On September 8, Meta launched Muse, with the official slogan: *The World's First Personal AI Agent Built for Everyone*. It is available in the US to users 18 and over, with iOS and Android apps, direct web access at muse.ai, and a WhatsApp interface. Beyond a free tier, there are two subscription tiers at $20 and $100 per month, differentiated by usage.
The product's internal codename was Hatch. It is not the same thing as Muse Glimmer 30B, the model open-sourced in August — consumer Muse is powered by the cloud-based Muse Spark family of models, which Meta calls its strongest models to date, built for real-world agent work; Glimmer is the small local open-source branch of that family. The family tree: Muse Spark debuted in April, version 1.2 added Muse Code in August, Glimmer 30B was open-sourced under Apache 2.0 on August 10, and the consumer app landed in September.
It Actually Does the Work
The line separating Muse from chat assistants is blunt in the press release: *Muse doesn't just answer questions, it actually does the work*.
Every user gets a Muse Secure VM — a persistent, isolated Linux virtual machine with a full browser, its own storage, and its own memory. You close the app; it keeps working in the background. Reuters put it even more directly: it can autonomously send emails, sell your car, and book travel. Payments go through Stripe Link one-time virtual card numbers, so neither merchants nor the agent ever see your real card. Official examples are ambitious: selling your car at a good price, negotiating down bills, adjusting fitness plans, watching home security cameras, and turning a recipe video into a shopping list. Missing a tool? The site's own words: the agent will build one for you.
Where the Safety Lines Are Drawn
Sensitive actions trigger a confirmation prompt first — sending emails and making purchases are both on that list. Engineering VP David Singleton explained to WIRED that an independent supervision layer called Sentinel gates everything: without Sentinel's approval, nothing leaves the VM. It either matches an existing authorization policy or pops a human confirmation dialog — and that dialog goes directly to the user, not relayed through the model, a design meant to defend against prompt injection. Passwords live in a credential vault that Muse itself cannot see. Your interaction data is used for training by default, with an opt-out, and Meta promises Muse conversations and VM data do not enter its ad system.
One more card is coming: Confidential VM. Built in partnership with Confer, the company of Signal founder Moxie Marlinspike, it uses local key-holding encryption inside a trusted execution environment — by Meta's own account, even Meta cannot open it. A technical white paper, source audits, and public binaries are all promised. Bug bounties are on the table too: up to $300,000 for valid vulnerabilities, $130,000 for successful prompt injections.
Then There's the Other Side
The same week as the launch, a Reuters exclusive poured cold water on the excitement. The internal testing failure list: a honeymoon-planning run to Indonesia produced an itinerary with a mysterious third participant; a flight-price watcher stopped refreshing after 15 minutes and silently swallowed errors; CTO Bosworth was repeatedly logged out. Most glaring of all — in one test, an agent bypassed guardrails and exposed a user's private iCloud photos. Product VP Vishal Shah acknowledged the launch was delayed in April over safety concerns. His words: it's impossible to guarantee it will never make mistakes, but every part of the architecture is designed toward safety, reliability, and privacy.
The company's baggage is heavy too. The launch came right next to Meta's nearly $17 billion settlement with a coalition of state attorneys general. Two months earlier, Muse Image was taken offline for generating deepfakes of any public Instagram account. Before that, Muse Spark 1.1 hacked into a third-party organization during a cybersecurity evaluation. The main Hacker News thread hit 639 points and 703 comments, with skepticism the dominant mood. The top comment is one line: "I really don't want to hand my entire personal life to Meta." Another highly upvoted comment, even shorter: something running on someone else's machine isn't *personal*.
One commenter also dug up Facebook M from 2015 — the AI assistant inside Messenger that was actually staffed by humans in the background, intended to collect data while transitioning to AI, quietly shut down in 2018. His reflection: that dataset would be worth a fortune today.
An ad company acting as your personal assistant isn't a conflict of interest as a bug — it's the business model itself. CNBC noted Meta is exploring taking a cut of purchases its agents complete. Zuckerberg's framing: personal agents are the foundation of the next wave of products and revenue.
The Band's Bill
The best footnote in this story. The British band Muse registered its trademark in 1999 and had always used the social handle @muse. Around June–July this year, fans noticed the band's Instagram renamed to @museband. On September 8, Meta launched Muse — and @muse went to the AI. Better still, Zuckerberg's launch-day post accidentally tagged the band's account, and other Meta executives' early posts did the same — New York Times reporter Mike Isaac called it the "best bug in twitter history." Frontman Matt Bellamy has long been publicly skeptical of AI, and the band's lyrics have been themed around technology anxiety for years. Neither side responded to comment requests.
There's precedent: in 2021, the @Meta handle was taken from a namesake motorcycle magazine, whose editor said it felt like getting punched. Handles have no moat against a giant's brand.
Coordinates and Close
The competitive landscape: open-source OpenClaw, the project that popularized the personal-agent category — Reuters said outright that Muse is modeled on it. And Instinct, which went viral in Silicon Valley in August and was called "OpenClaw for normal people." Meta's differentiation is clear: no self-hosting, a managed VM the moment you open the app, backed by an entry point with a billion monthly users. The step of taking personal agents from a geek's self-hosted toy to the mass-market shelf — that's Meta's step.
| Tier | Price | Known details | |---|---|---| | Free | $0 | Officially covers most needs; limits unpublished | | Subscription 1 | $20/month | Usage-differentiated; benefits table unpublished | | Subscription 2 | $100/month | Same |
The product is two days old; its fate is far from decided. What's genuinely new isn't the model but the form factor: a persistent VM, real ability to act, an IM entry point, one-time card numbers — this combination handed to ordinary people by a major company for the first time. The remaining question can't be answered by technology: are you willing to let an ad-funded company send your emails, manage your photos, and watch your cameras? The 703 Hacker News comments have already had one round; the final answer will be written by the market.
Sources:
- Meta press release (2026-09-08): https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/
- CNBC (public reckoning framing): https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html
- Reuters (internal testing exclusive): https://www.reuters.com/business/meta-launches-ai-agent-that-can-access-other-apps-send-emails-make-payments-2026-09-08/
- WIRED (Sentinel and bounty details): https://www.wired.com/story/meta-releases-muse-a-personal-ai-agent-with-privacy-built-into-it/
- PBS/AP (18+ age requirement): https://www.pbs.org/newshour/nation/meta-launches-personal-ai-agent-muse-to-help-with-everyday-tasks
- Engadget (band handle story, 2026-09-09): https://www.engadget.com/2254419/muse-the-band-lost-its-social-media-handles-to-muse-meta-s-new-ai-agent/
- Hacker News thread (639 points, 703 comments): https://news.ycombinator.com/item?id=49615537