On September 8, 2026, Meta announced Muse — a personal AI agent that, in the company's words, "actually does the work" rather than answering questions. Within a week it was the No. 1 free iPhone app in the US, ahead of ChatGPT; within five days it had roughly 600,000 downloads; and TIME reported it at 4 million users by early October. It is the most consequential consumer agent launch of the year — and the sharpest argument yet about where the AI race actually goes: not to the lab with the best model, but to the company that can put an agent in a billion inboxes.
This report covers the full picture: what Muse is, every capability Meta has shipped, how the underlying architecture works (the Secure VM and the Sentinel permission broker), the model family behind it (Muse Spark through Muse Wonder and the open-weight release), what it costs, and — with real quotes — what X/Twitter said when it landed, plus the first-six-week aftermath: the Amazon block, the privacy investigation, and the security scrutiny.
What Muse Is
Muse is a personal AI agent — a category Meta is explicitly distinguishing from chatbots and assistants. From Meta's own FAQ: a chatbot answers one question at a time; an assistant handles more complex conversations; an agent "can take real actions across the web and connected apps, work through multi-step tasks on its own, and keep running in the background even after you close the app." That distinction is the product. Muse does not stop at a reply — it opens a browser, fills out forms, books travel, sends email, makes purchases, and keeps working on a goal for hours or days, checking back only when it needs a decision.
| Chatbot | AI assistant | Personal AI agent (Muse) | |
|---|---|---|---|
| Interaction | One question, one answer | Complex conversations, content generation | Takes actions across the web and connected apps |
| Duration | Single exchange | Session | Long-running; continues after the app is closed |
| Proactivity | None | Limited | Monitors, suggests, and advances goals unprompted |
| Control model | — | User prompts | Permissions, approvals, audit trail, user can intervene mid-task |
It was developed under Alexandr Wang, whom Meta appointed its first chief AI officer after buying a 49% stake in Scale AI for $14.3 billion in June 2025. The model lineage started in April 2026 with the first Muse Spark; by launch day, Meta's launch post called it "the world's first personal AI agent built for everyone," rolling out in the US on iOS, Android, and muse.ai, with direct access from WhatsApp and the Mac. At the September 23 event, Meta added a Realtime Avatar (video conversations with a visual representation of the agent), macOS app control, an email address of the agent's own (forward it messages or copy it into threads), and smart-glasses control via a wake word.
Capabilities, Item by Item
- Conversation — message it like a person, in the Muse app (iOS, Android, Mac) or directly inside WhatsApp. You can name it, give it an avatar, and set its communication style.
- Browsing and computer use — Muse opens a real browser, navigates sites, fills out forms, and works through multi-step tasks. The user can watch the browser work and intervene at any point. This is the "computer use" capability that reviewers consistently called the clever part of the UX.
- Long-running background work — the signature feature: a task like "monitor daily weather reports and alert me about rain," or a goal like "sell my car for more," keeps advancing after the app is closed. Muse builds an action plan, tracks progress, and comes back when something changes or when it needs approval (before sending an email, making a purchase).
- Goals and proactivity — give it a goal and it develops a personalized plan, coordinates time and resources, and gets sharper over time, returning with ideas and suggestions. It remembers what matters to you: turn a saved Instagram recipe reel into a grocery list, suggest a dinner-party menu, remember friends' dietary restrictions before sending invites.
- Connectors — connect email, calendar, Instagram, and other daily apps with granular, per-connector permissions (e.g., read mail but don't send). At the September 23 event Meta announced commerce and productivity partners: Stripe, Shopify, Best Buy, Gap, Sephora, Walmart, Wayfair, Expedia, Instacart, GitHub, and Notion.
- Tool building — if a task needs a tool that doesn't exist, Muse builds it for you. That is the strongest claim in the feature set, and the one to watch in practice.
