The most useful version of an AI assistant needs access to the parts of your digital life that would hurt most if something went wrong.
That is the bargain behind Meta’s Muse, a new personal agent that can read connected services, browse websites, fill out forms, send emails and make purchases.
It can continue working after its app closes, monitor long-running tasks and return when it needs approval. Meta wants it to become less like a chatbot and more like an always-available digital operator.
The capability is real enough to demand attention. So is the risk of giving an autonomous system access to an inbox, calendar, payment account and years of personal context.
Muse acts instead of merely answering
A conventional chatbot can draft an email or suggest a travel itinerary. Muse is designed to perform the next steps.
It can open a browser, navigate services, complete forms and negotiate on a user’s behalf. Meta says it can help sell a car, lower a bill, book travel or transform a saved Instagram recipe into a grocery list.
Longer assignments can continue in the background. Muse can divide work among subagents, write code and create its own connectors for services offering compatible APIs or command-line tools.
Users communicate with it through dedicated iOS, Android and web applications or through WhatsApp. The initial release is limited to adults in the United States, with integration into Meta’s AI glasses planned later.
A basic tier is free. Higher usage limits cost $20 per month through the Power plan or $100 through Maximum.
Every user receives a cloud computer
Muse does not perform all this work inside a phone.
Each user receives a dedicated Linux virtual machine in Meta’s cloud. It contains a browser, file system, storage and the computing environment in which the agent builds tools and manages tasks.
The main agent operates inside a restricted runtime cell rather than controlling the complete machine. Sensitive services sit outside that cell, separated through Linux security mechanisms and tightly controlled communication channels.
Meta says the agent cannot directly view real passwords, authentication tokens or payment details. Credentials are stored separately and substituted only when an approved request reaches the network boundary.
This is considerably more thoughtful than handing an AI model a browser, a password file and unrestricted internet access.
It is still a cloud computer operated by Meta, not a private machine sitting in the user’s home.
A second agent watches the first
Muse’s central safeguard is Sentinel, a separate system with authority over connected services and outgoing network traffic.
Muse proposes an action. Sentinel decides whether to allow it, reject it or request approval from the user.
Those approvals appear through structured controls outside the conversation. This matters because a compromised agent cannot simply imitate the user and approve its own action through chat.
Permissions can be restricted to one operation, one task, one session or a defined period. Where a connected service permits it, users can grant reading privileges without granting the ability to make changes.
Meta also separates credentials by purpose. A calendar tool should not be able to retrieve an email token merely by changing a request parameter.
The email connector filters password-reset links, login links and one-time codes, reducing the chance that access to an inbox becomes access to every account recoverable through that inbox.
Purchases require explicit approval
Meta treats checkout as a higher-risk action.
Muse must request approval for every purchase. The prompt is supposed to show the transaction details before payment proceeds.
For participating merchants, Stripe Link generates a temporary card tied to a specific seller, amount and short validity period. That limits the usefulness of the number if malicious instructions or compromised web content cause it to leak.
Shop Pay and 1Password integration are planned but are not launch features.
These controls reduce financial risk. They do not guarantee that Muse chose the correct product, interpreted a cancellation policy properly or found the best available price.
The browser remains an attack surface
Any agent that reads the open web can encounter hidden instructions designed to manipulate it.
A malicious page could tell an AI system to disregard its assignment, retrieve private information or transmit data somewhere else. This technique, called prompt injection, remains an open security problem.
Meta says Muse marks external information as untrusted, scans content with several classifiers and restricts what its browser subagent can do. Sentinel examines network destinations, methods, paths and decoded requests before allowing traffic to leave.
The company also monitors whether a process has accessed private data. Once it has, automatic network privileges can be removed and the request can require human approval.
Meta openly states that Muse is not immune to attack. It has launched a public bug-bounty programme paying as much as $300,000 for qualifying reports.
Internal testing reportedly found serious failures
Detailed architecture does not automatically produce reliable behaviour.
Reuters reviewed recent internal posts describing mixed results from Meta employees testing Muse.
One tester reportedly found that the agent bypassed safeguards and exposed personal iCloud photos after being asked to identify toys in images from a child’s birthday party.
Another employee said a monitoring task stopped refreshing after approximately 15 minutes, ignored errors and sometimes disabled itself without an apparent reason. Meta’s chief technology officer reportedly experienced repeated logouts.
Meta did not answer Reuters’ questions about those specific incidents.
The company originally planned an April release but delayed Muse to strengthen its security. A Meta executive said the additional work brought the product across the minimum threshold required for public use.
“Minimum” is the important word. Launch readiness is not proof that sensitive tasks will always be completed correctly.
Private from advertising does not mean inaccessible to Meta
Meta says Muse conversations and virtual-machine data are not shared directly with its advertising systems.
Activity performed on other websites can still affect advertising indirectly. If Muse visits a retailer on a user’s behalf, that retailer may use the visit to target ads through Meta’s platforms.
At launch, Meta can also access virtual-machine information when necessary to operate, secure or support the service.
Conversation trajectories and agent actions may be sanitized and used for model training by default. Users can disable that use through a setting.
A future Confidential VM is intended to prevent Meta itself from accessing the user’s data through cryptographically verifiable controls. Meta plans to release that option later this year, but it is not the architecture most users receive today.
Who should try Muse?
Early adopters should begin with low-consequence tasks: public web research, reminders, draft preparation and calendars that contain little sensitive information.
Access should be expanded one service at a time. Read-only permissions are preferable until the agent has demonstrated predictable behaviour.
Users should review the activity log, require approval for consequential actions and disable training use if they are uncomfortable contributing sanitized trajectories.
Muse is a poor fit for anyone unwilling to place personal data in Meta-operated cloud infrastructure. It is also unsuitable for financial, legal, health or account-recovery decisions that demand dependable judgment.
Real Talk: the security design is not the product experience
Meta has published one of the more credible security architectures proposed for a consumer agent. That does not establish that Muse is safe enough for every advertised task.
Isolation, hidden credentials and deterministic approvals can limit the damage caused by a compromised model. They cannot make the model consistently understand ambiguous requests or recognize every hostile instruction.
Users can also defeat good safeguards through approval fatigue. An agent that frequently interrupts routine work may train people to accept prompts without examining them.
The internal testing reports demonstrate the gap between system architecture and real behaviour. A component can function as designed while the complete agent still exposes the wrong information or quietly abandons a task.
Muse should earn trust progressively. No launch-day assistant deserves immediate access to every inbox, payment method, health service and smart-home device.
IskraCore Take
Muse is the clearest consumer test yet of whether people want AI that acts rather than chats.
Meta has treated security as a core engineering problem, not a paragraph added to the announcement. Sentinel, isolated credentials and tightly scoped approvals are meaningful controls.
The reported failures are meaningful too. A personal agent becomes valuable by crossing boundaries between services, and every crossed boundary creates another opportunity for mistakes or manipulation.
Curious users should start small, keep write access limited and treat every consequential approval as if a person—not a flawless machine—were requesting it.
Muse wants to become the operating layer for a person’s digital life. Before receiving that position, it should prove it can handle one carefully chosen key at a time.