Meta Muse turns a consumer AI assistant into a persistent agent with its own secured cloud computer

On September 8, 2026, Meta launched Muse in the United States across iOS, Android, muse.ai and WhatsApp. Unlike a conventional chatbot, Muse can continue executing tasks after the user closes the app, use a browser, fill forms, negotiate, send emails with approval, make purchases and coordinate longer-running goals. Meta runs each user’s agent and connected data inside a dedicated Muse Secure VM and places a separate Sentinel agent between Muse and the internet. Users choose which services the agent can access and can revoke those permissions. Meta says a more strongly encrypted Confidential VM mode is planned later in 2026. The launch is free for ordinary use with paid higher-usage tiers; Reuters reports $20/month and $100/month subscription options.

Consumer AI is moving from answering questions to holding credentials and taking consequential actions over time. That changes the product boundary for builders: identity, permission scopes, approval checkpoints, payment delegation, audit trails, prompt-injection defenses and revocation become central UX rather than infrastructure details hidden behind an enterprise agent. Muse also demonstrates one architectural answer to agent containment—a dedicated execution environment plus a separate policy agent—while Meta’s own safety write-up makes clear that giving an unattended model inbox, calendar, shell and web access creates failure modes that ordinary chat products do not face.

Muse can continue work after the user closes the client and return when something changes or when approval is needed. Meta describes tasks ranging from travel booking and selling a car to longer-running plans. That persistence matters because the risk model is no longer limited to one synchronous prompt/response turn: the system may encounter new pages, messages and state while the user is absent.

Meta says every Muse runs in its own Muse Secure VM with a browser. Connected-service data and credentials are stored there rather than shared across users. Muse itself is designed not to see raw passwords or payment details; credentials can be used from secure storage, and payments can use one-time-use card details through Stripe Link. Meta says Shop Pay and 1Password support are planned.

Meta separates a Sentinel agent from Muse at the system level. Internet-bound actions pass through Sentinel, which can allow, block or require user confirmation. Sensitive actions such as sending an email or making a purchase are designed to trigger explicit approval, and Muse exposes an audit trail of completed and planned activity.

Users choose which services Muse connects to and, for some integrations, what level of access it receives—for example read-only email versus permission to send. Access can be revoked later. That is a useful pattern for any consumer agent: broad account connection should not automatically imply every available action, and revocation needs to work independently of conversational memory.

Meta says internal use began early in 2026 and describes handing the system inboxes, calendars and a shell while allowing it to run unattended. Its security engineering emphasizes prompt-injection awareness, long-trajectory instruction following and containment. Independent reporting says internal testing also exposed reliability and security problems before launch. The important takeaway is not that Meta has eliminated agent risk, but that consumer autonomy is forcing vendors to build explicit execution and policy boundaries around the model.

Meta says Muse Confidential VM will arrive later in 2026 with encryption controlled by a user-held key so that even Meta cannot access the VM’s data and conversations. The launch product instead relies on Secure VM isolation, policy controls and an opt-out from using interactions to train Meta’s models. Builders should distinguish shipping privacy guarantees from announced future architecture.