What launched
Meta released Muse, its consumer AI agent, in the United States on 8 September. It is available to adults on iOS and Android, on the web at muse.ai and through WhatsApp, and Meta says it will come to the company’s AI glasses later.
Muse connects to a user’s email, calendar, payment methods, health apps, smart home devices and shopping accounts, and acts through them. TechCrunch reported that it can send emails, book travel, negotiate bills down, fill in forms, build plans, turn recipe videos into grocery lists, send party invitations and make purchases.
There is a free tier, capped by usage, and two subscriptions: Power at $20 a month and Maximum at $100 a month. SiliconANGLE puts the free allowance at up to 100 million tokens a week. Meta’s chief AI officer said most users should be able to do what they need within the free tier, which is a claim worth revisiting in six months.
The security architecture is the pitch
Meta is selling this on containment rather than capability, and the architecture is the reason. Muse runs on the company’s Muse Spark model inside what Meta calls a Secure VM — a dedicated virtual machine with its own isolated browser, separated from the rest of the user’s data.
A second component, Sentinel, watches what leaves that cell, checking outbound actions against policy and prompting the user for approval when an action falls outside it. Tarek Sheasha, a vice-president at Meta Superintelligence Labs, told SiliconANGLE that the harness runs in its own isolated cell and does not see real credentials.
Payments work the same way: purchases go through Stripe’s Link, which issues single-use card numbers rather than handing the agent the real one. Meta says a later Confidential VM update will run the agent in a trusted execution environment with user-held keys, so that Meta itself cannot read the contents.
Why the design is defensive
The design answers a specific problem, and Meta’s own pre-launch history is part of it. The product was tested internally under the codename Hatch, and reporting before launch described a version of the agent changing a password and sending an email nobody had asked for. An agent with a browser, a mailbox and a payment method is one prompt injection away from doing something expensive on a user’s behalf.
The other problem is Meta itself. TechCrunch’s framing — will consumers trust it — points at three Federal Trade Commission settlements over privacy, in 2011, 2019 and 2023, the Cambridge Analytica affair, an incident in which user passwords were stored in readable form, and continuing litigation over child safety. Meta says Muse conversations do not feed its advertising systems. That is a policy statement, not an architectural guarantee, and it is the one claim in the launch that nothing in the Secure VM design enforces.
What to watch next
Three things. Whether the free tier’s 100 million weekly tokens survive contact with real usage, or quietly shrink. Whether Sentinel’s approval prompts are frequent enough to be a real control and rare enough that users do not click through them by reflex. And whether an independent researcher gets a prompt injection past the Secure VM — because on current evidence, someone will try within the week.
