What is Meta Muse? Meta's personal AI agent explained

Meta Muse is a personal AI agent that Meta announced on 8 September 2026 and describes as "a secure, private personal AI agent that proactively helps with people's goals and suggests ideas". The part that matters is where it runs: not on your phone, but on a Meta-hosted virtual machine with its own browser and its own file system, holding the credentials for every account you connect to it. If you are in the United States or Canada, over 18, and you want an agent without hosting anything yourself, Muse is the least effort on offer; if you want your credentials to stay on hardware you control, it is the wrong shape of product and a self-hosted agent is the alternative.

This page covers what Muse does, where it runs, who can use it, what the plans cost, how its permission model works, and the things worth knowing before you connect an account. Every fact below is quoted from Meta's own pages except where a paragraph names another source instead.

#What does Muse actually do?

Meta's framing is that Muse completes work rather than answering questions. The newsroom post says it "doesn't just answer questions, it actually does the work" and that it "helps people stay on top of things, takes tasks and projects off their plate". The concrete examples Meta gives are handling tasks "like sending an email or booking travel", and Meta says Muse "can open a browser, fill out forms, and negotiate on their behalf".

Meta's design write-up is more specific about the machinery. Muse has "its own computer, with a file system and a terminal, so it can write its own code", and "access to a full web browser, so it can search, navigate sites, fill out forms, and complete transactions". It can "produce things for you", listing "documents, PDFs, web pages, and more". The same page describes the interaction model as one long running conversation rather than a series of prompts, and says Muse "is always working": "Once you've set a goal or a task, Muse continues to work on a schedule and in response to relevant events."

That last property is the one that separates an agent from a chatbot, and it is the same property that makes a self-hosted agent worth running. If you have not met the category before, what a personal agent looks like day to day is a reasonable starting point.

#Where does Muse run, and where do your credentials sit?

On Meta's computers, in both cases. The newsroom post says Muse "runs on Muse Secure VM, a dedicated secure computer with its own browser", and describes it as "where Muse lives and where the data and credentials for any service a person connects are securely stored".

Meta's security write-up describes that VM as separating "what you and your Muse do from everything we've built in to keep you safe using Linux isolation primitives". The agent runs inside a container managed with systemd-nspawn, and Meta notes that "Root inside the runtime cell is mapped to an unprivileged host user so runtime cell root is not host root." Security services sit outside that cell, including a component that stores credentials and workers that run built-in connector code "with tightly scoped privileges", each with "explicit credential allowlists".

Two sentences on that page are worth reading slowly, because they bound what "secure" means here. Meta says the design "restricts access to your data by Meta personnel through operational policies", and then says plainly: "It does not prevent Meta from accessing data when necessary to support, secure or operate the service." Meta says a future Muse Confidential VM "is intended to cryptographically and verifiably prevent Meta from accessing data in your VM", and the newsroom post describes it as a VM where "the whole VM, including a person's data and conversations with Muse, is encrypted with a key only they hold". That product is described as coming later, not as something you can use now.

#Who can use Muse, and on what devices?

Meta's newsroom post says Muse "is rolling out in the US on iOS, Android, and muse.ai, and coming soon to AI glasses". The Muse Supplemental Terms set the age floor: "you cannot use Muse if you are under the age of 18 (or such greater age required in your country or territory)". The US App Store listing for Muse from Meta, published by Meta Platforms, Inc., carries an 18+ rating, is free with in-app purchases, requires iOS 18.0 or later, and lists iPhone as the only supported device. The same app from the same seller is also live on the Canadian App Store, free with in-app purchases, and the Supplemental Terms' disputes section is written for users who "live in the US or Canada", so Muse is available in both countries today.

WhatsApp is a fourth surface, and it is Meta's own word rather than a press report. The newsroom post says Muse "is designed around the way people already communicate, so talking to it works just like messaging another person, in the Muse app or directly in WhatsApp". That sentence sits in a different part of the page from the rolling-out line quoted above, which names only the apps and the website, so the two read as a narrower list than Meta actually gives. TechCrunch reported the same four surfaces on 8 September 2026.

