Meta has unveiled Muse, a personal AI agent designed to act on users' behalf rather than simply answer questions. The product, announced September 8, 2026, centers on a new infrastructure component: Muse Secure VM, a persistent, isolated Linux computer in the cloud with a full browser that both the user and their agent can access.
**How Muse works**
Most AI assistants today operate within a chat interface, generating text but unable to take concrete actions. Muse takes a different architectural approach. Each user gets their own dedicated virtual machine—Muse Secure VM—where the agent lives alongside the user's data and credentials. This VM contains a full browser, allowing Muse to navigate websites, fill out forms, click buttons, and complete multi-step tasks such as booking travel, sorting email, or building a fitness plan.
The messaging figure shows the conversational interface through which users interact with Muse on mobile and desktop, where the agent navigates a full browser and completes multi-step tasks like form filling, matching the description of Muse Secure VM and the mobile, Mac, and WhatsApp interfaces.
The agent is powered by Muse Spark, described as Meta's most capable model to date, built specifically for real-world agentic work. Users communicate with Muse through a mobile app, a Mac app, or directly within WhatsApp—interfaces designed to mirror ordinary messaging so there's no learning curve.
**Security architecture: the Sentinel model**
A distinctive feature of Muse's design is a separate "Sentinel" agent that runs on the same Secure VM but is kept apart from Muse at the system level. Nothing Muse does reaches the internet unless the Sentinel approves it. When Muse attempts a sensitive action—sending an email, making a purchase, or accessing a connected service—the Sentinel intercepts the request and asks the user for explicit permission. This creates a deterministic, code-level checkpoint that operates outside the language model's probabilistic outputs.
Meta also states that Muse never sees users' passwords or payment methods. Credentials shared with Muse go into secure storage the agent can use without reading. When shopping, Muse generates a one-time virtual card number at checkout through Link (built by Stripe), keeping the real card hidden from both the merchant and the agent. Eligible purchases carry Link's purchase protections—covering damage, loss, price drops, and no-fee returns—which Meta says is a first for AI agents.
The secure-storage figure visualizes the Sentinel architecture and credential handling described in the security section—an isolated vault, privacy shield, masked credentials, and the Stripe Link virtual card that keeps payment details hidden from both merchants and the agent itself.
**User control and privacy**
Users decide which apps Muse connects to (email, calendar, Instagram, and others) and granularly control what each connection permits—whether Muse can only read email or also send on their behalf. Access can be revoked at any time. A complete audit trail shows everything Muse has done and plans to do.
Meta states that conversations and VM data are not shared with its advertising systems. Users can opt out of having interactions used to train Meta's AI models, and can tell Muse to "forget" specific learned details.
**Proactive assistance and memory**
Muse retains context across conversations, enabling proactive suggestions. The announcement describes examples: turning a saved Instagram recipe reel into a grocery list, suggesting a dinner-party menu while remembering friends' dietary restrictions, or adjusting a training plan as the user's schedule shifts. For long-running tasks, Muse continues working after the user closes the app and returns when something changes or approval is needed.
**Pricing and availability**
According to a Reuters report cited in discussion around the launch, Muse will initially be available only in the United States. A basic version will be free, with subscriptions priced at $20 per month and $100 per month for heavier usage tiers.
**Future direction: Confidential VM**
Meta plans to introduce Muse Confidential VM later in 2026, where the entire virtual machine—including user data and conversations—is encrypted with a key only the user holds, meaning not even Meta could access the contents.
**Open questions**
The supplied sources do not specify the exact technical implementation of the Sentinel's deterministic checks, the model architecture behind Muse Spark, or independent benchmarks comparing Muse's task-completion reliability to other agent systems. The Reuters report notes internal concerns were raised about sensitive data management and potential guardrail bypasses, though the supplied primary sources do not detail these. Real-world performance across diverse tasks and the practical limits of the approval workflow remain to be seen as the product rolls out.