Meta Muse AI Agent: Tasks, Pricing and Platform Access

A chat thread attached to a computer that keeps working

Muse accepts requests in its own app or through WhatsApp, but its work happens on a persistent, dedicated Linux virtual machine in Meta's cloud. It can use built-in connectors for services such as email, call public APIs, or drive a browser when no connector exists. Meta says it can plan multi-step goals, fill forms, book travel, send email, negotiate, and continue working after the person closes the app. [1][3][2][4]

The persistent computer is the product distinction. A chatbot returns text; Muse retains files, memory, processes, and scheduled work in an environment it can revisit. Muse's VM retains credentials in isolated storage; the core agent cannot see them and instead receives surrogate tokens. That also enlarges the consequence of a bad instruction: a mistaken answer stays in a conversation, while a mistaken agent can send, buy, or change something. Meta's architecture is built around containing that second kind of failure rather than pretending the model will never make one. [1][3]

US adults first, with a card even on the free tier

Meta launched Muse in the United States for people 18 and older on iOS, Android, the web, and WhatsApp. TechCrunch reported that a payment card was required to start even though limited use was free. The launch subscriptions were Power at $20 per month and Maximum at $100 per month, both buying more usage rather than a different agent. Meta said support for its AI glasses, Shop Pay, and 1Password was still coming. [1][2][4]

Muse is powered by Muse Spark, the closed flagship model Meta introduced five months earlier. The September launch turned that model line from a research and developer story into a consumer service with recurring subscriptions and permissioned access to email, calendars, payments, and other personal systems. [1][2]

The agent, its credentials, and permission authority are separated

Inside each Muse Secure VM, the core agent and its tools run in a restricted container. Credential storage and connector workers sit outside that container, and the agent receives surrogate tokens rather than raw secrets. A separate host-side system called Sentinel is the sole permission authority for connector actions and network access: it can allow, deny, or send a request to the person for approval, then insert the real credential only at the network boundary. [3]

The browser agent receives an accessibility-tree view rather than the raw page DOM, cannot execute JavaScript in the page, and pauses while the person takes control or enters credentials. Meta says separate classifiers inspect pages, images, and downloads for prompt injection and unrelated personal-data egress. Purchases always require human approval, with Stripe Link issuing a merchant-, amount-, and time-limited card number. Meta opened a bug bounty paying up to $300,000 for demonstrated problems, including prompt injection. [3]

These are concrete isolation and authorization mechanisms, not merely a confirmation dialog around the same model. They are still Meta's account of the launch system. The public documentation does not supply independent penetration-test results or a prompt-injection success rate, and TechCrunch noted that the claims would require deeper investigation by security experts. [3][2]

The encrypted mode was not part of the launch

Muse Secure VM isolates one user's data from other users, but Meta says the launch version does not prevent its personnel from accessing data when necessary to support, secure, or operate the service. Limited data leaves the VM for inference and telemetry. Conversations, tool calls, and subagent handoffs are sanitized to remove key personally identifiable information and used for model training by default, with an opt-out in settings. [3]

Meta says Muse conversations and VM data do not feed its advertising systems, while noting that websites Muse visits can treat the browsing as the person's activity and later target ads through their own tracking. The promised Muse Confidential VM is a different system intended to use a user-held key to prevent even Meta from accessing the VM. On launch day it was limited to trusted testers, undergoing external review, and planned for later in 2026. [1][3]

Calling the launch VM dedicated and isolated is accurate; calling it end-to-end encrypted would move a future property backward into the September product. The useful privacy question is therefore not whether Muse has protections, but which party each protection constrains: other users, the agent process, connected services, Meta's ad systems, or Meta itself. At launch, the architecture addressed the first two directly and excluded Muse activity from Meta's ad systems, but connected services can still observe Muse acting on their sites and may use that activity for advertising. [3][2]