Meta Muse: Features, Pricing, and Privacy Tradeoffs

Meta Muse is Meta's personal AI agent, launched on September 8, 2026. You message it like a person, in the Muse app or in WhatsApp, and it acts for you: it browses the web in its own browser, fills out forms, reads and sends email through apps you connect, makes purchases, and keeps working after you close the app. It runs on Muse Spark, Meta's own model.

The difference from a normal chatbot is where it runs and what it can touch. Each user gets a dedicated Linux virtual machine in Meta's cloud, called Muse Secure VM, with a browser, a file system, memory, and stored logins for the services you connect. Muse can plan multi-step work, schedule tasks, and come back when it needs your approval, for example before sending an email or making a purchase.

Who can get it: Meta launched Muse in the US on iOS, Android, and muse.ai. Meta now also lists a Mac app. Meta says Muse isn't available everywhere yet, and you need to be 18 or older to subscribe.

What it costs: Muse is free with a usage limit that Meta doesn't quantify. Paid plans are Power at $20/month (500M "Muse tokens" per week) and Maximum at $100/month (3B per week), per Meta's Help Center as of September 26, 2026.

The tradeoff: Muse is only useful if you give it access to things like your inbox, calendar, accounts, and a payment method. Meta has published an unusually detailed security design for that. Two weeks in, a researcher had already disclosed a hijacking flaw in the Mac app, and Meta hot-fixed it. Model training on your Muse interactions is on by default.

Muse and Muse Spark

Muse is the agent product. Muse Spark is the model underneath it. Meta introduced Muse Spark on April 8, 2026, as the first model from Meta Superintelligence Labs. Meta's Muse security write-up names Muse Spark 1.3 as the model version at launch and says the model was trained for tool calling, long context, long task trajectories, prompt-injection awareness, and multi-agent coordination.

This matters for one reason. If you want Muse Spark in your own software, you don't use Muse. You call the model through Meta Model API (see "Not the same thing" below).

What Muse can do

Meta also says Muse remembers what you tell it and makes suggestions without being asked. Unlike most chat apps, it isn't turn-by-turn, so you can send follow-ups before it finishes replying.

Browser and app actions

Muse has a full browser inside its VM, and you share it. Meta's Help Center lists booking appointments, making purchases, filling out forms, and watching for price drops as typical browser tasks. You can open the browser to watch, take control to pause the agent, or stop the task. Muse may accept essential cookies on third-party sites. You can ask it which URLs it visited and which cookies it accepted.

For payments, Muse checks out with Stripe's Link, which generates a one-time card number so neither the merchant nor the agent sees your real card. Meta says eligible purchases get Link's purchase protections. At Connect on September 23, Meta added Shop Pay and PayPal as payment options.

Background execution

Muse keeps working after you close the app. Meta's example is monitoring daily weather reports and alerting you when rain is coming. Meta's engineering post describes subagents and cron-style scheduled tasks running inside the VM. You can see scheduled work under Upcoming and a chronological record under Activity log.

Approval model

This is the part to understand before connecting anything.

Meta's engineering post says approvals are enforced by a separate process called Sentinel, not by the agent. Sentinel is the only component that can approve connector actions and outbound network requests, and the approval dialog appears directly in the app rather than in your chat with Muse. That design means a manipulated agent can't just decide it has permission.

Meta is also plain about the limits. Its Help Center says Muse "can make mistakes or take unexpected actions," that you're responsible for fixing errors with third parties, and that some actions, like sending an email, can't be undone.

If you build agents yourself, Sentinel is Meta's version of a common pattern: keep the permission checks outside the model.

How policy gates and human-in-the-loop checks fit into an applied agent architecture

concept

Connectors

Connectors are Muse's integrations with outside services. You add them in Settings → Connectors or by asking ("Connect my Gmail").

At launch: Meta says there were dozens of partner connectors plus access to the full Shopify catalog. Meta's own pages mention email, calendar, Instagram, and, on Mac, Messages, Calendar, and Notes.
Added at Connect (September 23): Walmart, Best Buy, American Eagle Outfitters, DICK'S Sporting Goods, Fanatics, Gap, Michael Kors, Sephora, Ulta, Wayfair, Instacart, Notion, Granola, GitHub, and Box. Expedia is listed as coming soon.
Meta's own apps: Facebook, Instagram, and Threads connect automatically if those accounts are in the same Meta Accounts Center as your Muse login.
Custom connectors: Muse can create a connector for an unsupported service, often from that service's API details. Meta says it doesn't review custom connectors or how they use your data.

