Meta released Muse today, a personal AI agent that ships in a standalone iOS and Android app, on Muse.ai, and as a chat partner inside WhatsApp, with the company's AI glasses to follow. Free access is framed as a trial; anyone automating digital work at volume will need one of Meta's paid AI plans. The agent takes natural-language instructions and acts on them — sending email, booking trips, even helping sell a car on the owner's behalf. But the centrepiece of the launch is not the task list. It is the box the tasks run in, and the price Meta has put on breaking it: up to $300,000.
Muse comes out of Meta Superintelligence Labs, the division Mark Zuckerberg stood up roughly a year ago to close the gap with OpenAI and Anthropic, and which recruited by writing very large compensation packages. It was founded on a bet that AI agents would change how ordinary people use the internet and Meta's own products. WIRED previously reported that the company tested Muse internally under the codename Hatch, with employees letting it work through third-party apps and browse sites in their name.
The competitive frame is OpenClaw and Instinct — agents users already chat with and hand actions inside digital services. Meta is late to that fight, and the lateness is visible in how it is selling. Instead of leading on capability, it leads on containment.
Every Muse user, free or paid, runs on an architecture Meta calls Secure VM. Each person's agent activity is isolated in its own virtual machine, which separates untrusted material pulled in from the web and connected services from the part of the agent allowed to take actions. Inside that VM sits a component called Sentinel, which inspects everything leaving the machine. It either matches an outbound action against a policy the user or the system has already approved, or it raises a confirmation dialog. David Singleton, vice president of engineering for consumer products at Meta Superintelligence Labs, said the system was designed from the start around access to a large number of personal data sources.
The detail that matters in that design is where the confirmation goes. Those checks reach the user directly and do not pass through the model, which is what makes them a defence against prompt injection rather than another surface for it. An agent that can be talked into fabricating its own approval prompt is not protected by having approval prompts.
Purchases run through Stripe's Link infrastructure, which issues a single-use card number so the agent never types the user's real payment details into an arbitrary website. Meta says Muse is the first AI agent covered by Link's guarantees for purchases made by agents, which include returns without a fee.
Then comes the admission that undercuts the pitch. Secure VM is built to protect data and privacy, but it is not a fully closed container. Meta's policy forbids the company from reaching Muse user data — while technically that access remains possible. Users can separately refuse to have their data used for model training.
The version where the guarantee is technical rather than contractual is called Confidential VM, and it is a future mode. In it, each virtual machine would run inside a trusted execution environment and the user would hold the access keys on their own device, shutting everyone else out, Meta included. It is being built with Moxie Marlinspike, who created the end-to-end encrypted messenger Signal and more recently the privacy-oriented AI platform Confer. WIRED reviewed a preliminary technical document describing it: alongside user-held keys, Meta says it will give certain security companies the Confidential VM source code so they can audit it regularly and confirm the stated guarantees, and will publish the binaries — the machine-readable instruction files — plus a transparency log, so users can verify the validity and integrity of their connection to Muse.
That is a genuinely serious architecture, and the serious part has not shipped. What launched today protects users from Meta by policy. What would protect them by construction is a roadmap item with a named collaborator and no date. This is the oldest asymmetry in privacy engineering: the promise arrives with the product, the proof arrives later, and adoption is decided in between. Meta knows this, which is presumably why Marlinspike's name and the audit programme are in the launch material at all — borrowed credibility covering the interval until the real thing exists.
The bounty numbers read the same way, as a price list rather than a reassurance. Singleton says Secure VM has already been through extensive testing by Meta's own offensive security people, its teams that attack AI agents, and a private bug bounty. Muse now joins the public programme, paying up to $300,000 for confirmed issues and up to $130,000 for a successful prompt-injection attack affecting a single user. A six-figure payout for compromising one user is not a routine number. It is Meta pricing the attack it most expects, on the component it most wants to be believed about.
Notably absent from the announcement: which security companies get the Confidential VM source, on what terms, and whether their findings will be published or merely delivered to Meta. Also absent is any timeline. Until those two things are filled in, the honest description of Muse's privacy story is that the strongest claim in it is an intention, and that a user handing the agent their email, their calendar and their card today is trusting a Meta policy — the exact instrument whose durability has been the question about Meta for a decade.