The Mac app is a fifth surface, and Meta documents it itself. Meta's own download page for Muse is titled "Download Muse: Free AI Agent for Mac & Mobile", and Meta's Help Center carries a page titled "How Muse works with files and apps in your Mac". The September launch post predates the Mac app and does not mention it. TechCrunch reported on 18 September 2026 that "Meta's new AI assistant app, Muse, is now available on Mac", and that on a Mac "Muse can interact with your files, messages, calendar, notes, and mail, all within their native applications". TechCrunch does not date the app's arrival itself. The post it embeds does: Alexandr Wang (@alexandr_wang) wrote "muse for mac is HERE!!" on 17 September 2026.

There is also a limit on availability that sits slightly at odds with a clean "it is available in the US and Canada" summary. Meta's own subscriptions page says: "Muse and Muse subscriptions are in limited testing and aren't available in all locations yet."

#What does Muse cost?

Meta's newsroom line is that Muse is "free for most of what people need, with subscription plans for people who want to do more". The Help Center puts numbers on it. The free tier "is available for free with a usage limit", and "If you reach your free usage limit and want more usage, you can upgrade to a paid subscription or wait until your free usage limit refreshes." The Help Center does not give the size of the free allowance. Mark Zuckerberg's launch-day post on Threads does: Meta is "providing Muse for free for up to 100 million tokens per week".

One practical detail about the free tier comes only from the press. TechCrunch reported on 8 September 2026 that "Muse requires a payment card to get started". Meta's subscriptions page, which is where the prices below come from, says nothing about a payment method, so read the free tier as free to use rather than as something you can start without a card.

Plan	Price	Included usage	Where you can subscribe
Free	$0	Up to 100M tokens per week, per Mark Zuckerberg's launch post	Not applicable
Power	$20 per month	500M Muse tokens per week	muse.ai and the mobile app
Maximum	$100 per month	3B Muse tokens per week	muse.ai and the mobile app

Meta measures the paid tiers in "Muse tokens", and Zuckerberg's post gives the free allowance in tokens too, so the three rows are comparable with each other: Power is five times the free allowance and Maximum is thirty times it. Meta does not publish a conversion between a token and a task, so nothing outside the table can be compared with them. TechCrunch reported the same two prices on 8 September 2026.

#Can you write your own skills for Meta Muse?

Not in the sense that word has in most agent tooling. The consumer Muse agent has no user-authored skill file you drop in a directory. Muse Code, the separate developer product covered further down, is the opposite: its documentation says it "ships built-in skills, and you can add your own or import them from other agents", loading user skills from $XDG_CONFIG_HOME/muse/skills and ~/.agents/skills. The rest of this section is about the consumer agent.

Meta's security write-up says Meta's own team has "written and iterated on SKILLs", which it defines as "detailed instructions to Muse" on how to get the most out of each connector. Those ship with the product. The same page says Muse can also "write its own custom connectors for other services".

The Help Center describes connectors as "apps and services provided by Meta or third-parties" that give Muse new capabilities, and says Facebook, Instagram and Threads connect automatically when the accounts are linked through Accounts Center, with no manual setup. For a service Meta has not covered, you ask Muse to build one: "Muse will guide you through the process, which can involve retrieving API information from the service."

This is the structural difference between Muse and a file-based agent, and it cuts both ways. There is nothing to audit because there is nothing you wrote, and equally nothing you can inspect, version or pin. On platforms where you do install somebody else's instructions, the opposite discipline applies, and our skill security audit checklist is the version of that we point people at.

#How does Muse ask for permission?

Approval is a gate, not a suggestion. Meta's newsroom post says Muse "checks with the person before sensitive actions like sending an email or making a purchase". The security write-up describes what happens mechanically: when the system decides an action needs approval it "creates a pending approval and execution stops", and the user gets "a dialog...directly within the client UI" carrying the exact action. Meta describes approvals as "strict capabilities, not conversational suggestions", with scopes that can be "one-time, session-scoped, task-scoped, time-bounded, or perpetual".

The Help Center gives the user-facing version of those scopes as five choices: "Allow once: Muse proceeds this one time", "Allow for this task", "Allow for this site", "Always allow" and "Deny". Which actions trigger a prompt depends on your settings, and the page describes those settings as covering "every write action and important read actions" alongside "sensitive actions like payments or purchases".

