Meta Launches Muse, a Personal AI Agent That Can Send Email, Book Travel and Make Purchases
Meta has launched Muse in the U.S., a personal AI agent that can work across apps, browse the web, send email, book travel and make purchases with user approvals.
Summary
Meta launched Muse on September 8, 2026, pushing its consumer AI strategy beyond chat into delegated action. Meta says Muse can work across connected services, browse the web, fill forms, send email, book travel, negotiate on a user's behalf and complete purchases. It can keep working after the app closes and return when it needs approval.
Muse is rolling out in the United States on iOS, Android and muse.ai, with WhatsApp access and support for Meta AI glasses planned. Meta says it is free for most needs with subscriptions for heavier use. Reuters and the Financial Times report $20 and $100 monthly tiers, though Meta's launch post does not list those exact prices.
Quick Take
- Muse is an action-taking personal agent, not only a chatbot.
- A dedicated Muse Secure VM hosts the agent and its workspace, while a separate Sentinel checks outbound actions.
- Meta says sensitive actions require approval and real credentials are kept outside the agent runtime.
- Meta's own safety post says Muse can still make mistakes; Reuters reports earlier internal security and reliability problems before launch.
What changed
Muse is designed to stay active rather than wait for every new prompt. A user can assign a task or longer-term goal, and Muse can plan work, use tools and subagents, browse sites and continue in the background.
For consequential actions, Meta says the system returns control to the user. Sending an email or making a purchase can require approval. Stripe Link can provide one-time-use cards so the agent does not see a user's real card number. Shop Pay and 1Password support are planned.
Meta's technical safety post identifies Muse Spark 1.3 as the model used for browser work. Meta released Muse Spark 1.3 on September 2 for Muse Code and the Meta Model API.
Why the security architecture matters
The bigger story is the trust boundary around the model.
| Layer | Meta's design | Practical consequence |
|---|---|---|
| Secure VM | Dedicated cloud computer for each user's agent and workspace | Gives long-running tasks persistent state while limiting cross-user exposure |
| Runtime isolation | Separates the agent from more sensitive host services | Assumes the model can fail or be manipulated |
| Sentinel | Reviews network egress before it reaches the internet | Adds a policy gate the main agent cannot simply override |
| Credential handling | Real secrets stay outside the agent runtime | Reduces credential-theft risk from prompt injection |
| Human approval | Sensitive actions can require confirmation | Keeps users in the loop for higher-consequence steps |
This is a meaningful shift from treating agent safety as only a model-alignment problem. Meta is also treating network access, secrets and permissions as system-security problems.
What remains unproven
Meta is explicit that Muse can still make mistakes and has opened a bug bounty with rewards up to $300,000. Reuters reports that earlier internal testing exposed private data and inconsistent performance, and that an earlier launch was delayed while Meta strengthened the product.
There is also an important privacy distinction. Meta says Muse conversations and VM data are not shared with its ad systems. But Meta's safety documentation says the current architecture does not technically prevent Meta from accessing VM data when needed to operate, secure or support the service. A planned Confidential VM would encrypt the full environment with a user-held key.
Who should care
Consumers now have to decide whether delegated convenience is worth connecting an AI agent to email, calendars, accounts and payments. The utility ceiling is higher than for chat-only assistants, but so is the permission surface.
For developers and security teams, Muse is a notable reference architecture because it places deterministic controls around an autonomous model.
For Meta's rivals, the competitive layer is changing: persistent agents with memory, tools, approvals and distribution may matter as much as raw benchmark leadership.
What to watch next
The important launch metrics are real-world task completion, false actions, security disclosures, approval friction and user retention. Also watch for official paid-tier pricing, international rollout, the promised Confidential VM and how much functionality reaches Meta's glasses.
AI World Scope take
Muse qualifies as breaking news because Meta has turned its personal-superintelligence strategy into a shipping consumer product with real permissions and real actions.
The frontier is no longer only "which model gives the best answer." It is increasingly which company can safely earn permission to act.
Sources & Documentation
Sources used for this article, with source type and publisher shown where available.
- officialIntroducing Muse: The World’s First Personal AI Agent Built for EveryoneVisit Source
- officialHow We Built Safety Into MuseVisit Source
- officialIntroducing Muse Spark 1.3Visit Source
- newsMeta launches AI agent that can access other apps to send emails, make paymentsVisit Source
- newsMeta unveils AI personal assistant linked to WhatsApp and InstagramVisit Source