Meta Launches Muse, a Personal AI Agent That Runs in Its Own Secure VM
Meta debuted Muse on September 8, a personal AI agent that browses, emails, shops, books travel, and pays bills from a dedicated per-user cloud virtual machine, free for most users with $20 and $100 tiers.
Meta officially launched Muse on September 8, its long-planned personal AI agent, per Axios, and the architecture detail is the story: every user gets a dedicated Muse Secure VM, a personal cloud virtual machine where the agent, its browser, and all stored credentials live in isolation. From that VM, Muse browses the web, uses connected apps, sends email, makes purchases, books travel, fills in forms, negotiates, and pays bills. Pricing is free for most users with paid tiers at $20 and $100 per month, and it is US-only initially, built under chief AI officer Alexandr Wang on the latest Muse Spark generation.
The Secure VM Is the Right Default
Giving every agent its own virtual machine is the architecture security teams have been asking for since agent deployments went mainstream: credentials and session state stay out of the user’s daily environment, an escaped or exploited agent has a bounded blast radius, and the whole machine can be snapshotted, audited, or destroyed per task. It is the same isolation instinct behind the sandbox-escape lessons of the Hugging Face incident, productized for consumers. What Meta has not fully answered is the cross-VM problem: an agent that sends email and pays bills on your behalf is only as safe as the apps it connects to, and a prompt injection that reaches the VM’s browser still reaches your real accounts.
Two Caveats Before Trusting It
First, reporting indicates Muse shipped despite internal security-flaw reports, per Implicator.ai, which is worth weighing against the Secure VM marketing. Second, an agent with purchase authority introduces liability questions nobody has fully settled: when Muse negotiates or buys the wrong thing, the charge is on your card under Meta’s terms. For developers, the signal is that consumer agent platforms are standardizing on per-agent VMs, and that expectation will flow into enterprise agent architecture quickly. For everyone else, the meta-competition is now explicit: OpenAI sells Astra’s intelligence through gated tiers, Meta gives away Muse’s labor and monetizes the relationship.
Get Insanely Good at AI
The book for developers who want to understand how AI actually works. LLMs, prompt engineering, RAG, AI agents, and production systems.
Keep Reading
How to Deploy Enterprise MCP with Cloudflare Workers
Learn to secure and scale Model Context Protocol deployments using Cloudflare’s reference architecture for remote MCP servers and centralized portals.
Meta's Muse Synced 187,000 Lines of Messages With Permissions Off
A professor's test of Meta's Muse found it pulled roughly 187,000 lines from his iPhone Messages database within a day, with Full Disk Access off and Messages permission never granted, per AppleInsider's report on his account.
Meta's Muse Spark 1.3 Hits 61 on the AI Index With a Catch: Its Best Mode Is Gated
Meta released Muse Spark 1.3 on September 2, its fourth release in five months, scoring 61 on the Artificial Analysis Intelligence Index, though the top results come from a max-reasoning variant in limited preview.
Meta Launches Muse Wonder: An Agent Model With Active Memory and Active Focus
Meta announced Muse Wonder and Muse Wonder Full on October 12, an agent model family with persistent Active Memory and sustained Active Focus, trained at the gigawatt-scale Prometheus datacenter and available now through the Meta Model API and Muse Code.
Meta's Muse Assistant Has a Zero-Day That Hands Attackers Your Whole Account
Mac security researcher Patrick Wardle disclosed a zero-day in Meta's Muse on September 21 that lets any local app or a single terminal command steal the assistant's auth token, exposing the WhatsApp, email, calendar, camera, and location access Muse holds.