Meta’s Muse Agent Wants Your Inbox and Your Card

Meta launched Muse in the U.S. on September 8, 2026, a personal AI agent that can email, book travel, and pay with Stripe’s Link. It is live on iOS, Android, the web at muse.ai, and in WhatsApp chats, with Meta’s AI glasses promised next.

Mark Zuckerberg said the product “understands your goals and works 24/7 to get things done for you.” A payment card is required to start, even before anyone hits a paid plan.

Muse Opens in the US With WhatsApp as the Front Door

Meta is not pitching another answer box. In its newsroom note it calls Muse a personal agent that actually does the work, then keeps going after you close the app.

Talking to it is meant to feel like messaging a person, which is why WhatsApp is a launch surface rather than a later add-on. People who already live in that chat thread do not have to open a new habit to hand off a task.

Vishal Shah, Meta’s VP of AI Products, put the limiter in plain language. The ceiling is not a missing API. It is how much of a life someone is willing to plug in.

Because it is a very capable AI product that can also build its own software, it isn’t really limited in what it can do. From a complexity perspective, you just have to get more and more comfortable with giving it access to more, and also telling it what’s important to you, so it can be the most helpful it can be.

Vishal Shah, VP of AI Products, Meta

Users pick a name, an avatar, and how the agent talks. They also connect services one at a time. If a tool has a public API, Muse can build a connector from credentials the person supplies. If it does not, Muse can drive the site in a browser, fill forms, and finish the click path.

The company account posted the launch clip as people were still finding the app.

https://x.com/Muse/status/2097399178376671666

A Dedicated Linux Box, and a Sentinel on the Same Machine

The product Meta is really shipping is a computer. Each Muse lives on Muse Secure VM, a dedicated cloud Linux box with a browser, CPU, memory, and storage, isolated so another person’s agent cannot reach it.

Tarek Sheasha, a software engineer and VP at Meta Superintelligence Labs, wrote that the team has used the agent on its own inboxes, calendars, and shells since early 2026, and that unattended runs did not always go as planned. The write-up on how Meta built safety into Muse is the manual for what they bolted on after those misses.

Credentials sit in a store the main agent cannot read. Built-in connectors run in tightly scoped workers, so a calendar job cannot ask for an email token by changing a field. The runtime cell is a systemd-nspawn container whose root is not host root. Muse Spark, the Muse Spark model Meta already shipped into its stack this year, never sees the real password or the real card number.

WHAT SENTINEL CAN STOP

• Network egress: Nothing the agent does reaches the internet unless a separate Sentinel process on the same machine allows it.
• Mail and pay: Sending an email or completing a purchase pauses for a yes in the app UI, not inside the chat.
• Surrogate tokens: Connector code sees stand-in secrets; Sentinel swaps in the real credential only at the network edge.
• Inbox traps: The email connector strips one-time passcodes, password-reset links, and magic login links so a hijacked agent cannot reset the rest of someone’s accounts.

Read-only jobs and some low-risk clicks can pass without a tap. Meta says the mix will be tuned as real users show up. People can disconnect a service, tell Muse to forget a fact, and opt out of having chats used to train models. Meta also says conversations and data in the VM are not shared with its ads systems.

Muse can and will still make mistakes, but we expect they’ll be much less frequent and cause much less damage due to the safety systems we’ve built in.

Tarek Sheasha, Software Engineer and VP, Meta Superintelligence Labs

A public bug bounty now pays up to $300,000, including up to $130,000 for a prompt-injection that hits one user. Later in 2026, Meta says it will add Muse Confidential VM, with the whole machine encrypted under a key only the user holds.

Stripe Link Issues a Card Muse Never Sees

When the errand is a purchase, Muse checks out with Link, built by Stripe. Meta says it is the first AI agent covered by Link’s purchase protections, including coverage for damaged or lost items, price drops, and no-fee returns on eligible buys.

Link’s Link wallet for AI agents mints a one-time-use card so the agent never holds the raw number. Stripe has said that wallet sits on top of Issuing for agents, and that Link already has more than 200 million consumers. Shop Pay is listed as a coming checkout path. 1Password support is listed too, so the agent can use a password vault without putting those secrets in the model’s context.

That is the second job hiding under the assistant pitch. Once a card is on file and a one-time number can be minted per cart, Meta is in the middle of the buy, not only the chat. The person still has to approve the spend. The rail is still Meta’s product plus Stripe’s wallet, not the merchant’s old checkout page alone.

Thirteen Days After a $17.1 Billion Child-Safety Deal

The launch landed 13 days after Georgia Attorney General Chris Carr announced a $17.1 billion child-safety settlement with Meta, which he called the largest state consumer-protection deal outside the tobacco cases of the 1990s. The agreement covers 47 states, the District of Columbia, Puerto Rico, American Samoa, and the Northern Mariana Islands.