- Purchases — checkout via Stripe Link, the first AI agent covered by Link's purchase protections (coverage for damaged/lost items, price drops, no-fee returns, return guarantee). Link's wallet for agents generates a one-time-use card, so your real card details never touch the transaction. Shop Pay and 1Password (so Muse can use logins you already have) are on the way.
- Generation — answers questions, generates images, creates documents, sets reminders, and monitors things you care about.
Why "built for billions" matters
Most agent products assume a technical user. Muse's explicit design target is a non-technical one: no learning curve, messaging-style UI, a recognizable mascot, an app inside WhatsApp. The launch thread on X that got the most engagement from real users (not tech media) was about people asking Muse to answer emails and manage calendars. Meta is not selling Muse to developers. It is selling it to the person who thinks "chat.com is an AI called chat."
How It Works: The Secure VM and Sentinel
The technically interesting part of Muse is not the agent — it is the computer. Meta's argument: personal agents need a new kind of secure computer, so it built one. Two isolated security domains live on one machine in the cloud:
- Muse Secure VM. A persistent, isolated Linux virtual machine in Meta's cloud, dedicated to you alone. It has real storage, CPU, and memory, and a full browser that you and your agent share. Your VM holds your connected services' credentials and your working files; it keeps state between sessions, so in-progress work survives. No other user's agent can reach it.
- Sentinel. A separate agent on the same machine, kept apart from Muse at the system level. Sentinel is the sole authority for connector actions and network egress: nothing Muse does reaches the internet unless Sentinel approves it, and Sentinel asks you when it needs to. Architectural analyses (eBPF taint tracking, credential surrogation, a host-side permission authority) describe this as a containment-first design — the model never handles the approval request itself, which is the core anti-prompt-injection move.
- Credential surrogation. Muse has no visibility into your passwords or payment methods. Credentials you share go into secure storage that Muse can use but never see; it also cannot see passwords you type into the browser yourself.
- Permissions and audit. You choose which apps connect and exactly how much access each gets (read vs. write, per app). Muse checks with you before sensitive actions, and shows a complete audit trail of everything it has done and plans to do.
- Training and sharing controls. Meta uses your queries for model training by default, with an opt-out. Conversations and VM data are not shared with Meta's ad systems. You can tell it to forget specific things. Later this year, Muse Confidential VM ships the whole VM — data and conversations — encrypted with a key only you hold, so not even Meta can access it.
The mental model from Meta's own security engineering team is: "two isolated security domains on one box, not an LLM-powered agent with root." Defense in depth, because an agent holding private data, untrusted web content, and network access sits directly in the prompt-injection danger zone — the "lethal trifecta" that Simon Willison named, and which most coverage of the launch correctly identified as the reason the architecture has the shape it does. The $130,000 bug bounty Meta put on prompt-injection finds is, as one analyst put it, "both a confession and a strategy."
The Model Family Behind It
Muse runs on Muse Spark, Meta's model line. At launch, Muse Spark 1.3 powered the agent: built for long-horizon agentic work, it sustains multiple workflows in one long thread, generates its own context across messy and conflicting sources, asks clarifying questions when ambiguous, invokes user help when stuck, confirms before consequential actions, and tracks what it has learned across a task. Meta reports a 1M-token context window and a 75.4% score on DeepSWE 1.1.
The independent numbers are the honest ones: Artificial Analysis scored Muse Spark 1.3 max at 62 on its Intelligence Index — behind Claude Fable 5.1 (66) and Claude Opus 5 (63). VentureBeat caught the catch that softens Meta's launch table: max is in limited preview, and the version you can actually sign up for (xhigh) scores 61. Ethan Mollick's reaction to the whole line is the most-cited line in the developer discourse: a solid set of stats still trailing the frontier, but "the most important thing to note is that it is not open weights" — openness was the reason Meta's previous models mattered. Meta corrected that course in mid-October: on October 15 it released Muse Spark Open, an 816-billion-parameter open-weight model it calls the most capable US open-weight model to date, benchmarking ahead of GLM 5.3 and Kimi K3 on agentic tasks and visual reasoning, with custom Helion GPU kernels in SGLang (1.03–3.95× kernel-level speedups). NVFP4 weights run at roughly 530 GB — Meta's own docs show it serving on four Blackwell Ultra GPUs, eight H200s, or, most tellingly, two paired M5 Ultra Mac Studios.
