Meta Muse vs OpenClaw: hosted vs self-hosted personal agents

Pick Meta Muse if you want a personal agent with nothing to install, nothing to keep awake and a permission layer you cannot accidentally switch off. Pick OpenClaw if you need to choose your own model, write your own skills, reach the agent from a chat app you already use, or keep the agent on hardware you control. The deciding question is not which one is cleverer: it is whether you would rather Meta ran the machine or you did.

Everything below is checked against both vendors' own pages, fetched on 18 October 2026. One naming note first, because the word is overloaded: this article is about Meta Muse, the personal agent from Meta. It is not about Muse Spark, Muse Code or Muse Glimmer, and it is not the unrelated muse.ai video product that search results sometimes surface.

#What is Meta Muse?

Meta describes Muse in one line on its newsroom: "Muse is a personal AI agent. It doesn't just answer questions, it actually does the work." The architecture is the interesting part. Muse "runs on Muse Secure VM, a dedicated secure computer with its own browser", and that VM "houses both the agent and a person's data". Meta's security write-up puts the design plainly: "The right mental model is two isolated security domains on one box, not an LLM powered agent with root."

The second domain is a separate agent called Sentinel. Meta says "Sentinel is a separate host-side agent from your Muse" and "the sole permission authority for connector actions and network egress". The division of labour is explicit: "Muse proposes actions, but only Sentinel can grant permission to perform action." On the newsroom page the same idea is compressed to a sentence worth remembering: "Nothing Muse does reaches the internet unless the Sentinel approves it."

Meta's announcement carries two dates, 8 September 2026 and 30 September 2026, printed adjacently with no label saying which is which. Our Meta Muse platform hub tracks the product's details as they change, and is Meta Muse safe? goes deeper into the security model than this comparison does.

#What is OpenClaw?

OpenClaw is a self-hosted gateway you install yourself. Its documentation describes it as "MIT licensed, community-driven", "developed in the open by the OpenClaw Foundation, an independent 501(c)(3)", with "no paid tier, no telemetry by default beyond a version check you can turn off, no lab owns it".

It installs on "macOS, Linux, or Windows", and the install page notes that "Windows users can start with the native Windows Hub app, the PowerShell CLI installer, or a WSL2 Gateway". It wants "Node 24.16+ or 26.1+", and "Node 26 is recommended; the installer provisions Node 26 on macOS and Node 24 LTS on Linux when Node is missing".

The part that has no Muse equivalent is how you reach it. OpenClaw's channels page lists a long roster of chat platforms it plugs into, among them Discord, Google Chat, iMessage, Matrix, Microsoft Teams, Signal, Slack, Telegram, WhatsApp and Zalo. The agent comes to the app you already have open. The free getting started walkthrough is the shortest route to a running one, and the OpenClaw platform hub collects the rest.

#Muse vs OpenClaw at a glance

Question	Meta Muse	OpenClaw
Who hosts it	Meta, in a per-person "Muse Secure VM, a dedicated secure computer with its own browser"	You, on your own macOS, Linux or Windows machine (native or WSL2)
Price	Free "with a usage limit" that Meta does not quantify; Power $20/month (500M Muse tokens per week); Maximum $100/month (3B per week)	MIT licensed with no paid tier; you pay your model provider, or nothing extra for a local model
Availability	"Rolling out in the US on iOS, Android, and muse.ai, and coming soon to AI glasses"; subscriptions are "in limited testing" and not in all locations	Anywhere your own machine runs, on macOS, Linux or Windows; needs Node 24.16+ or 26.1+
Extension model	No documented user-authored skills: "Skills are developed by Meta and are already part of Muse". You ask Muse to build a Custom Connector instead	You write SKILL.md files in your own workspace; ClawHub is "the public skills registry"
Approvals and security	Sentinel is "the sole permission authority for connector actions and network egress"; approval modes range from "Always ask" to asking only for write and important read actions	tools.exec.mode with five modes from deny to full; "host exec uses the stricter result of OpenClaw config and the host-local approvals file"
Data use	Credentials sit "in a separate isolated container in your VM, not in other Meta services"; Meta "doesn't share your conversations or the data in your Virtual Machine with Meta ad systems"	Memory is plain Markdown in ~/.openclaw/workspace; but the default embedding provider is OpenAI, so indexed memory leaves your machine unless you change it

#Who hosts the agent, and why it matters

This is the whole comparison in one row of that table, and it cuts both ways.