Where a service supports it, Meta separates read access from write access. Many connectors can be limited to reading data without taking actions. Meta says an email connector lets Muse search your mail without downloading the whole inbox unless you ask it to. Meta's engineering post says the email connector filters out one-time codes, password-reset links, and magic login links.

Access and availability

Item	What Meta documents (as of Sept 26, 2026)
Launch	September 8, 2026, rolling out in the US
Where you can use it	iOS and Android apps, muse.ai on the web, a Mac app, and chat in WhatsApp
Account	A Meta account. You can create one with Facebook, Instagram, email, or phone number.
Regions	"Not available in all locations yet." Meta hasn't published a country list on the pages we checked.
Age	18+ or the age of majority to subscribe
Coming	AI glasses "in the coming months," a voice mode, Muse's own email address, and the Muse Charm device (details "later this year")

Pricing and usage limits

Plan	Price	Weekly allowance
Free	$0	Usage limit not quantified. It refreshes over time.
Power	$20/month	500M Muse tokens per week
Maximum	$100/month	3B Muse tokens per week

Source: Meta Help Center, "About Muse subscriptions," read September 26, 2026. Plans renew monthly on your purchase date. You can subscribe in the mobile app or at muse.ai. Meta says benefits and availability "may vary by region and account" and that subscriptions are "in limited testing."

Privacy and security tradeoffs

What Meta says it protects

Official docs

Meta's documented protections

Each user's VM is isolated from other users' agents. Credentials for connected services are stored in your VM, not in central Meta infrastructure, according to Meta's engineering post.
Logins go into a Secure Credentials Store. The agent works with stand-in tokens, and Sentinel swaps in the real credential at the network boundary, so the model never sees your password.
Every outbound network request goes through Sentinel. Separate classifiers screen for prompt injection outside the agent's runtime.
Muse conversations and VM data aren't shared with Meta's ad systems.
You can delete messages and files, ask Muse to forget topics, or reset Muse entirely.
Meta runs a public bug bounty for Muse that pays up to $300,000, including up to $130,000 for prompt injections that affect a single user.

What you're giving up

Training is on by default. Meta uses your Muse interactions to train its AI models unless you turn it off under Settings → Data controls. Meta says turning it off also applies to past interactions, and that it removes some personal identifiers before training.
Meta can currently access your VM. Meta says Muse Confidential VM, which is encrypted with a key only you hold, is planned for "later this year." Until then, Meta isn't claiming that Meta itself can't access your data.
Deleting isn't the same as forgetting. Meta says Muse may still remember what it learned from something you deleted. The forget skill removes things "to the best of its ability."
Your Meta accounts are connected by default. Facebook, Instagram, and Threads connect automatically through Accounts Center.
Muse sends data to third parties. Each connector has its own terms and privacy policy, and custom connectors aren't reviewed by Meta.
Prompt injection is still unsolved. Meta's engineering post says Muse isn't immune and calls prompt injection an open problem across the industry.

Community report

Mac app hijacking flaw, September 21–22, 2026

On September 21, macOS security researcher Patrick Wardle publicly disclosed a flaw in the Muse Mac app. According to his disclosure, as reported by Privacy Guides and Unite.AI, an undocumented setting (endo_voyager_dictation_endpoint) could be changed by an ordinary local process to redirect dictated prompts to an attacker's server. That would let an attacker capture audio, inject prompts, steal the Muse auth token, and use whatever access the user had granted Muse. The attack needed code already running on the Mac. Wardle also described a remote path in which a user is socially engineered into running one command. He reported on September 22 that Meta had hot-fixed it. We haven't reproduced any of this, and Meta hasn't published a statement on it on the pages we read.

How it has performed so far

We don't have first-party results. Early outside hands-on coverage is mixed and specific to tasks.

Muse vs ChatGPT's agent

The comparison most people want is ChatGPT agent. OpenAI's Help Center now says ChatGPT agent "is no longer available" and sends users to ChatGPT Work for long multi-step tasks and to a cloud browser for browser workflows.