And on October 12, Meta's Superintelligence Lab released its first frontier model: Muse Wonder and the more powerful Muse Wonder Full, which is subscription-only. Bloomberg framed it as the company's most capable model since Zuckerberg's hiring push, a 14-month effort to "reach the AI frontier." Muse will be powered by the Wonder line "soon," per The New York Times. So the model story as of this writing: Spark (open, October 15) for the ecosystem, Wonder (closed, October 12) for the frontier, and the consumer agent getting the upgrade next.
Pricing, Hardware, and the Business Model
Muse is free for most of what people need, with a usage limit on the free tier; beyond that, subscription plans at $20 and $100 a month. Meta says the service will carry no advertising. The business model is the interesting line, from Zuckerberg: the company expects to "profit by taking a small fee from transactions." That is the agent-economy in one sentence — the money is in the checkout, not the subscription, which is exactly why Stripe Link's one-time-card purchase protection and the Best Buy/Walmart/Expedia/Instacart partner roster matter.
On hardware, at Meta Connect 2026 on September 23, Meta introduced Muse Charm, a palm-sized "first device made for Muse" — a keychain/pendant you connect to by voice, touch, and camera, so the agent works away from the phone. It was originally planned for 2027; Zuckerberg pulled the timeline forward to ship by end of 2026. Notably, Meta has not announced a price — no figure on any regional page, the newsroom post, or the keynote. It launched alongside the $1,299 Meta VR Glasses, which the company says will control Muse through the wake word. The Charm and the glasses are Meta's answer to the question "where does this agent live when my phone is in my pocket?"
What X (Twitter) Said
The X reaction split fast and ran loud, and it is worth quoting rather than paraphrasing because the range is the story. A HackerNoon digest of 100 real reactions (developers, Meta staff, reporters, security researchers, executives, ordinary users) plus the direct X posts give the full spectrum:
The genuine enthusiasm
- Tobi Lütke, Shopify's CEO, posted the shortest endorsement Muse got from anyone of his rank: "You should try Meta's Muse app. It's pretty amazing." (@tobi, Sept 9). He separately told X the agent "looks very strong." For a platform-partner CEO to say that in public is a real signal — Shopify was an announced commerce partner.
- Paras Madan (Replit): "So yes, the consumer agent era arrived now: private, sandboxed, and secure." — citing the 1M-token context and the DeepSWE 1.1 score.
- Blake Robbins (Slang.ai): "Muse is very slick. The computer use UX is clever. We all just have full access to super computers via messaging apps now."
- Molly Orsborn, who worked on Muse at Meta: "the best Meta product I've ever used" — the insider's read, worth noting it exists.
- Tiffany Janzen (TiffinTech), who sat down with Zuckerberg, was the most enthusiastic named user on record: "I've been using Muse for a while now, and I genuinely can't imagine my day-to-day without it!!" — worth weighing alongside the access that interview implies.
The strategy question
- aj0strow: "The strategy was unclear until now." He reads Muse as the moment Meta's acquisitions, hires, and open-sourcing resolve into personal AGI, priced for intelligence-per-dollar because most users will never pay.
- abixb, the thread's most-discussed comment: Meta's play is to capture the "'normie-tier' of AI users." His evidence: an accounting friend, asked which GPT tier she used, replied "just ChatGPT, what is Sol?"
- alfiedotwtf thinks they're playing the wrong game: "What's Meta's moat? Content and doom scrolling…" — and proposes real-time personalized entertainment, with Meta as the next generation's Disney, as the actual moat.
