Meta has launched Muse, a personal AI agent designed to do more than answer prompts. The Meta Muse AI agent can work through multi-step tasks, keep projects moving after the app is closed and ask for approval before sensitive actions. Its arrival marks a significant shift from conversational chatbots towards software that can act across the web on a user’s behalf.
What is the Meta Muse AI agent?
Muse is Meta’s new consumer-focused AI agent, announced on 8 September 2026. It is powered by Muse Spark, a model built for agentic work, and is available through a dedicated app, WhatsApp and the web at muse.ai.
Instead of waiting for a series of individual prompts, Muse can break a larger goal into steps and continue working in the background. Meta says it can draft and send emails, research purchases, book travel, fill in forms and help organise longer-term plans. It can also use information a person has chosen to share to make proactive suggestions.
The initial rollout is for adults in the United States on iOS, Android and the web. Meta says support for AI glasses is coming soon. The company has not announced an Australian release date, so local users should be wary of unofficial downloads or sign-up pages claiming to offer early access.
What changed: from chatbot to action-taking agent
Most mainstream AI assistants have primarily generated text, images or answers inside a chat window. Muse is designed to operate a browser and interact with external services. That difference is important: an answer can be reviewed and ignored, while an agent may take a real action that affects money, communications or accounts.
Meta says Muse pauses for approval before actions such as sending an email or completing a purchase. Users can see an audit trail of what the agent has done and what it plans to do. Access is also meant to be granular: a person might allow Muse to read email without allowing it to send messages, then change or revoke that access later.
Shopping and payments
For online purchases, Muse supports Link by Stripe. Meta says the integration can use a one-time card so the merchant does not receive the customer’s real card details. Eligible transactions also receive Link purchase protections. Shop Pay and 1Password integrations are planned, which could broaden the services and credentials the agent can use.
Memory and proactive help
Muse can remember selected details and use them in later tasks. Meta gives examples such as turning a saved recipe into a grocery list or remembering guests’ dietary requirements while planning dinner. Users can tell it to forget specific information, although people should still consider carefully which personal details an automated service genuinely needs.
How Muse Secure VM is meant to protect users
Each Muse runs inside what Meta calls a Muse Secure VM—a dedicated virtual computer in the cloud with its own browser, storage and isolated environment. Connected-service credentials are kept in secure storage so the AI can use them without directly seeing passwords or payment details.
A separate “Sentinel” agent monitors outbound activity. According to Meta, nothing from Muse reaches the internet unless Sentinel approves it, and the system requests the user’s permission where required. This separation is intended to reduce the chance that malicious content on a website tricks the primary agent into leaking data or taking an unwanted action.
Meta says conversations and data inside the VM are not shared with its advertising systems. People can also opt out of having their interactions used to train Meta’s AI models.
Why this matters
Muse is one of the clearest attempts by a major consumer platform to make autonomous AI useful to non-technical users. The integration with WhatsApp lowers the learning curve, while persistent background work could make agents practical for tasks that take hours or require repeated checking.
For businesses, this points towards customers increasingly delegating research, comparison and purchasing decisions to software. Retailers and service providers may need websites that are easy for both people and authorised agents to navigate. Clear pricing, structured product information, accessible policies and reliable checkout flows could become even more important.
Developers and creators should also watch the permissions model. If consumers become comfortable granting narrowly scoped access—read but not send, research but not buy—that pattern may influence how future apps expose agent-friendly integrations.
Risks and limitations
The security design is promising, but it does not eliminate risk. An AI agent can misunderstand a request, select the wrong item, expose information through a poorly chosen action or encounter hostile instructions embedded in a web page. Approval prompts and audit logs help only if users read them carefully.
There is also an important difference between Muse Secure VM today and Meta’s planned Muse Confidential VM. Meta says the later system will encrypt the entire virtual machine with a key held only by the user, preventing even Meta from accessing its contents. That stronger architecture is expected later in 2026; it should not be treated as part of the current release.
Availability is another limitation. Muse is presently rolling out only in the US, and Meta describes the service as free for most needs with subscriptions for heavier use. Users should check the current terms, limits and pricing before relying on it for important workflows.
Practical advice before using a personal AI agent
- Start with low-risk tasks: use research, planning and draft creation before enabling purchases or outbound messages.
- Grant the minimum access: connect only necessary services and choose the narrowest permissions available.
- Review every approval: check recipients, dates, prices and cancellation conditions before authorising an action.
- Inspect the audit trail: regularly review what the agent accessed and completed.
- Keep recovery controls: use strong account security and know how to revoke sessions and payment access.
What to watch next
The biggest milestones will be the launch of Muse Confidential VM, expansion beyond the United States and the promised arrival on AI glasses. It will also be worth watching how well Sentinel resists prompt-injection attacks in real-world browsing, how often human approval is required, and whether businesses begin publishing interfaces specifically for personal agents.
Conclusion
The Meta Muse AI agent brings the industry closer to assistants that can carry out useful work rather than simply describe how to do it. Its isolated virtual machine, permission controls and action log address genuine safety concerns, but users are still handing software meaningful authority over personal data and online accounts. Muse’s success will depend not only on what it can accomplish, but on whether its safeguards remain understandable and dependable at consumer scale.