After the fact, the Help Center says you can "Visit your Activity log by tapping your assistant icon to see a chronological record", and that "You can ask your Muse to undo or stop some actions, like reading a website or comparing prices." Note the word "some". Meta does not claim every action is reversible.

#Is Muse the same thing as Muse Spark or Muse Code?

No, and the names are close enough to send you to the wrong documentation. Meta uses "Muse" across several products.

• Muse is the personal AI agent this page is about: the consumer product announced on 8 September 2026 that runs in the Muse Secure VM.
• Muse Spark is a model. Meta's research blog announced Muse Spark 1.3 on 2 September 2026, saying it "delivers improved performance across agentic and coding tasks", and that it is "available on Muse Code and Meta Model API".
• Muse Code is the developer-facing product that same blog names as one place the model is available. It is the one that takes skills you write: its docs say it "ships built-in skills, and you can add your own or import them from other agents", read from $XDG_CONFIG_HOME/muse/skills, ~/.agents/skills and a repository's own .agents/skills. None of that applies to the consumer agent.

When you search for "Muse", check which of these the page in front of you is about before you act on it. A pricing page for the Meta Model API tells you nothing about what the consumer agent costs.

#What should you know before connecting an account?

Four things, all from Meta's own pages.

Prompt injection is unsolved, and Meta says so. The security write-up lists real defences: Meta says "our model is trained to recognize and resist prompt injection", that "When data enters the model's context from any external source, it's labeled as untrusted input", and that it runs "An ensemble of multiple prompt injection detection classifiers". It then says "Prompt injection remains an open problem in the industry", and that Muse "will sometimes make mistakes". An agent with a browser and your credentials reads attacker-controlled text all day. This is the failure mode behind most real agent security incidents, and it is not specific to Meta.

Browsing as you has advertising consequences. Meta states that "Muse doesn't share your conversations or the data in your Virtual Machine with Meta ad systems." It also states the second half: "When Muse browses the internet, it will appear as your activity, so if you ask Muse to buy a shirt from a clothing designer's website, that designer might use your visit to show you an ad on Instagram." Both sentences are true at once, and only the first one usually gets quoted.

The terms put the outcome on you. The Muse Supplemental Terms say "You are solely responsible for the instructions, goals, and guidance you provide to Muse" and that "You are also solely responsible for the actions Muse takes". They add that Meta "DOES NOT REPRESENT OR WARRANT THAT MUSE WILL PERFORM...IN ACCORDANCE WITH YOUR INSTRUCTIONS", and cap what Meta can owe you: aggregate liability "WILL NOT EXCEED THE GREATER OF $250 OR THE AMOUNT YOU HAVE PAID US IN THE TWELVE MONTHS PRECEDING THE EVENTS GIVING RISE TO THE MOST RECENT CLAIM", except for claims arising from Meta's "GROSS NEGLIGENCE, WILLFUL MISCONDUCT OR FRAUD". The capitals are the document's own. Read the "greater of" carefully: on the free tier the cap is $250, and on a paid plan it is whatever you have paid in the past year if that is more. The same section names "MUSE TAKING ANY UNINTENDED, ERRONEOUS, OR UNAUTHORIZED ACTION" as among the things covered, so if Muse buys the wrong thing, that cap is the ceiling on Meta's exposure, not yours.

Availability can move. Meta's subscriptions page describes Muse as in limited testing and not available in all locations, so an account that works today is not a commitment.

#Should you use Muse?

Muse is a reasonable first agent if you are in its availability window, you want zero setup, and the accounts you plan to connect are ones you would be relaxed about a vendor holding credentials for. The free tier is enough to find out whether the category suits you, and the approval model is better specified than most.

It is the wrong tool if you need the credentials on your own hardware, if you want to write and version the instructions your agent follows, or if you need it outside the United States and Canada today. Those are the trade-offs a self-hosted agent exists to make, and the comparison against a hosted chat product covers the same ground from the other direction.

The current state of every fact on this page, including plans, surfaces and availability, is tracked on the Meta Muse platform hub.