Meta on Tuesday launched Muse, a personal AI agent that can send emails, book travel, make purchases, and negotiate on a user's behalf — all running inside a dedicated virtual machine in the cloud. It is available now on iOS, Android, and the website Muse.ai, and can also be reached directly through WhatsApp. Support for Meta's AI glasses is coming 'soon,' the company said.
Here's the thing. Muse is not just a chatbot with a to-do list. It connects to third-party services including Google Workspace, Ticketmaster, OpenTable, Spotify, and Apple Health. It can browse the web, fill out forms, build grocery lists from saved Instagram recipe videos, and complete purchases using a Stripe payment tool called Link, which issues single-use card numbers so the agent never enters a user's real financial credentials across the internet. Meta says Muse is the first AI agent covered by Link's purchase protections, which guarantee no-fee returns.
The agent runs on what Meta calls Secure VM — a virtual machine architecture that isolates each user's activity and keeps untrusted web data separate from the part of the agent that can actually take action. A component called the Sentinel monitors everything leaving the VM and either matches it against an existing permission policy or surfaces a human-in-the-loop prompt for user approval. Singleton, Meta Superintelligence Labs' VP of engineering for consumer products, says those prompts go directly to the user and are not filtered through the model — a specific defense against prompt injection attacks.
Meta is also offering bug bounty payouts up to $300,000 for valid vulnerability findings, including up to $130,000 for successful prompt injection attacks affecting a single user.
Later this year, Meta plans to ship Muse Confidential VM, developed with Moxie Marlinspike, creator of Signal. In that configuration, each VM runs in a trusted execution environment, users hold their own access keys locally, and Meta says even it cannot access the data. The company will publish Confidential VM binaries and a transparency log so users can independently verify their connection.
Vishal Shah, Meta's VP of AI Products, said the company delayed an earlier April release to clear minimum thresholds for safety, security, privacy, and model performance. 'It is impossible to say that there is never going to be a mistake,' Shah said, 'but every single part of the architecture has been designed to make this as safe, as secure, as private as we can possibly make it.' Meta also acknowledged in a blog post that 'Muse can and will still make mistakes.'
On training data: users can opt out of having their Muse interactions used to train future models. Meta says it will not share Muse conversation details with its advertising systems, though it acknowledged some interactions — like shopping — could 'indirectly' influence the ads people see.
The demo is not the product, and the changelog on Meta's privacy record is long. Secure VM is a legitimately novel architectural choice, and Confidential VM, if it ships as described, would set a meaningful industry standard. But the free-market case for Muse depends entirely on whether users can verify those guarantees independently — which is exactly why the transparency log and third-party audits matter more than the press release. Competition from OpenClaw and others gives users leverage. Use it.
