Meta’s newest AI product does not want another tab in your browser. It wants the keys to the browser itself.
Launched in the United States on September 8, Meta Muse is a personal AI agent that can keep working after you close the app. It can browse websites, fill in forms, send emails, book travel, make purchases and connect information from services such as email, calendars and Instagram. You can message it through the Muse app, muse.ai or WhatsApp, and Meta says support for AI glasses is coming.
Those features make Muse easy to describe as Meta’s answer to ChatGPT Agent or Gemini. But that comparison misses the more consequential part of the launch.
Muse is not primarily a bet that Meta has built the smartest model. It is a bet that millions of people will trust Meta with enough context and authority to act as them online.
A Chatbot Gives Advice. Muse Creates Consequences.
A conventional chatbot can write a cancellation email. Muse can open the provider’s website and cancel the subscription. A chatbot can suggest flights. Muse can complete the booking. A chatbot waits for your next message. Muse can continue a project in the background and return when it needs a decision.
This difference sounds small in a product demo and enormous in a failure report.
If a chatbot recommends the wrong hotel, you can ignore the answer. If an agent books the wrong hotel, someone must reverse a transaction, recover the money and repair the schedule. The unit of quality is no longer a convincing response. It is a correct, authorized and recoverable outcome.
Meta understands this distinction. Its Muse launch spends unusually little time on benchmark scores and a great deal of time on isolation, credentials, approvals and audit trails. That is the right emphasis, because personal agents will not win by sounding slightly more intelligent. They will win by making real actions feel boringly safe.
The Product Has Three Actors, Not One
The name “Muse” makes the system sound like a single assistant. The architecture described by Meta is closer to a small organization with separated responsibilities.
Muse is the worker. Powered by Muse Spark, it interprets a goal, plans the steps, uses connected services and decides what it wants to do next.
Muse Secure VM is the workplace. Each agent runs in a persistent, dedicated cloud computer with its own browser. Connected data and credentials live inside that environment rather than in one shared browser session used by many agents.
Sentinel is the gatekeeper. Meta says a separate agent runs on the same machine but is isolated from Muse at the system level. An outbound action must pass through Sentinel before it reaches the internet, and sensitive actions can be escalated to the user for approval.
That separation is more important than the branding suggests. Asking the same model to plan an action and judge whether that action is safe creates a conflict of interest. The model is rewarded for completing the task; the safety check may tell it to stop. By placing a separate component between Muse and the internet, Meta is trying to make the control boundary architectural rather than conversational.
It is a promising design. It is not proof that the design cannot fail.
A Sentinel can approve the wrong destination. A permission screen can summarize an action too vaguely. A website can inject instructions that change what Muse does after the user has approved the plan. A long-running task can begin within scope and gradually drift outside it. The meaningful metrics will be false approvals, missed prompt injections, stale permissions and the percentage of harmful actions stopped before execution—not how reassuring the approval dialog looks in a launch video.
“Muse Cannot See Your Password” Is Only the First Question
Meta says Muse cannot view passwords or payment details. Credentials are placed in secure storage, and the agent can use them without reading the raw secrets. Payments through Stripe’s Link use one-time card numbers, keeping the actual card number away from both the agent and the merchant. Muse also asks before actions such as sending an email or making a purchase and provides an audit trail of completed and planned work.
These are sensible controls. They address secret theft and unauthorized transactions, two obvious risks of browser agents.
But a personal agent creates a second category of risk that encryption alone cannot solve: legitimate access used in an unexpected way.
Muse does not need to know your Gmail password if it already has permission to read your inbox. It does not need your card number if it is authorized to spend through a payment provider. The central privacy question is therefore not “Can the model see my password?” It is “What can the system infer, combine and do with the access I granted?”
Meta says Muse conversations and VM data are not shared with its advertising systems. Users can disconnect services, tell Muse to forget information and opt out of having interactions used to improve Meta’s AI models. A future Muse Confidential VM is supposed to encrypt the entire environment with a user-held key so that even Meta cannot access its contents.
