a lower one
Bigger, one-off jobs like selling a car
Watching home security camera feeds
Longer projects: building a year-long workout plan or helping set up a new business
Turning a recipe you saved from an Instagram reel into a grocery list, then building a dinner party menu around it — including your friends' dietary restrictions from past get-togethers
These examples show what Muse is designed to handle, but they shouldn't all be read as universally available capabilities. Some are demonstrations of what Meta says the system can do, while actual availability depends on the connected service, permissions you've granted, rollout status, and the specific task.
What separates this from a regular chatbot is that it doesn't simply stop when the conversation ends. Give it a goal, and it can build a plan, keep working on it in the background, and come back to you when it needs a decision — like approving an email before it actually gets sent, or confirming a purchase.
It also remembers things you've mentioned previously, which is how it can make suggestions based on your past conversations rather than treating every interaction as a blank slate.
The Limitations You Should Know
Muse sounds much more autonomous than a traditional chatbot, but it's not an unrestricted digital employee.
Its ability to act depends on the services it can connect to and the permissions you've granted. A task that looks simple in a demo may require a particular integration, additional approval, or user input before Muse can complete it.
There's also a difference between planning an action and being allowed to execute it. Muse can work through a multi-step goal, but sensitive actions can still be blocked by its permission system or require confirmation from you.
And the demos don't tell us how reliably Muse will perform these tasks in the messy real world. Booking a flight in a controlled demonstration is one thing; handling a changed itinerary, an unexpected payment screen, a CAPTCHA, or a website that blocks automated agents is another.
That's important because many of the hardest problems with agentic AI aren't about whether a model can understand the task. They're about whether it can safely and reliably complete the task when the environment changes underneath it.
For now, the safest way to think about Muse is as an AI agent with meaningful autonomy, but bounded by integrations, permissions, and confirmation policies — not an AI that can freely operate everything on your behalf.
The Security Story: Secure VM and Sentinel
Handing an AI agent access to your email and payment services is a bigger ask than letting it answer trivia, and Meta clearly knows it. Its answer is something it calls Muse Secure VM — basically a dedicated, isolated computer in the cloud for each user, where your agent and your connected data both live.
The interesting part is a second system called Sentinel, which sits apart from Muse and checks everything trying to leave that virtual machine. Sentinel evaluates each action against the permissions you've configured. Depending on the action and its scope, it can allow it, block it, or pause and ask you for approval.
Because of this split, Meta says Muse itself never actually sees your raw passwords or card numbers — it can use saved credentials without having visibility into them. In a more technical write-up, Meta's research team described running the agent inside a restricted Linux container with limited system permissions, so that even if something goes wrong, the agent can't reach the more sensitive parts of the machine.
You can also set permissions per app you connect, opt your data out of training, and ask Meta to delete what's stored. Whether any of this holds up once outside security researchers start poking at it is genuinely an open question, and Meta's own team has pointed to a recent incident — an open-source agent reportedly deleting a Meta employee's files after being given broad email access — as the exact kind of failure they're trying to design around.
Meta is also putting Muse under external scrutiny through a public bug bounty, with rewards of up to $300,000 for serious security vulnerabilities. That includes substantial payouts for successful prompt-injection attacks that cause harmful actions.
Price and Availability
Muse comes in three tiers:
A free tier, which Meta's AI chief Alexandr Wang says should cover most people's needs
$20 a month for heavier use
$100 a month for the top tier
Right now it's US-only. It's available through dedicated iOS and Android apps, on the web at muse.ai, or through WhatsApp.
Where This Fits in the Bigger Picture
Meta has said Muse takes inspiration from OpenClaw, the open-source agent project that's been circulating this year. It's also arriving right as OpenAI, Apple, and xAI are all racing toward the same idea: an assistant that acts on your behalf instead of just chatting.
This is personal for Mark Zuckerberg too. He's talked about agents like this as Meta's next big platform shift, and Muse is one of the first major consumer products to emerge from Alexandr Wang's tenure since Meta poured $14 billion into his old startup, Scale AI, to bring him on board.
The Trust Problem
This is really the whole story, and TechCrunch's take on launch day put it well: Meta is asking people to connect an AI agent to categories of data — health, payments, home security — that go well beyond anything social media ever touched, right as the company is trying to rebuild trust after its legal settlement.
Some services aren't waiting to find out how it goes. As Axios reported, Resy, the restaurant booking platform, has already said it'll delete accounts caught using automated booking agents, which gives you a sense of the friction agentic AI is about to run into across the web.
That's an important part of the bigger picture. An AI agent doesn't operate in a vacuum. It has to deal with websites, apps, payment systems, anti-bot measures, and companies that may simply decide they don't want automated agents interacting with their services.
Worth Watching
Muse is a genuinely ambitious piece of engineering: a dedicated secure machine per user, a separate watchdog checking every outbound action, and a model built specifically for long, messy, real-world tasks.
But the real test hasn't happened yet.
The interesting question isn't whether Meta can make an AI agent book a flight in a demonstration. It's whether that agent can reliably handle the unpredictable parts of everyday digital life without making mistakes — and whether people are willing to give Meta enough access for it to be useful in the first place.
Whether Muse actually catches on probably won't come down to the tech alone. It'll come down to whether people are willing to give Meta this much access to their daily lives, whether websites allow agents to operate on their behalf, and whether the security promises survive contact with the researchers who are about to start testing them.
Comments (0)
Login to post a comment.