It also closed state claims about Meta sharing nonpublic Facebook data with third parties such as Cambridge Analytica. On Instagram and Facebook, children get a combined two-hour daily cap, with mandatory pauses after 15 minutes of continuous use and again at 60 and 90 minutes, for five years. Night hours from 12:00 a.m. to 6:00 a.m. are blocked. School-day push alerts from 8:00 a.m. to 3:00 p.m. are cut.

That clock sits next to a product that wants Gmail, a calendar, a health app, and a card. The Oakland child-safety trial against Meta was the fight that produced the payout. Muse is the first consumer agent Meta has built that needs more of a person’s private stack than a social feed ever did. In 2019 the FTC extracted a $5 billion privacy penalty from the company. The Sentinel and the opt-in connectors are the reply Meta is putting in the app, not in a courtroom.

THE PATH FROM SPARK TO MUSE

1. April 8, 2026: Meta Superintelligence Labs releases Muse Spark, the first model in the Muse family.
2. July 9, 2026: Muse Spark 1.1 ships as a multimodal model aimed at tool use and computer use, with a 1 million token context window.
3. August 26, 2026: Carr’s office announces the $17.1 billion deal and the new child-use rules on Instagram and Facebook.
4. September 2, 2026: Muse Spark 1.3 lands, trained to hold longer jobs in one thread and to ask before consequential steps.
5. September 8, 2026: Muse opens in the U.S. on phones, the web, and WhatsApp, powered by that 1.3 model.

Carr said Meta was first among large platforms to take a comprehensive youth-safety deal, and that it should not have taken lawsuits to get there. Muse does not undo those terms. It does ask the same company to hold a different class of keys.

How Muse Spark 1.3 Turns a Saved Reel Into a List

AI at Meta said the agent is powered by Muse Spark 1.3 for agentic work. The model is built to keep several jobs alive in one long thread, write its own helper code on that VM, and spawn subagents. The newsroom example is small on purpose: a recipe reel saved on Instagram becomes a grocery list, then a shopping run, with friends’ dietary limits remembered when the invites go out.

Shah’s version of the same idea is that Muse can look through saved recipe videos on Instagram and Facebook, tidy them, compare prices, and order. The useful part is not the demo. It is the list of systems Meta already wired, plus the browser for everything else.

APPS MUSE CAN PLUG INTO FIRST

An audit trail in the app is supposed to show what Muse has done and what it still plans to do. The agent is also allowed to learn what matters from chat and then suggest steps nobody asked for that hour. That unprompted layer is how a task tool starts to look like a staffer. It is also how a wrong inference gets expensive if the next step is a send or a pay.

The Shelf Google and Instinct Already Stocked

Meta is late to the errand, not to the model. Google has been showing Gemini Spark as a cloud-resident helper that can run inbox and calendar work and drive purchases through its own cart tools. OpenAI and Stripe already shipped Instant Checkout inside ChatGPT, using scoped payment tokens so the assistant never holds the raw card. Those are the same rails Muse is now standing on, with WhatsApp as Meta’s distribution edge.

The sharper warning sits with Instinct, the invite-only life assistant from Spear Street Technology. Early terms gave the company a perpetual and irrevocable license to access, host, and modify user materials, including for training. Testers found indexed mail still sitting in Instinct’s records after they cut the Google connector. Instinct later revised the language, on August 26, 2026, the same date as Meta’s state deal.

Muse’s pitch is the opposite piece of paper: per-app opt-in, a Sentinel that can refuse egress, passwords out of the model’s sight, and a training opt-out. The gap Instinct opened is still the one Meta has to clear in practice. An agent that can bind a person to a purchase does not get a second chance on a bad send.

What Muse Costs on Power and Maximum Plans

Zuckerberg said Muse is free up to 100 million tokens a week, with paid plans for people who burn more compute. At launch those plans are Power at $20 a month and Maximum at $100 a month. Meta thinks most people will stay on the free meter. The app shows how much of the allowance is left and warns before a charge.

MUSE PLANS AT LAUNCH

• Free tier: Up to 100 million tokens a week, with a card on file to open the account.
• Power: $20 a month for extra usage on everyday handoffs.
• Maximum: $100 a month for still heavier agent work.
• Bug bounty: Up to $300,000, with prompt-injection priced up to $130,000 for a single-user hit.

A dedicated VM per person is not a chat cost. It is a data-center cost, which is why the free token pile matters. Meta can give away a lot of inference to get email connected and a card stored, then let the meter rise after the agent is already in the workflow. Glasses come after that, when the same agent can be spoken to without opening a phone.

Meta said a Confidential VM, encrypted with a key only the user holds, is due later in 2026, and that Muse will reach its AI glasses. Until those ship, the U.S. app is a WhatsApp thread, a Linux box, a Sentinel, and a Link card that the model is not allowed to read.