Meta launched Muse in the United States on September 8, 2026, pitching it as a personal AI agent that can move beyond answering questions and complete multi-step tasks. It can work through a web browser and connected services, continue after you close the app, and ask for approval before actions such as sending an email or making a purchase.
That convenience changes the risk calculation. A chatbot usually produces text for you to review; an agent may read private data, open websites, fill forms, or act through connected accounts. Muse includes notable technical safeguards, but Meta’s own App Store listing says it may be inaccurate or take unexpected actions. The safest starting point is narrow access, read-only permissions where possible, and explicit approval for every external action.
What is Meta Muse?
Meta Muse is a U.S.-only personal AI agent, launched on September 8, 2026, that can use connected apps and a browser to manage tasks such as email, scheduling, travel, shopping, and longer projects. It works on iOS, Android, the web, and through WhatsApp, while requesting approval for sensitive actions.
Meta says Muse is powered by its Muse Spark model and runs inside a dedicated cloud computer called Muse Secure VM. Unlike a conventional assistant that stops after providing advice, Muse can keep working in the background, notify you when something changes, and return when it needs a decision.
Meta Muse availability and pricing
| Item | Launch status checked September 12, 2026 |
|---|---|
| Region | Rolling out in the United States |
| Platforms | iOS, Android, muse.ai, and WhatsApp; Meta says AI glasses support is coming soon |
| Free access | Meta says most typical use is free, with a usage meter and paid options for more capacity |
| Paid plans | TechCrunch reported Power at $20 per month and Maximum at $100 per month at launch |
| iPhone requirement | The U.S. App Store listing requires iOS 18.0 or later and rates the app 18+ |
Prices and availability can change. Confirm the amount shown inside Muse before subscribing; do not rely on a launch-day article when a purchase screen presents different terms. Meta’s announcement did not publish the paid prices, so the table labels those figures as independently reported rather than first-party pricing.
What can Muse actually do?
Coordinate routine personal tasks
Meta and the App Store listing describe email management, calendar conflict resolution, restaurant reservations, reminders, travel booking, price tracking, subscription audits, shopping, and fitness planning. Muse can also use a browser when a service does not have a built-in connector.
Keep working in the background
A long-running task can continue after the app closes. That is useful for tracking a price drop or following up on a project, but it also means you should review active tasks and recurring permissions regularly. Cancel work you no longer need instead of assuming it has expired.
Connect information across services
Muse becomes more personalized as you connect email, calendars, Meta apps, health data, financial services, and other accounts. The benefit is context; the cost is a wider data footprint. The App Store privacy label says data linked to identity may include health and fitness, purchases, financial information, location, contacts, user content, search and browsing history, sensitive information, and diagnostics.
Act, not merely recommend
Muse can prepare or execute actions such as sending messages, filling forms, negotiating, booking, and buying. Meta says it asks for permission before sensitive actions and provides an audit trail. Treat that confirmation screen as the final safety boundary: inspect the recipient, amount, merchant, date, address, cancellation policy, and exact data being shared.
How Muse’s security architecture works
Meta’s technical design is more detailed than a generic promise that an agent is “secure.” It separates the task-running agent from credential storage and approval authority.
- Dedicated virtual machine: Each user gets a Muse Secure VM that stores connected data and credentials. The agent’s runtime is isolated from more sensitive host services.
- Sentinel approval layer: A separate host-side agent controls connector actions and network access. Muse proposes an action; Sentinel decides whether policy allows it, denies it, or asks you.
- Hidden credentials: Meta says the core model does not see real passwords, payment methods, or OAuth tokens. Separate services insert credentials at the network boundary.
- Scoped connectors: Where services support it, read and write permissions can be separated, and connector controls can be narrower than broad OAuth scopes.
- Audit and revocation: Users can inspect activity, change access, and disconnect a service.
These controls reduce risk; they do not make the agent infallible. Meta explicitly says Muse can make mistakes and encounter prompt injection in content it reads. Independent security review will matter because the architecture was described by the company that built it.
A safer Meta Muse setup checklist
- Start with one low-risk job. Try calendar conflict detection or price research before email sending, purchases, finances, or health decisions.