- Ethan Mollick, the assessment that mattered most to developers, on the model underneath: solid stats still trailing the frontier, but "the most important thing to note is that it is not open weights." Openness was the entire reason Meta's previous models mattered; without it, Spark's value is much harder to predict. (The October 15 Spark Open release is Meta's direct answer to this exact line.)
The trust and privacy problem
- TechCrunch framed the whole product as a single transaction: to use Muse, consumers will have to trust Meta with more of their personal information than ever before.
- Simon Willison, who coined "prompt injection" and named the "lethal trifecta" (private data + untrusted content + ability to send data out), is the reason this launch has the shape it does — and the reason the security coverage is unusually substantive.
- The Attacker Moves Second (a late-2025 paper) is cited across the discourse as the reason nobody serious calls prompt injection solved: it tested twelve published defenses with adaptive, iterative attacks and got through them. OWASP's June 2026 report now maps prompt injection into six of the ten categories in its Top 10 for Agentic Applications.
- David Singleton, Meta VP of engineering for consumer products, conceded the limit publicly: policy bars staff from reading inside your VM, but access would still be technically possible. The user-key Confidential VM was not available at launch.
- TIME's investigation (Oct 6) is the hard-hitting version: an analysis of Muse's internal instructions found it builds "continuously updated dossiers" on its users — who matters to you, what you desire, what nudges shape your behavior — and, per the piece, that it maps users and their contacts, including people who don't use Muse, and shares anonymized insights across its system. That is the "dossier" concern that dominated the privacy thread on X.
The platform fight (the most important X storyline)
- On September 21, thirteen days after launch, Amazon blocked Muse from shopping on Amazon.com. The popup shown to users is the bluntest text in the entire coverage: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use." Amazon said Meta had not told it Muse would access the site, and that the agent did not identify itself while browsing. Forbes framed it as "a growing fight over who controls customer accounts in the AI agent era," and CNN Business as the dilemma every merchant now faces: partner with agent vendors and risk your own platforms, or block them and lose the agent-driven shopper.
- The naming clash was the X comedy of the launch: the rock band Muse lost its @muse handle and is now @museband, with crossed wires when Zuckerberg's initial posts about the agent tagged the band's account.
The moderation and "creepy" thread
- WIRED ran a first-person account of getting Muse to generate explicit text; Meta's line was that it "wouldn't block legal adult behavior" — Muse generates explicit text but not images or video. OnlyFans creators pushed back hard at the asymmetry: the AI agent gets to be sexually explicit, but real adult creators get demonetized.
- NBC News captured the dominant mood in a headline: "It's cute. It's cuddly. And it wants your data." Users loved customizing their avatars and sharing screenshots; skeptics cited security. The "cute mascot with deep access" tension is the single most repeated frame.
The single best summary of the X reaction
From the 100-reaction digest, the line that compresses the whole discourse: "The technical design earned real respect. The company attached to it did not." (eesel). The architecture — Secure VM, Sentinel, credential surrogation, audit trail — got genuine, unsolicited respect from security people. The trust in Meta to hold the data those mechanisms are protecting did not. That split is where Muse's next six months are decided.
What It Means
Three things fall out of the launch and the reaction:
- The agent race moved from model quality to distribution and trust. Muse is not the strongest model on the frontier — by every independent number it trails Claude and OpenAI's top models. What it is, is the best-distributed agent on Earth: a messaging-style UI inside WhatsApp and a dedicated app, aimed at non-technical users, from a company with billions of accounts. The competition is no longer "whose model is smartest" but "whose agent gets opened, trusted, and given access to a real life." That is a different game, and it is the one Meta has historically been best at.
- The architecture is the real product, and it is ahead of the competition on containment. The Secure VM + Sentinel two-domain design — a persistent private computer with a full browser, a separate permission broker that is the sole egress authority, and credential surrogation so the model never sees secrets — is a serious answer to the prompt-injection problem that most competitors are still hand-waving. Security researchers respected it. Whether it holds up under adaptive attack (the "Attacker Moves Second" scenario) is an open empirical question, and the $130,000 bounty is a bet that it will be probed.