Muse's hosting is the product. You do not provision anything, you do not keep a machine awake, and the isolation Meta describes is isolation you could not easily build yourself: a dedicated VM per person, "contained so no one else's agent can reach it", with a second agent holding the only key to the network. Meta says it will introduce Muse Confidential VM later this year, with the whole VM "encrypted with a key only they hold, so not even Meta can access it". That is a roadmap statement rather than a shipped feature, so do not plan around it yet.

OpenClaw's hosting is your problem and your lever. Nothing runs when your host is off, which is why so many people put the gateway on a machine that stays up. In exchange you choose the model, you can read every file the agent remembers, and no vendor's policy change can alter what your copy does.

#What does each one cost?

Meta's newsroom gives the shape: Muse is "free for most of what people need, with subscription plans for people who want to do more". The numbers are on Meta's own subscriptions page, which is where to read them rather than in press coverage. Power is "$20/month" with "500M Muse tokens per week"; Maximum is "$100/month" with "3B Muse tokens per week". The free tier is described only as "Muse is available for free with a usage limit", and that page does not say how large the limit is. If you reach it, Meta says "you can upgrade to a paid subscription or wait until your free usage limit refreshes".

OpenClaw's software cost is zero and its running cost is entirely your model bill. That makes a direct price comparison impossible in either direction: a heavy OpenClaw user on a frontier API can spend more than $100 a month, and a user running a local model through Ollama can spend nothing. The honest comparison is that Muse's price is predictable and capped in tokens, while OpenClaw's is uncapped and under your control.

#Where can you actually use them?

Here the gap is wide and it is the thing most likely to decide this for you. Meta's announcement says Muse "is rolling out in the US on iOS, Android, and muse.ai, and coming soon to AI glasses", and the subscriptions page warns that Muse "and Muse subscriptions are in limited testing and aren't available in all locations yet" and that "benefits and availability may vary by region and account".

OpenClaw has no availability question, because it is software you install. If your machine runs macOS, Linux or Windows and has a supported Node, you can run it, wherever you are.

For a wider field than these two, personal AI agents compared sets both of them against ChatGPT, Gemini Spark, Grok Bot and Instinct on the same axes.

#Can you write your own skills?

No, and yes, and this is the clearest functional difference between them.

Meta's help page on Muse skills says "Skills are developed by Meta and are already part of Muse", that they are "automatically available within Muse and you don't need to install them separately", and it does not describe any way to author or upload one of your own. The route Meta does document sits on the connectors page: "If you want to connect to a service not yet available in the Connector list, you can ask Muse to create a Custom Connector", a process that "can involve retrieving API information from the service", with the credentials kept in Muse's "Secure Credentials Store". Read the warning on that page before you use it: "Meta doesn't review custom connectors or how they use your information", so "grant access with caution and review the provider's privacy policies". The agent writes the integration and nobody vets it.

OpenClaw is file-based and the format is the portable one. Its docs define skills as "markdown instruction files that teach the agent how and when to use tools", and the shape is minimal: "Each skill lives in a directory containing a SKILL.md file with YAML frontmatter and a markdown body", where "every skill needs at minimum a name and description in the frontmatter". They load from your workspace, at <workspace>/skills and <workspace>/.agents/skills among other paths. Sharing goes through ClawHub, "the public skills registry", with openclaw skills install @owner/<slug>.