- Connect only the service needed. Do not link email, calendar, payments, health, and social accounts on day one simply because the options exist.
- Choose read-only access first. If Muse can complete the task by reading a calendar, do not grant permission to create or delete events.
- Review the privacy choices. Meta says users can opt out of having Muse interactions used to train its AI models and that Muse data is not shared with Meta’s advertising systems. Check the live settings rather than assuming a default.
- Keep credentials out of chat. Use the dedicated sign-in or connector flow. Never paste a password, recovery code, API key, or card number into a conversational message. ToolNexa’s strong-password guide explains how unique passwords and a password manager reduce account risk.
- Require confirmation for consequential actions. Preserve approval prompts for email sending, purchases, cancellations, bookings, financial changes, and public posts.
- Read the proposed action literally. Confirm the exact recipient, destination, date, price, quantity, and attached information before approving.
- Inspect the result outside Muse. Open the sent email, merchant receipt, calendar event, bank statement, or source website to verify what happened.
- Review the activity log. Look for unexpected websites, repeated attempts, or a task that continued beyond its intended scope.
- Revoke access after temporary projects. Disconnect a service when the trip, purchase, or project is over.
Three good first tasks—and three to avoid
Good first tasks
- Compare public prices and return a shortlist without making a purchase.
- Read a calendar and flag conflicts without editing events.
- Draft a travel plan while leaving all bookings unconfirmed.
High-risk first tasks
- Giving it full email write access before you understand its approval behavior.
- Allowing autonomous purchases, subscription cancellations, or financial transfers.
- Using generated health or fitness guidance as a substitute for qualified medical advice.
For developers, Muse is a consumer product rather than an agent-building API. ToolNexa’s OpenAI Agents API guide covers a different search intent: creating and controlling your own managed software agents.
Payments and purchase protections
Meta says Muse can check out using Link by Stripe, which creates a one-time-use card so the merchant does not receive the user’s real card number. Link’s support page says eligible purchases may receive protections for damage, loss or theft, no-fee returns, price drops, and refunds, subject to eligibility and limits.
Protection is not the same as automatic coverage. Before approval, inspect the merchant, final price, shipping destination, recurring-payment status, and Link’s current terms. Keep the receipt and the agent’s audit trail in case you need to dispute what occurred.
How to evaluate Muse during the first week
- Accuracy: Did it identify the correct email, event, item, or account?
- Scope: Did it do only what you asked, or expand the task?
- Approval quality: Did confirmation screens show enough detail for an informed choice?
- Recovery: Could you interrupt, correct, or undo a mistaken step?
- Data discipline: Did the job really require every connected source?
- Time saved: Was verification faster than doing the whole task manually?
If the agent saves little time after review, narrow the task or stop using it for that workflow. Convenience should be measured after verification, not before it.
Frequently asked questions
Is Meta Muse available outside the United States?
Meta’s launch announcement says Muse is rolling out in the United States. It did not provide a date for wider regional availability as of September 12, 2026.
Is Meta Muse free?
Meta says Muse is free for most typical use, with subscriptions for additional capacity. TechCrunch reported launch plans called Power at $20 per month and Maximum at $100 per month. Confirm current pricing in the app before paying.
Can Muse see my passwords or card number?
Meta says Muse’s core agent cannot see passwords or payment methods because credentials are stored separately and inserted at the network boundary. Users should still enter secrets only through trusted sign-in and payment interfaces, never through chat.
Does Muse use my data for advertising or AI training?
Meta says Muse conversations and VM data are not shared with its advertising systems, and users can opt out of having interactions used to train Meta AI models. Review the current privacy policy and live settings because those choices and terms can change.
Can I let Muse buy things without checking?
Meta says Muse asks before purchases, and the product includes approval and audit controls. Keep those checks enabled, inspect every order, and verify the receipt directly with the merchant or payment provider.
Conclusion
Meta Muse is a significant step from conversational AI toward software that can act across everyday accounts. Its dedicated VM, separated credentials, Sentinel controls, approval prompts, and audit trail are meaningful safeguards. They are also reasons to use the product deliberately: begin with read-only access, connect one service at a time, approve consequential actions manually, and verify every result in the system of record.