Meta is rolling out Muse today for iOS and Android users within a dedicated Muse app, alongside the website Muse.ai. The company also states that users can directly message Muse on WhatsApp to interact with the agent. Furthermore, users equipped with Meta AI glasses will soon gain the ability to interact with the Muse agent as well. Meta notes that individuals can test Muse for free, though those seeking to automate extensive digital workflows will require one of the company's dedicated AI subscription plans.
Muse represents Meta's latest push to challenge viral AI agents like OpenClaw and Instinct, which users can message to automate routine digital tasks. The agent is a direct product of Meta Superintelligence Labs, the artificial intelligence unit formed roughly a year ago by CEO Mark Zuckerberg to close the gap with OpenAI and Anthropic, offering select researchers lucrative compensation packages to join. The division was founded on the premise that AI agents will fundamentally transform how everyday consumers navigate the internet as well as Meta's own product ecosystem.
Meta previously tested Muse internally under the codename Hatch, where employees utilized it to autonomously run third-party applications and browse the web on their behalf. Meta claims in an official blog post that anyone can adopt Muse immediately out of the box, noting that the product was meticulously engineered to eliminate any learning curve. The company explains that users can issue natural language prompts, allowing the agent to independently dispatch emails, secure travel bookings, or even assist in selling a vehicle.
Beyond communication, Muse possesses the capability to execute financial transactions on behalf of users, checking out securely via specialized payment infrastructure designed by Stripe. This payment utility, known by Stripe as Link, issues single-use card numbers to prevent agents from exposing an individual's real financial credentials across the broader internet. Meta highlights that Muse is the initial AI agent covered under Link's dedicated purchase protections for agents, guaranteeing fee-free returns.
Although Meta is entering the personal agent space relatively late, the company is striving to set itself apart by centering Muse around robust security and privacy mechanisms. The agent debuts with an underlying architecture dubbed Secure VM, designed to isolate each individual user's activity within a virtual machine. This segregation ensures that untrusted web data and third-party integrations remain strictly separated from the core components of the agent capable of taking autonomous actions.
Deploying a personal AI agent demands immense user trust, an area where Meta has faced significant scrutiny over the years. To encourage users to trial Muse and integrate the agent with their personal third-party applications and services, Meta is attempting to convince the public that it can responsibly steward their personal data.
David Singleton, Meta Superintelligence Lab's vice president of engineering for consumer products, emphasizes the deliberate design approach. He notes that building a product with access to sensitive personal data requires profound responsibility, explaining that the system features a monitor called the Sentinel which inspects outgoing data from the virtual machine, matching it against established user permissions or prompting human approval.
Singleton points out that these human check-in prompts are delivered directly to the user without filtering through the underlying model, thereby guarding against prompt injection attacks. While Secure VM is engineered to safeguard user privacy, it does not function as an absolute locked box. Singleton acknowledges that while Meta's internal policies bar the company from accessing user Muse data, the technical capability remains present, though users retain the option to opt out of data training.
The architectural foundation of Secure VM establishes a notable industry benchmark for AI agents. Moving forward, Meta plans to introduce a Confidential VM variant, structured so that each virtual machine executes within a trusted execution environment while users independently manage their local access keys. This configuration ensures that no external entity, including Meta, can breach a user's agent virtual machine.
The development of Confidential VM stems from Meta's collaboration with Moxie Marlinspike, the creator of the end-to-end encrypted messaging service Signal, who also spearheaded the privacy-oriented AI platform Confer. Meta has provided select security firms with access to the Confidential VM source code for rigorous auditing and verification. Additionally, Meta will publish the Confidential VM binaries and a transparency log, empowering users to independently verify the integrity of their connection.
Singleton underscores that Muse Secure VM has undergone extensive vetting, including rigorous evaluations by Meta's internal human and agentic red teams, alongside a private bug bounty program. Meta is now expanding the scope of its public bug bounty to encompass Muse, offering payouts of up to $300,000 for verified vulnerabilities, including up to $130,000 specifically allocated for successful prompt injection exploits impacting a single user.
