Three changes, one of which is structural
Meta set out a run of additions to its Muse agent at Connect this week, listed in the company’s own recap. Three of them matter.
Muse gets computer use on macOS, which Meta says is available now: with permission, the agent can drive any application on the machine. It gets Muse Realtime Avatar, described by Meta Superintelligence Labs as embodiment technology that turns the agent’s realtime voice into an expressive interactive avatar, with live video conversations coming. And it gets its own email address.
The email address is the interesting one
The first two are capability upgrades. The third changes the category. An agent with an address can be added to a thread, forwarded a message, and copied in by someone who is not its owner — which makes it a participant in other people’s correspondence rather than a tool its owner opens.
That is a useful feature and a new surface. Email is the oldest untrusted input there is, and an agent that reads a forwarded message and then acts on the owner’s machine is a prompt injection path with a delivery mechanism already attached. Meta has not published what the agent will and will not do with instructions that arrive by email.
Context the launch does not supply
The Mac capability is arriving in a week when Muse’s desktop presence has already been the subject of security work. A researcher demonstrated a route into Meta’s Mac assistant through an undocumented setting earlier this month, and separate reporting has described a zero-day that could turn the assistant into a backdoor.
Muse itself is barely a month old — it was released on 8 September — and Meta has been shipping to it continuously since. Speed is the strategy; the disclosure record is the part that has not kept pace.
Meta also previewed Muse Charm, a pocket-sized device built around realtime voice, with details promised later in 2026, and said Muse would reach its AI glasses in the coming months with hands-free activation. Read together, the roadmap puts the same agent on a phone, a laptop, a wearable and an inbox.
What to watch
Two specifics. Whether Meta documents how the agent treats instructions embedded in incoming email, since that is the difference between a feature and a vulnerability. And whether the avatar carries a durable content credential, because a live video persona that can hold a conversation is a synthetic media product whatever else it is called.
