Meta has launched Muse, a personal AI agent that can use a browser and connected apps, keep working after its app closes, send messages, and complete purchases. The US rollout is real, but several protections and integrations remain future promises rather than current features.
Muse began rolling out on September 8, 2026, through iOS, Android, and muse.ai in the United States. Meta says AI glasses support is coming soon. This is a consumer agent product, not the Muse Spark model or the Muse Code coding agent already covered by Musthave.ai.
Meta Muse can act after the app closes
The defining product change is continuity. A user can ask Muse to research, compare options, work through a browser, use a connected service, or prepare a transaction, then leave the app while the task continues. That makes Muse closer to a delegated worker than a chat response.
Continuity also expands the risk window. A wrong assumption can survive longer, a connected account can expose more data, and a delayed action may execute after the user has changed plans. Useful agent design therefore depends on interruption, approval, audit, and revocation controls.
What is available now and what is coming later
| Capability | Launch status | Important limit |
|---|---|---|
| iOS, Android, and web access | Rolling out in the US | Broader geography was not announced |
| Browser and connected-app actions | Available in the launch | Permissions vary by action and service |
| Stripe Link payments | Available | Uses one-time-use cards and Link protections |
| Shop Pay and 1Password | Coming soon | No final availability date in the announcement |
| AI glasses support | Coming soon | Not part of the initial app and web rollout |
| Confidential VM | Planned later in 2026 | Not a launch-day protection |
Muse uses a Secure VM and a separate Sentinel agent
Meta says each Muse task runs in a dedicated Secure VM. A separate Sentinel agent evaluates proposed internet actions and can require user approval before sensitive steps. Muse also provides an audit trail so a user can inspect what happened.
These are Meta-reported architecture and policy claims, not an independent security audit. The practical test is whether Sentinel blocks the right actions, whether the audit trail includes enough detail to reconstruct a task, and whether revoking a connection stops work already in progress.
Purchases introduce a different approval boundary
Stripe Link can supply a one-time-use card and purchase protections without exposing a reusable payment credential to the agent. That reduces one risk but does not answer every commerce question. A buyer still needs to confirm merchant, item, quantity, price, delivery address, return policy, and final total.
- Require approval immediately before the final purchase action.
- Show the merchant and total in the approval screen, not only in the audit trail.
- Set a low spending ceiling for early tests.
- Confirm cancellation and return handling before delegating repeat purchases.
- Revoke payment and account connections after a sensitive one-off task.
Meta’s privacy promises need precise reading
Meta says Muse conversations and Secure VM data are not shared with its advertising systems. It also says users can opt out of having their interactions used for model training. Those statements describe the current product policy. They should not be expanded into a claim that no operational logs exist or that every connected service follows the same policy.
Before connecting email, files, calendars, shopping accounts, or social accounts, check data retention, deletion, export, and revocation behavior for both Muse and the connected service. Our Meta AI recurring-task checklist provides a useful permission inventory.
Muse pricing is still incomplete
Meta says Muse is free for most needs and that subscriptions will support heavier use. The launch announcement does not publish a complete price table, quota schedule, or overage model. That makes cost comparison premature.
Do not build a workflow around the word free. Record task limits, wait times, connector availability, purchase limits, and any subscription prompt during real use. A useful agent budget includes the subscription, time spent correcting work, and the consequences of a wrong action.
How Muse differs from Meta’s other Muse products
Muse is now an overloaded name. Muse Spark is a model story. Muse Code is about delegated software work. The new Muse is a consumer personal agent with browser, app, messaging, and commerce actions. Readers should verify which product a feature or price belongs to.
A safe first-week test
- Start read-only: ask Muse to research and compare without sending or buying.
- Connect one low-risk account: avoid a full bundle of email, cloud storage, and payment access.
- Trigger an approval: verify exactly what information appears before an action.
- Interrupt the task: close the app, return, cancel, and confirm that execution stops.
- Inspect the audit trail: compare the record with what changed externally.
- Revoke access: confirm that tokens, sessions, and saved payment permissions are no longer usable.
My verdict: Muse is an action product, not just a chatbot
Meta Muse matters because it combines persistent work, connected services, and payments in a mass-market product. The Secure VM, Sentinel review, audit trail, and one-time cards are thoughtful controls. They still need to work under interruption, ambiguous instructions, compromised pages, and changing user intent.
Use the initial rollout to test the approval boundary, not to maximize the number of connected accounts. If Muse makes its actions understandable and reversible, it can become useful. If the user cannot tell what it will do next, the convenience is not yet worth the authority.
Read the primary source
- Read Meta’s Muse personal AI agent announcement.
Checked September 9, 2026. Availability, architecture, privacy, payment, and roadmap statements are Meta-reported. Test recommendations are Musthave.ai analysis.
