Meta has launched Muse, a personal AI agent designed to execute tasks rather than simply answer questions. The service is available now in the US on iOS, Android, and muse.ai. It includes a free tier alongside paid plans. Users can direct Muse to send emails, book travel, negotiate bills, and pursue long-term objectives. The software continues to operate after the app closes and pauses only when it requires explicit approval for sensitive actions.
What Muse Actually Does
The system functions around messaging. A user describes a task or goal, and the agent plans and executes the steps. It can open a browser, fill out forms, and negotiate on a person’s behalf. Meta’s examples include selling a car for a higher price, lowering utility bills, and adapting a training plan. Muse retains context across conversations. It can convert a saved Instagram recipe reel into a grocery list while recalling friends’ dietary restrictions. Sensitive steps, such as sending an email or completing a purchase, always pause for user approval. A full audit trail records everything the agent has done and plans to do.
The Model: Muse Spark 1.3
Muse runs on Muse Spark 1.3, released last week by Meta Superintelligence Labs. The model targets long horizon agentic work: zero shot CLI tool calling, multi workflow threads, and self correction across messy sources. In internal comparisons by Meta engineers, it used roughly 20% fewer tool calls and 25% fewer tokens than Muse Spark 1.2. Meta says the model is close to state of the art at resisting prompt injection. Developers can use it now in Muse Code and the Meta Model API at dev.meta.ai.
Muse Secure VM and the Sentinel
The security design is the most technically interesting part of this launch. The agent harness runs inside a systemd-nspawn runtime cell with filtered syscalls and limited kernel capabilities. Security critical services sit outside that cell, on the same VM. A separate Sentinel agent approves every connector action and every network request, at both layer 4 and layer 7. Muse proposes; only Sentinel permits. Credentials are handled through surrogation. The agent only ever sees placeholder tokens, and Sentinel injects real secrets at the network boundary. That makes credential exfiltration via prompt injection structurally futile, since there is nothing real to steal. Kernel level eBPF taint tracking distinguishes clean requests from those that touched user data, gating approvals accordingly. The browser sub agent sees an accessibility tree, not the raw DOM, and cannot execute JavaScript. The email connector even filters out one time passcodes and password reset links by default.
Interactive Explainer: How 1 Muse Action Gets Approved
The embed below walks through the approval pipeline in 5 stages, in Meta’s blue theme. It includes 2 scenarios: a normal purchase and a blocked prompt injection attempt.
What it means
For the average user, this shifts the relationship with AI from conversation to execution. You give an instruction, and the agent handles the logistics. The isolation of the dedicated cloud VM and the Sentinel agent mean the software cannot access your real passwords or sensitive data directly. This architecture addresses the primary fear regarding autonomous agents: that they might leak credentials or act without permission. Developers have access to the underlying model weights and API, allowing them to build tools that rely on this secure execution environment without needing to host the heavy infrastructure themselves.
