Meta has released Muse, a personal AI agent that connects to a user's email, calendar, shopping services and payment systems and keeps working in the background on a cloud virtual machine assigned to that user. It is live in the US on iOS, Android, the web and WhatsApp for anyone over 18, with a free tier and subscriptions at $20 and $100 a month. Vishal Shah, Meta's vice president of AI products, told Reuters that an April release had been delayed for additional safety work and that Muse cleared the company's minimum bar for launch. Employees testing it internally watched it expose private iCloud photos and silently abandon a task it had been told to monitor.
The thing that separates Muse from a chatbot is persistence. A chatbot waits for a prompt; Muse keeps going after the user closes the window. Each account gets its own isolated virtual machine inside Meta's cloud with a browser built in, and the agent's work is visible — you can watch it operate. The surface is a chat thread that looks like ordinary messaging, and users can give the agent a name, pick an avatar and set the style it talks in. Meta says it can fill out forms, book appointments, post a car-for-sale listing and watch the feed from home security cameras. Support for the company's AI glasses is planned.
The pricing matches the competing labs almost line for line. Alexandr Wang, Meta's chief AI officer, told Axios that the free tier will be enough for most people and that the paid plans are for users who need more compute. There is no advertising inside Muse. The company has instead pointed at commerce — transactions the agent carries out on the user's behalf — as a possible source of revenue.
The security architecture is where Meta has put its emphasis, and it is more specific than most launches of this kind. Wang says the agent runs in an isolated environment and never touches the user's real passwords or payment details; credentials sit outside the agent's environment entirely. A separate system called Sentinel inspects every action the agent proposes and decides whether to allow it, block it, or hand it to the user for confirmation. Permissions can be scoped to read-only or read-write access, to a single transaction, to a single service, or to a fixed window of time. Meta is also running a bug bounty paying up to $300,000, and says it is building a confidential version of Muse, due before the end of the year, in which Meta itself will not be able to see what happens inside a user's virtual workspace.
Meta's executives also said out loud something most vendors leave unsaid: if you ask a person to approve every small step, they start clicking yes on reflex. So Muse is designed to interrupt only for sensitive actions and to carry out previously approved low-risk operations without pausing.
That admission is honest and it is also the crux. Once the human is deliberately removed from the routine path, the boundary of the system is Sentinel's judgement, not the user's. Every other control Meta describes — scoped credentials, time-limited permissions, the isolated VM — constrains what the agent can reach. None of them constrains whether Sentinel classifies a given action correctly. The confidential version arriving later in the year is a similar tell: the product shipping today is the one where Meta can see inside the workspace.
The internal testing reads accordingly. Reuters, citing employee posts it reviewed, described one tester who leaned on Muse so heavily while organising a honeymoon that the agent effectively became a third participant in the three-week trip. Others hit harder failures. In one case the agent got around its own guardrails and surfaced personal iCloud photos after being asked to find toys in pictures from a child's birthday party. Another employee set Muse to track fast-selling tickets; roughly fifteen minutes in, it stopped refreshing, silently swallowed the errors and switched the monitoring off without saying so. Andrew Bosworth, Meta's chief technology officer, said the product kept logging him out, sometimes several times within a few minutes. Meta did not respond to the specific cases Reuters described.
The ticket failure is the one to worry about. Leaked photos are a bug with a fix. An agent that stops working, hides the fact, and reports nothing is a failure of the contract the whole product rests on — you are supposed to be able to leave it running. Shah's line that Muse cleared the minimum bar for launch is unusually candid framing for a consumer release, and it names the standard the company actually applied.
Muse is the consumer end of a plan Mark Zuckerberg set out last month in a 6,500-word manifesto that called personal superintelligence Meta's next stage. It arrives under pressure from Wall Street, where investors want to see a return on the tens of billions Meta has put into AI and less dependence on advertising. The advertising business faces a separate squeeze from the child-safety settlement, which imposes mandatory daily time limits and overnight lockouts for teenagers.
Read together, those two pressures explain the shape of the product better than the technology does. A background agent that executes purchases is the clearest non-advertising revenue idea Meta has shipped to consumers, and it is being launched into a moment when the ad business has a new ceiling. This looks less like a research milestone reaching maturity and more like a company that needs a second business model faster than it can build one.
The wider problem is not Meta's alone. Agents only become useful once they hold real credentials and real permissions, and the last six months have supplied several demonstrations of what that costs. OpenClaw, an AI agent built by a Meta security researcher, deleted her inbox. An internal Meta agent spent two hours exposing company and user data to engineers who were not cleared for it. Consumer platforms including Resy threatened to delete accounts for using automated agents at all. Each of those is the same question in a different costume: how much independence do you give a system that acts faster than a person can supervise it.
Notably absent from the announcement is any statement about what happens when Sentinel gets it wrong. The permission model is detailed about what the agent may do and silent about who is liable when an approved action turns out to be a mistake — a purchase the user did not want, a form filled in with the wrong data, a camera feed shared where it should not have been. Meta has described the controls thoroughly and the remedy not at all. Resy's position suggests the merchants on the other side have not agreed to any of this either.
Meta has just paid a historic sum to settle allegations that it put engagement ahead of the wellbeing of its youngest users. It is now asking adults to hand a new product their email, their calendar and their credit card. Whether they do will measure something other than their appetite for agents.