OpenClaw's own docs attach the warning that matters: "Treat third-party skills as untrusted code. Read them before enabling." That applies to anything you install from a registry, and ClawDocx does not vet third-party skills either: read our skill security audit before you install somebody else's SKILL.md, and do not treat any of them as endorsed.

#How does each one ask permission?

Both have a real approvals story, built differently.

Muse's is architectural and not yours to configure away. Sentinel holds the permission authority, so Meta can say "nothing Muse does reaches the internet unless the Sentinel approves it". On top of that sits a user-facing setting: Meta's page on guidance and approval describes an "Always ask" mode where "your Muse will ask for permission before any action", and an "Ask for some actions" mode where Muse asks "before every write action and important read actions". Meta also says Muse checks with you "before sensitive actions like payments or purchases", that you should "oversee its actions regularly", and it is candid about the limit: some actions, "like sending an email, cannot be reversed".

OpenClaw's is configuration, with five documented modes for tools.exec.mode: deny ("block host exec entirely"), allowlist ("run only allowlisted commands; silently deny misses"), ask ("run allowlist matches; ask a human on misses"), auto ("run allowlist matches; review eligible misses with allow, deny, or ask") and full ("run host exec without ordinary policy prompts"). The docs recommend auto "for coding agents that need useful host access without making every miss a human prompt", and the layering is strict outside one exception the page names for a full-permission Gateway session: "host exec uses the stricter result of OpenClaw config and the host-local approvals file."

The difference is who can relax it. On OpenClaw, you can set full and remove the prompts, which is a freedom and a foot-gun. On Muse you cannot, because the authority lives in a domain you do not administer. Our OpenClaw security hardening guide covers the settings worth changing before you expose a gateway to anything.

Neither vendor claims this is solved. Meta's security write-up says "prompt injection remains an open problem in the industry", and that Muse "will sometimes make mistakes".

#What happens to your data?

Meta's claims here are specific enough to hold it to. Credentials for connected services are "stored in a separate isolated container in your VM, not in other Meta services", and "the agent never sees real tokens". On advertising, Meta says it "doesn't share your conversations or the data in your Virtual Machine with Meta ad systems". On training, it says agent trajectories "are sanitized to remove key personally identifiable information before being used in training", which is a statement that training happens, with a filter, rather than that it does not.

Meta also documents two concrete limits on what Muse can reach. Its email connector "filters out one-time tokens, password reset links, and login magic links", so that email access does not become a way to act as you elsewhere. Its browser "has no ability to run javascript in the page context".

OpenClaw's data story is simpler and less absolute than the self-hosting label suggests. Memory lives in plain Markdown "in your agent's workspace (default ~/.openclaw/workspace)", and the docs state the property that makes it auditable: "the model only remembers what gets saved to disk; there is no hidden state." But the same page notes that the default embedding provider is OpenAI, so the content indexed for memory search is sent there unless you pick a local option such as Ollama or LM Studio. Self-hosting the agent is not the same thing as self-hosting every model call, and that is the detail most comparisons of these two get wrong.

#What we could not pin down

Three things, named here rather than guessed at.

How big Muse's free tier is. Meta's subscriptions page quantifies both paid plans and describes the free one only as having "a usage limit". No Meta page we fetched gives the number, so this article does not supply one.

Which surfaces and countries Muse covers today. Meta's newsroom names the US, iOS, Android and muse.ai, with AI glasses "coming soon". We found third-party write-ups claiming Canada availability, a WhatsApp surface, a Mac app and an 18+ age rule. None of those appears on the Meta pages we read, so none of them is stated above. Treat the newsroom list as the floor and check in the app for your own region.

Whether Muse will ever take a user-written skill. The skills help page does not address it either way. We searched Meta's own material for an authoring or upload path and found none; absence from the pages we read is not proof that none exists anywhere, so the sentence above is about what Meta documents, not about what Meta permits.