The word “future” matters. The Confidential VM is not the same as the current Secure VM, and an opt-out control is not the same as data being excluded by default. Meta’s supplemental terms say content from Muse and connected services may be used to provide, maintain, secure and improve the product, and interactions may be used to improve AI at Meta unless the user opts out in Data Controls.
That does not automatically make Muse unsafe. It does mean users should evaluate the shipped policy, not the privacy architecture promised for a later release.
Meta’s Biggest Advantage Is Not Muse Spark
The most powerful line in Meta’s announcement may be the least technical: people can talk to Muse directly in WhatsApp.
Personal agents face a distribution problem. To become useful, they need frequent interaction, persistent context and connections to services people already use. Most new AI products must persuade users to install another app, develop a new habit and manually rebuild their context.
Meta already owns the habit.
WhatsApp provides a familiar conversation surface. Instagram can provide interests and saved content. Meta’s apps already sit near friends, creators, businesses and customer conversations. AI glasses could eventually give Muse a visual and voice interface throughout the day. No single integration guarantees success, but together they give Meta a shorter path from “assistant I occasionally open” to “agent that knows what I am trying to do.”
This is an inference from Meta’s product design, not a capability claim: Muse’s moat may be context acquisition, not model intelligence.
That advantage also raises the stakes. The company best positioned to make a personal agent convenient may be the company users scrutinize most closely when asked for deeper access. Meta must overcome not only technical agent failures, but years of accumulated skepticism about how large platforms handle personal data.
The Terms Put the Steering Wheel Back in Your Hands
The product page presents Muse as an agent that works on your behalf. The legal terms draw a sharper boundary around that phrase.
Users are responsible for deciding which connected services receive data, configuring their permissions and understanding third-party policies. They are also responsible for artifacts Muse creates or publishes at their direction, even when they did not inspect those artifacts. The terms require meaningful human oversight and state that Muse does not create a fiduciary or legal agency relationship with the user.
In plain English: Muse may act for you, but Meta does not become legally responsible as your agent.
This gap is not unique to Meta. It is the emerging contract of consumer agentic AI: the product sells delegated action while the user retains much of the accountability for the result. The more autonomous the interface feels, the easier it becomes to forget that distinction.
For developers, this is a useful product lesson. “Human approval” cannot mean showing a confirmation button after the system has hidden all the relevant context. A meaningful approval should identify the exact action, destination, data being shared, financial amount and whether the permission applies once or permanently. It should also make reversal as easy to find as approval.
How I Would Start Using Muse
I would not begin by connecting email, calendar, payments, Instagram and cloud storage at once. That would make it impossible to understand which access produced which behavior.
I would start with one reversible task and one read-only connection: monitor a public price, summarize a calendar or research a trip without booking it. I would examine the audit trail, interrupt the task halfway through and see whether the agent stops cleanly. Then I would connect a low-risk account with “ask every time” enabled for external actions.
Only after observing several complete cycles would I allow Muse to send or buy anything. Permanent approval would be the final step, not the default convenience setting.
This gradual approach may sound cautious for a consumer product marketed as effortless. But trust in an agent is not a checkbox. It is an evidence trail built from small tasks that behaved exactly as expected—including when something went wrong.
The Personal-Agent Race Has Moved Beyond the Model
Meta Muse marks a change in the AI market. The competition is no longer limited to which company produces the best answer. Companies are now competing to become the trusted execution layer between a person and the internet.
That layer needs a capable model, but it also needs an isolated computer, protected credentials, understandable permissions, payment safeguards, recoverable actions and distribution. Meta has assembled all of those pieces into one consumer product and placed it inside a messaging habit used at global scale.
The unanswered question is not whether Muse can send an email. It is whether people will let it read enough of their lives to know which email should be sent—and trust it enough to press Send.
If Muse succeeds, Meta will own more than another AI assistant. It could become the interface through which users delegate parts of their digital lives.
That is why the most important Muse benchmark will never fit neatly on a model card.
It is the amount of trust users are willing to grant, one permission at a time.