Meta launches Muse, an AI agent that acts inside your apps

Meta unveiled Muse, a personal AI agent capable of browsing the internet, connecting to apps and services, and taking action on behalf of the person using it. The rollout began on September 8 in the United States. Unlike a chatbot that only answers questions, Muse can take on entire tasks — sending emails, making purchases, managing bookings — and, according to the company, keeps working even after the person closes the app. Meta's own example: Muse can take a recipe saved on Instagram, turn it into a grocery list, suggest a dinner-party menu, and remember guests' dietary restrictions before sending out invitations.

What Muse can actually do

According to Meta's official announcement, Muse can read and reply to email, manage calendars and payments, interact with health apps, shop, and control smart-home devices. The agent can open a browser, fill out forms, and negotiate on the user's behalf — for example to sell a car for more money or lower a bill. When it's time to pay, Muse can check out using Link, Stripe's wallet for agents, which generates a one-time-use virtual card so the user's real card details stay hidden; Meta says it is the first AI agent covered by Link's purchase protections, such as coverage for damaged or lost items. Shop Pay and support for passwords stored in 1Password are coming soon. The whole system runs on Muse Spark, Meta's most capable model to date, built specifically for this kind of agentic work.

How Meta says it protects privacy — and the doubts that remain

Meta says it built new infrastructure to support this kind of agent: Muse runs inside a dedicated cloud virtual machine, called Muse Secure VM, unique to each person. A separate agent called Sentinel, kept apart from Muse at the system level, checks every action before it leaves that virtual machine, and asks for explicit approval for sensitive tasks like sending a message or making a payment. According to the company, Muse has no visibility into passwords or card numbers: credentials are kept in secure storage that the agent can use without ever "seeing" them. People choose which apps Muse connects to and how much access it gets, can revoke that access at any time, and can tell the agent to "forget" specific things it has learned. Meta also announced that, later this year, it will launch Muse Confidential VM, a version where the entire virtual machine — including data and conversations — is encrypted with a key only the user controls.

Despite these assurances, outlets such as Yahoo Tech point to an important caveat: using conversations to train Meta's AI models is turned on by default, and it's up to the person to opt out if they don't want it. The launch also comes just weeks after Meta agreed to an $18 billion multistate settlement over claims that its social platforms harm children, and amid broader concern about how the company's AI glasses are used to record people without their consent. That combination — an assistant with access to email, payments, and home devices, from the same company facing those cases — is why several analysts urge caution before handing Muse sensitive tasks. The initial rollout also excludes markets such as India, suggesting a deliberately staggered launch.

Pricing and availability

• Available since September 8 in the US, through a dedicated iOS and Android app, the browser at muse.ai, and WhatsApp chats
• A free tier, plus two paid plans: $20 and $100 per month
• The mobile app shows a meter that warns when free usage is running low
• Support for Meta's AI glasses is coming soon

What it changes for third-party app developers

For people building apps and online services, an agent like Muse changes a basic assumption: more and more actions inside an app can be carried out by autonomous software acting on behalf of a human, not just by a person tapping on a screen. That forces a rethink of interfaces designed purely for humans — forms, payment flows, ad walls — and raises security questions: if an agent can browse, fill out forms, and complete purchases, it also becomes a new attack surface if someone manages to manipulate it, for instance through hidden instructions injected into a page. Developers who want their apps to work well with agents like Muse will need to offer explicit permissions and APIs instead of relying on the agent to "guess" a human interface, and will have to decide carefully which actions — buying, canceling, sharing data — they're willing to delegate to software that acts without constant human supervision.