Meta announced Tuesday that Muse is now available for iOS and Android users via a dedicated app, the Muse.ai website, and direct messaging within WhatsApp.
The service operates in a secure cloud environment where the company claims privacy is built in from the start. Users can try the tool for free, though automating complex digital tasks requires a paid AI subscription plan. Meta states that owners of its AI glasses will soon be able to interact with the agent as well.
The product
Muse is Meta’s latest attempt to compete with viral AI agents like OpenClaw and Instinct. The tool is a product of Meta Superintelligence Labs, the unit CEO Mark Zuckerberg formed roughly a year ago to catch up with rivals OpenAI and Anthropic.
WIRED previously reported that Meta tested Muse internally under the codename “Hatch,” allowing employees to use it for autonomous web browsing and operating third-party applications.
Meta claims the product works out of the box with no learning curve. Users can prompt the agent in natural language to send emails, book travel, or assist in selling a car. The system can also make purchases on a user’s behalf using payment infrastructure designed by Stripe.
Stripe’s Link tool issues a single-use card number to prevent agents from accessing real financial information online. Meta says Muse is the first AI agent covered by Link’s purchase protections for agents, which guarantees no-fee returns.
Security and privacy
Meta is seeking to differentiate itself by focusing on security and privacy features. The agent debuts with an architecture for all users dubbed Secure VM, which isolates each user’s activity in a virtual machine.
This design keeps untrusted data from the web and integrations separate from the part of the agent that can actually take action. A personal AI agent requires a lot of user trust, something Meta has struggled with significantly over the years.
David Singleton, Meta Superintelligence Lab’s vice president of engineering for consumer products, says the team designed the system deliberately to handle personal data responsibly.
“We know it’s really important, if we’re going to build a product like this that can access a lot of sources of personal data, that we’re really responsible with that, so we’ve designed this system very deliberately,” Singleton says.
He adds that the system includes a component called the Sentinel. This looks out for everything moving out of the virtual machine. The Sentinel either matches the action to an existing policy where permission was given or presents a human-in-the-loop dialog to ask the user to approve the action.
Singleton notes that these check-in prompts come directly to the user and are not filtered through the model. This protects against attacks like prompt injections.
The Secure VM architecture is not a truly locked box. While Meta is barred by policy from accessing user Muse data, it would still be technically possible. Users can opt out of allowing their data to be used for training.
Eventually, Meta will offer Muse “Confidential VM.” This version is designed so each VM runs in a trusted execution environment and users manage their own access keys locally on their devices. No one else, including Meta, can access that user’s agent VM.
Confidential VM comes as part of Meta’s work with Moxie Marlinspike, creator of the end-to-end encrypted messaging app Signal. Marlinspike also developed the privacy-focused AI platform Confer in recent years.
WIRED viewed an advance draft of a technical white paper describing Confidential VM. In addition to structuring the system so the user controls their access keys, Meta is giving select security firms access to the source code to regularly audit and verify privacy guarantees.
Meta will also publish the Confidential VM binaries and a transparency log. This allows users to verify the validity and integrity of their connection to Muse.
Singleton emphasizes that Muse Secure VM has already been extensively vetted. Testing included reviews by Meta’s human and agentic red teams and the company’s private bug bounty. Meta is now adding Muse to the scope of its public bounty as well.
Payouts for valid vulnerability findings are up to $300,000. This includes up to $130,000 for successful prompt injection attacks that affect a single user.
What it means
For people making things or managing their digital lives, Muse represents a shift from simple chatbots to tools that execute actions. The focus on Secure VM and Confidential VM suggests a move toward higher standards for data isolation. This could set a new industry baseline where agents operate in isolated environments rather than sharing raw data broadly.