- The merchant relationship is the unresolved problem. Amazon's block is not a blip; it is the preview of every platform deciding whether agents are customers or intruders. Muse's entire commerce thesis — agent-proxied checkout, a fee on transactions — depends on other companies letting an agent act on their behalf. Until the "unauthorized AI agent" question is settled industry-wide (who authenticates the agent, who is liable, who owns the relationship), the shopping half of Muse is a negotiation Meta is running live, in public, one popup at a time.
What to watch
Muse Wonder powering the agent — when the October frontier model lands in the consumer agent, the "it's behind the frontier" critique gets stale. Muse Confidential VM — the user-held key that makes "not even Meta can read your VM" true; the single biggest trust fix available. The merchant war — whether more platforms block or onboard agents. The dossier question — whether TIME's read of the internal instructions holds up under scrutiny, and whether the opt-outs actually cover contact-graph mapping. Muse Charm's price and launch — the test of whether a $20–$100 agent needs hardware to become ambient.
Bottom Line
Muse is Meta's bet that the AI race's center of gravity is the personal agent — a persistent, secure, private computer that does the work of a billion non-technical lives — and it is the most credible execution of that bet yet. The product is real and impressive: computer use, long-running background goals, granular permissions, a Stripe one-time-card checkout, a model line that went from closed (Wonder) to open (Spark Open 816B) in the same six weeks. The reaction on X is the honest read of its position: the architecture earned respect from the people whose job is to distrust it, the consumer appeal is real (No. 1 in the App Store, 4M users, a CEO endorsement), and the trust deficit — the dossiers, the Amazon block, the "cute and wants your data" frame — is the exact thing the next six weeks of engineering and policy have to outrun. This is not a novelty. It is the first serious attempt to ship a personal superintelligence to the general public, and the race it starts is the one the lab benchmarks were never measuring.
References
- Meta — Muse product & capabilities page [ai.meta.com]
- Meta — "Introducing Muse: The World's First Personal AI Agent Built for Everyone" [about.fb.com]
- Meta AI Research — Introducing Muse Spark 1.3 [research.meta.ai]
- Meta AI Research — Muse Spark Open (816B open-weight) [research.meta.ai]
- Meta AI Research — Security & safety for AI agents (Muse architecture) [research.meta.ai]
- Meta — Muse Charm device [meta.com]
- Wikipedia — Muse (AI agent) [Wikipedia]
- HackerNoon — "What 100 Tech People Think Meta's Muse Is" [HackerNoon]
- TIME — "Meta's Muse AI Agent Is Building a Dossier On You" [TIME]
- GeekWire — Amazon blocks Meta's Muse from shopping [GeekWire]
- Forbes — Amazon's $68B reason to block Muse [Forbes]
- CNN Business — AI agents and the merchant dilemma [CNN]
- WIRED — "I Got My Muse AI Agent to Sext Me" / OnlyFans creators' reaction [WIRED]
- NBC News — "It's cute. It's cuddly. And it wants your data." [NBC News]
- 9to5Mac — Muse overtakes ChatGPT as top iPhone app [9to5Mac]
- Engadget — The band Muse loses its X handle to the agent [Engadget]
- VentureBeat — Muse Spark Open (Intelligence Index, Mac Studio serving) [VentureBeat]
- TechCrunch — Meta releases its first frontier model, Muse Wonder [TechCrunch]
- Business Insider — Alexandr Wang's "tweet cannon" promo strategy [Business Insider]
- CNBC — Zuckerberg's $1,299 VR glasses + Muse Charm [CNBC]
- AI Agents Library — Muse Charm availability & (absent) pricing [AI Agents Library]
Capabilities, architecture, pricing, and model details verified against Meta's official pages and research blogs; adoption figures, the Amazon block, the TIME investigation, and X reactions from 2026 trade and social reporting. All figures are as of the coverage through October 18, 2026, and some (user counts, model scores, Charm pricing) are moving targets.