# Meta Muse turns a consumer AI assistant into a persistent agent with its own secured cloud computer Meta’s new Muse personal agent can keep working after the user closes the app, connect to everyday services, browse and fill forms, send messages and make purchases, while a separate Sentinel system mediates internet actions inside a dedicated cloud VM. The material change is not another Meta model launch. Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product, making permission design and agent containment part of ordinary personal software rather than an enterprise-only problem. - Status: Active - Published: 2026-09-09T20:32:37+12:00 - Updated: 2026-09-09T20:32:37+12:00 - Categories: Artificial Intelligence, SaaS, AI Agents, AI SaaS - Tags: agent security, AI agents, Meta, Muse, privacy - Canonical HTML: https://beyondthe.news/dossiers/meta-muse-personal-agent-secure-vm-sentinel-whatsapp ## What changed On September 8, 2026, Meta launched Muse in the United States across iOS, Android, muse.ai and WhatsApp. Unlike a conventional chatbot, Muse can continue executing tasks after the user closes the app, use a browser, fill forms, negotiate, send emails with approval, make purchases and coordinate longer-running goals. Meta runs each user’s agent and connected data inside a dedicated Muse Secure VM and places a separate Sentinel agent between Muse and the internet. Users choose which services the agent can access and can revoke those permissions. Meta says a more strongly encrypted Confidential VM mode is planned later in 2026. The launch is free for ordinary use with paid higher-usage tiers; Reuters reports $20/month and $100/month subscription options. ## Why it matters Consumer AI is moving from answering questions to holding credentials and taking consequential actions over time. That changes the product boundary for builders: identity, permission scopes, approval checkpoints, payment delegation, audit trails, prompt-injection defenses and revocation become central UX rather than infrastructure details hidden behind an enterprise agent. Muse also demonstrates one architectural answer to agent containment—a dedicated execution environment plus a separate policy agent—while Meta’s own safety write-up makes clear that giving an unattended model inbox, calendar, shell and web access creates failure modes that ordinary chat products do not face. ## The agent persists after the conversation ends Muse can continue work after the user closes the client and return when something changes or when approval is needed. Meta describes tasks ranging from travel booking and selling a car to longer-running plans. That persistence matters because the risk model is no longer limited to one synchronous prompt/response turn: the system may encounter new pages, messages and state while the user is absent. ## A dedicated VM holds the agent, connected data and credentials Meta says every Muse runs in its own Muse Secure VM with a browser. Connected-service data and credentials are stored there rather than shared across users. Muse itself is designed not to see raw passwords or payment details; credentials can be used from secure storage, and payments can use one-time-use card details through Stripe Link. Meta says Shop Pay and 1Password support are planned. ## Sentinel is a second agent that mediates internet actions Meta separates a Sentinel agent from Muse at the system level. Internet-bound actions pass through Sentinel, which can allow, block or require user confirmation. Sensitive actions such as sending an email or making a purchase are designed to trigger explicit approval, and Muse exposes an audit trail of completed and planned activity. ## Permission scope becomes product design Users choose which services Muse connects to and, for some integrations, what level of access it receives—for example read-only email versus permission to send. Access can be revoked later. That is a useful pattern for any consumer agent: broad account connection should not automatically imply every available action, and revocation needs to work independently of conversational memory. ## Meta’s own safety material shows why the containment layer exists Meta says internal use began early in 2026 and describes handing the system inboxes, calendars and a shell while allowing it to run unattended. Its security engineering emphasizes prompt-injection awareness, long-trajectory instruction following and containment. Independent reporting says internal testing also exposed reliability and security problems before launch. The important takeaway is not that Meta has eliminated agent risk, but that consumer autonomy is forcing vendors to build explicit execution and policy boundaries around the model. ## The stronger privacy mode is still future-facing Meta says Muse Confidential VM will arrive later in 2026 with encryption controlled by a user-held key so that even Meta cannot access the VM’s data and conversations. The launch product instead relies on Secure VM isolation, policy controls and an opt-out from using interactions to train Meta’s models. Builders should distinguish shipping privacy guarantees from announced future architecture. ## Key details - Muse launched September 8, 2026 and is initially rolling out in the United States. - It is available through dedicated iOS/Android apps, muse.ai and WhatsApp. - Muse can keep working after the user closes the app and return for approvals or changed state. - Each user gets a dedicated Muse Secure VM containing the agent, browser and connected-service data. - A separate Sentinel agent mediates actions reaching the internet. - Users can choose and revoke connected-app permissions; Meta describes granular email read/send choices. - Sensitive actions such as sending email or purchasing are designed to request user approval. - Stripe Link supports agent purchases with one-time-use card details; Shop Pay and 1Password support are planned. - Meta says interactions can be opted out of model training and are not shared with Meta's ad systems. - Muse Confidential VM, with a user-held encryption key, is planned later in 2026. - Reuters reports free access plus $20/month and $100/month subscription tiers. ## Builder takeaways - Separate model reasoning from action authorization. A second policy/enforcement layer is easier to inspect and constrain than relying only on the model to self-police. - Scope connected-service permissions by capability—read, write, send, purchase—not merely by account connection. - Require fresh confirmation for high-consequence actions even when an agent has standing access to the underlying service. - Design persistent agents around resumable state, explicit audit trails and clear notification when work continues without the user present. - Keep raw credentials and payment details outside model-visible context wherever possible; provide constrained credential-use primitives instead. - Treat prompt injection as an execution-security problem once an agent can browse, read messages or invoke tools, not as a content-quality issue. - Be precise about privacy claims: a dedicated VM and policy isolation are different guarantees from end-to-end or user-key-controlled encryption. ## What to watch - Whether Meta publishes independent audit results or more detailed Sentinel failure/bypass data. - The rollout and technical guarantees of Muse Confidential VM. - Expansion outside the U.S. and into Meta AI glasses. - Whether app integrations expose standardized granular permission scopes or rely on service-specific browser automation. - Real-world evidence on prompt-injection, mistaken approvals and unauthorized or unintended actions. - How paid-tier limits are defined and whether agent work is metered by task, compute, time or another unit. ## Uncertainties - Meta's security and privacy architecture is largely described through first-party material and has not yet accumulated broad independent production evidence. - The Confidential VM design is announced for later in 2026 and is not the default launch architecture. - Reuters reports specific paid subscription prices, while Meta's launch post only describes free use plus subscription plans without publishing those price points in the announcement. - The breadth and reliability of individual third-party app integrations will vary and is not established by the launch examples. ## Sources - [Introducing Muse: The World’s First Personal AI Agent Built for Everyone](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/) — Meta · primary announcement · 2026-09-08T00:00:00+12:00. Primary launch source for availability, persistent execution, Secure VM, Sentinel, permissions, payments and future Confidential VM. - [How We Built Safety Into Muse](https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse) — Meta AI Research · primary engineering · 2026-09-08T00:00:00+12:00. Primary technical context on unattended agent use, prompt-injection defenses, tool calling and containment. - [Meta launches AI agent that can access other apps to send emails, make payments](https://www.reuters.com/business/meta-launches-ai-agent-that-can-access-other-apps-send-emails-make-payments-2026-09-08/) — Reuters · independent reporting · 2026-09-08T00:00:00+12:00. Independent rollout, subscription-price and internal-testing context. - [Meta launches personal AI agent, Muse, emphasizes safety and privacy](https://apnews.com/article/3a4572eb4cf4e95d8a0dfdad6e6ca065) — Associated Press · independent reporting · 2026-09-08T00:00:00+12:00. Independent confirmation of U.S. launch and consumer-agent positioning.