	Meta Muse	ChatGPT agent (retired) / ChatGPT Work
Free access	Yes, with a usage limit	Agent mode was paid-only. OpenAI says Work is for eligible paid plans.
Where it runs	A persistent per-user cloud VM that holds your data and credentials	Agent used its own virtual computer. Work runs in the cloud and can also run locally in the desktop app.
Operating model	Ongoing personal agent with memory, proactive suggestions, and background tasks	Task-oriented, focused on research and finished deliverables such as documents, spreadsheets, and presentations
Approvals	Per-action grants enforced by Sentinel, with once, task, site, or always scopes	Confirmations for high-impact actions. Agent had a supervised "watch mode" on some sites.

Should builders and operators care?

Not the same thing

Name	What it is	Relationship to Meta Muse
Meta Muse	Meta's consumer personal AI agent: app, web, Mac, and WhatsApp	This page
Muse Spark	Meta Superintelligence Labs' model family (1.3 at Muse's launch)	The model Muse runs on
Muse Code	Meta's terminal coding agent, with its own subscription	A separate developer product also built on Muse Spark. Not covered here.
Meta Model API	Meta's self-serve, OpenAI-SDK-compatible API for Muse Spark and other Meta models, in public preview	How developers call the model directly. Not covered here.
Muse Image	Meta's image-generation model, announced July 2026	A separate Meta AI model. Not the agent.

Muse Code: Meta's separate terminal coding agent, with its own plans and platform support

entity

muse.ai is Meta's own web address for Muse. Sign in there or in the official apps, not through lookalike sites.

Change log

April 8, 2026 — Meta introduces Muse Spark.
September 8, 2026 — Muse launches in the US on iOS, Android, and muse.ai with Muse Secure VM, Sentinel, Stripe Link checkout, and a public bug bounty. Meta says Shop Pay and 1Password support are coming soon.
September 21–22, 2026 — Patrick Wardle discloses the Mac app dictation-endpoint flaw. He reports a hot-fix the next day.
September 23, 2026 (Connect) — Meta announces Muse on AI glasses in the coming months, voice mode, new retail, work, and payment connectors (Shop Pay, PayPal), Muse's own email address, and the Muse Charm device.
As of September 26, 2026 — Meta's Muse page still lists 1Password as "coming soon." Muse Confidential VM is still planned for "later this year."

How we label public facts, community reports, and inference on this site

concept

Sources & Documentation

Meta Newsroom: Introducing Muse (September 8, 2026) — Launch, Muse Secure VM, Sentinel, approvals, Stripe Link checkout, US rollout on iOS, Android, and muse.ai, and the planned Confidential VM.
AI at Meta: Muse — Capabilities, surfaces (mobile, Mac, WhatsApp), background work, approval FAQ, and free usage limit.
AI at Meta: Download Muse — iPhone, Android, and macOS apps.
Meta Help Center: About Muse subscriptions — Power ($20/month, 500M Muse tokens per week), Maximum ($100/month, 3B per week), eligibility, and billing.
Meta Help Center: How Muse handles your privacy, safety and security — VM isolation, ad-system separation, Secure Credentials Store, training toggle, and deletion and forgetting.
Meta Help Center: How Muse works with your guidance and approval — Permission defaults, approval scopes, activity log, and user responsibility.
Meta Help Center: How Muse works with Connectors — Connecting and disconnecting, automatic Meta connectors, and unreviewed custom connectors.
Meta Help Center: How your Muse agent browses the web — Shared browser, take control and stop, and cookies.
Meta Help Center: How to get started with Muse — Meta account requirement, file types, and free usage limit.
Meta AI Research: How We Built Safety Into Muse — Runtime cell, Sentinel, stand-in credentials, tainted egress, Muse Spark 1.3, and the bug bounty.
Meta Newsroom: The Biggest News From Connect 2026 — Glasses, voice mode, new connectors and payments, Muse email address, and Muse Charm.
Meta for Developers: Meta Model API — Disambiguation only: developer API access to Muse Spark.
Meta for Developers: Muse Code — Disambiguation only: Meta's separate coding agent.
OpenAI Help Center: ChatGPT agent — States ChatGPT agent is no longer available. Earlier agent-mode plan and safety details.
OpenAI Help Center: ChatGPT Work and Codex — Work as OpenAI's current multi-step agent experience.
Privacy Guides: Meta's Muse AI Assistant Vulnerable to Hijacking — Community report of Patrick Wardle's Mac app disclosure.
Unite.AI: Meta Hot-Fixes Muse Zero-Day — Community report of the disclosure timeline and Wardle's hot-fix confirmation. The article is labeled as AI-generated.
Tom's Guide: Muse personal shopper test — A single writer's hands-on shopping session.