Meta gives every Muse user a cloud computer

Inside the Runtime Cell

According to Singleton, “Muse Secure VM” separates the workspace from sensitive system components. The Runtime Cell has its own root file system, isolated from the host system, and actions inside it are not restricted.

Meta says that even an attempt to inspect the environment will not give a user privileged access to its infrastructure or another user's data. The architecture is also designed to defend against prompt-injection attacks.

The boundary is not meant to be mysterious. Users can inspect:

The Library tab includes a built-in file manager. Users can also download their agent data through Settings > Data controls > Download your agent data.

That level of visibility is unusual for a consumer-facing agent. Meta is exposing the machinery behind Muse instead of presenting the cloud computer as a sealed service. My guess is that this is as much a trust decision as a security one: users are more likely to accept an agent with broad access if they can see where its work happens.

The product bet

Muse attracted more than 500,000 users in its first week and reached number one in the Apple App Store. At Meta Connect 2026, Meta added real-time video chats, separate email addresses, and the ability to control Mac applications.

Those additions make the product broader than a model demo:

Meta entered the AI race early with its Llama models, but failed to keep pace with the leading models from OpenAI and Anthropic. Muse is a different wager. Rather than competing primarily on model quality, Meta is putting the model inside a product with a wider surface area and a computer attached.

The announcement is quiet about the parts that would determine how durable that wager is: the limits of the cloud computer, its cost, and how much control Muse can exercise in practice. What it does show is a clear shift in emphasis. Meta may not have the best model, but it can still make the agent feel like the place where work gets done.