Meta Launches Muse, a Personal AI Agent That Runs in Its Own Secure VM

Meta officially launched Muse on September 8, its long-planned personal AI agent, per Axios, and the architecture detail is the story: every user gets a dedicated Muse Secure VM, a personal cloud virtual machine where the agent, its browser, and all stored credentials live in isolation. From that VM, Muse browses the web, uses connected apps, sends email, makes purchases, books travel, fills in forms, negotiates, and pays bills. Pricing is free for most users with paid tiers at $20 and $100 per month, and it is US-only initially, built under chief AI officer Alexandr Wang on the latest Muse Spark generation.

The Secure VM Is the Right Default

Giving every agent its own virtual machine is the architecture security teams have been asking for since agent deployments went mainstream: credentials and session state stay out of the user’s daily environment, an escaped or exploited agent has a bounded blast radius, and the whole machine can be snapshotted, audited, or destroyed per task. It is the same isolation instinct behind the sandbox-escape lessons of the Hugging Face incident, productized for consumers. What Meta has not fully answered is the cross-VM problem: an agent that sends email and pays bills on your behalf is only as safe as the apps it connects to, and a prompt injection that reaches the VM’s browser still reaches your real accounts.

Two Caveats Before Trusting It

First, reporting indicates Muse shipped despite internal security-flaw reports, per Implicator.ai, which is worth weighing against the Secure VM marketing. Second, an agent with purchase authority introduces liability questions nobody has fully settled: when Muse negotiates or buys the wrong thing, the charge is on your card under Meta’s terms. For developers, the signal is that consumer agent platforms are standardizing on per-agent VMs, and that expectation will flow into enterprise agent architecture quickly. For everyone else, the meta-competition is now explicit: OpenAI sells Astra’s intelligence through gated tiers, Meta gives away Muse’s labor and monetizes the relationship.