Meta shipped an agent on Tuesday that reads your mail and puts charges on your card, and the first thing it asked one reviewer for was an Amazon login. Muse went live on 8 September 2026, in the United States, for adults only. It's free up to 100 million tokens a week, then $20 a month for the Power tier and $100 for Maximum. The price isn't the interesting part. Meta built a per user virtual machine and a separate permission daemon to hold this thing, published the design in real detail, and then wrote in the same document that prompt injection remains an open problem. Both of those are true at once.
The short answer
Muse is a personal agent that connects to your mail, your calendar, a payment rail and a pile of consumer services, then acts on your behalf. It runs on Meta's Muse Spark model inside a dedicated virtual machine, with a component called Sentinel approving every connector action and every packet that leaves the box. Real credentials never reach the agent itself, and purchases always come back to you for approval. What Meta hasn't solved is prompt injection, and the version that would stop Meta itself reading your VM is dated later in 2026. Early hands on testing says the setup cost swamps the task for anything small.
What Meta actually shipped
Muse is a separate product from the assistant already living inside Meta's apps. You get it as an iOS app, an Android app, at muse.ai in a browser, or through WhatsApp, with the AI glasses promised later. US only at launch, gated to 18 and over. Alexandr Wang, Meta's chief AI officer, runs the effort, and the model underneath is Muse Spark, the same family we wrote about when the coding tier landed at $1.25 per million tokens.
The job it advertises is errands. Read the inbox, book the trip, argue a bill down, turn a recipe into a shopping list, buy the thing. Connectors cover mail and calendars, payments, health and fitness, smart home, dining, shopping, music and events. Where a service publishes an API, Muse uses it. Where it doesn't, Muse drives a browser with credentials you hand over. Checkout runs through Stripe's Link, and you need a card on file before you can start at all.
The pricing is generous and vague at the same time. 100 million tokens a week for free is a great deal of agent, and Meta says it expects most people to stay there. Power is $20 a month, Maximum is $100, and nothing published so far tells you what a booked flight costs in tokens. No advertising inside the product, conversations kept out of the ad systems, opt out of model training on request. I'd want that in a contract before connecting a work account, but it's at least the stated policy.
The permission layer is the part to read
Here's where it gets interesting for anyone who has tried to sandbox an agent themselves. Each user gets a virtual machine, the Muse Secure VM, holding the agent and the copy of your data it works on. Inside it, code runs in a systemd-nspawn cell with its own root filesystem, its own virtual network interface, filtered system calls and trimmed kernel capabilities. Root in the cell maps to an unprivileged user on the host, so getting out of the agent isn't getting out of the machine.
Beside it, kept apart at the system level, sits Sentinel. It's the sole permission authority for two things: calls to third party connectors, and every byte of network egress. It doesn't just check a hostname. It reads the resolved and final destination address, the port, the protocol, the HTTP method, the path and the decoded request, then answers allow, deny, or ask the user. Anything carrying your data outward needs approval. Purchases always come back to you with the exact details attached.
The credential handling is the part I'd steal outright. The agent never holds a real token. It gets a surrogate minted by a separate daemon, and Sentinel substitutes the genuine secret at the network boundary once the request has already been authorised. Per connector you can grant read without write, and Meta says it narrows OAuth scopes further than the providers themselves offer. There's an audit trail, and you can revoke any of it.
Two admissions sit in that same document. Muse will sometimes make mistakes. And prompt injection remains an open problem in the industry, which is Meta telling you the wall holds while the thing inside stays suggestible. Meta can also read your VM today. The Confidential VM meant to stop that is dated later in 2026, a promise rather than a property.
Thirty seconds, by hand
Architecture is one thing. PYMNTS put Muse through three ordinary errands on launch day and it finished none of them. Reordering toilet paper on Amazon failed. A Domino's order failed. A Resy reservation failed. Getting that far meant handing Amazon credentials over through a secure link, then running separate authorisation flows for Gmail and Calendar. The payment routed through Stripe Link, which didn't go through either. That same Amazon reorder, done by hand, took under 30 seconds.
One test on day one isn't a verdict, and I'd expect broken connectors to get patched fast. The shape of the problem won't patch, though. Every capability Muse has is a credential you granted and a scope you approved, followed by a queue of confirmations you'll be tapping through. That's the honest cost of the security model: the design that makes an agent safe to run is the same one that makes it slow to use. Meta chose correctly, and it still leaves a product that needs tasks big enough to earn the ceremony.
So it isn't for the 30 second errand. It's for something long and dull with a lot of steps, where you'd have burned 20 minutes anyway. If that's your week, the free tier costs you nothing except the connectors. And if your interest here is professional rather than personal, watch what happens the first time somebody points this at a work Google Workspace account, because nothing in the product stops them and the OAuth consent screen is the only place it shows up. Different problem entirely from running a 30B Muse model on your own GPU, where the data never leaves the building.
Sources
Meta AI Research, How we built safety into Muse (the Secure VM, the systemd-nspawn cell, Sentinel at layer 4 and layer 7, credential surrogation, per connector scopes, the purchase rule, the Confidential VM timing, and both stated limitations). TechCrunch, Meta debuts its Muse AI agent, 8 September 2026 (channels, connector categories, Stripe Link and the card requirement, the advertising and training positions). The Next Web, Meta launches Muse, 9 September 2026 (tier names and prices, Muse Spark underneath). PYMNTS, Meta's Muse can't order a pizza without help (the three failed transactions and the 30 second comparison).
Frequently asked questions
Can I use Muse outside the United States?
Not at launch. Meta gated it to the US and to users aged 18 and over on 8 September 2026, and hasn't published a date for anywhere else. A VPN isn't the answer either, because the connectors and the payment rail both key off a real account and a real card. If you're outside the US and curious, read Meta's security write up instead. It's public and it doesn't require the product.
Does Muse ever see my passwords or card numbers?
Meta says no, and the mechanism it describes backs that up. The agent works with surrogate tokens minted elsewhere, and Sentinel swaps in the real credential at the network boundary after the specific request has been authorised. Card details go through Stripe's Link rather than sitting in the agent's context. Genuinely good design. It isn't an audit, though, and nobody outside Meta has verified the implementation, so treat it as a credible claim rather than a proven one.
What does 100 million tokens a week actually buy?
Nobody has published a conversion, which is my main complaint about the pricing page. Tokens here cover the agent's own reasoning as well as every page it reads, so one multi step booking can cost what a month of chat never would. Meta's line is that most people won't leave the free tier. Until somebody measures a real errand end to end, that's an assertion rather than a number you can plan against.
Should I connect a work account to it?
I wouldn't, and if you administer a Google Workspace or Microsoft 365 tenant you'll want to decide that before your users do. Muse asks for OAuth scopes against whatever mailbox you point it at, and it's a consumer product with a consumer agreement behind it. The controls are per connector and revocable, which helps. But a copy of your mail lands in a VM that Meta can still read until the Confidential VM ships, and that alone rules it out for anything under a data processing agreement.
