Meta’s Muse Wants Your Inbox, Your Calendar, and a Card on File

To use Meta's new AI agent the way Meta wants you to use it, you have to hand over your inbox, your calendar, your smart home accounts, and a working payment card. Muse, which started rolling out in the US this week, is built to go do things rather than answer questions, and doing things requires the keys.

So it opens a browser and fills in forms. It sends email on your behalf, books travel and negotiates your bills, and it keeps working after you close the app, remembering your preferences and volunteering suggestions you never asked for. Meta's own examples run from turning saved Instagram recipe reels into a grocery list to organizing a dinner, down to tracking who at the table can't eat what. It's live in the US on iOS, Android and muse.ai, with the AI glasses "coming soon."

The security architecture is the actual news

Handing an agent your email and a credit card is the kind of thing that goes wrong loudly, and Meta clearly knows it. Muse doesn't run wherever the rest of Meta's services run. Each user's agent gets a dedicated virtual machine in the cloud, the "Muse Secure VM," which Meta describes as "contained so no one else's agent can reach it." Your data and your connected credentials live in there.

The second agent is the more interesting piece. Meta calls it Sentinel, and in Meta's words it "runs on that same machine, kept apart from Muse at the system level. Nothing Muse does reaches the internet unless the Sentinel approves it." One process does the work, a separate one decides whether the work gets to leave the box.

Around that, Meta says Muse has no visibility into your passwords or payment methods, asks permission before sensitive actions like sending mail or buying something, keeps an audit trail of what it did, and lets you set how much access each connected app gets. Purchases go through Link by Stripe, which issues a one-time-use card rather than exposing your real one and adds coverage for damaged or lost items, price drops, and no-fee returns. A "Muse Confidential VM" is promised later, encrypting the whole machine with a key only you hold, so that not even Meta can get in.

Meta also says your conversations and the data in your VM stay away from its ad systems, and that you can opt out of having your interactions train its models. The model underneath is called Muse Spark, which Meta bills as its most capable to date and built for real-world agentic work.

Now the hard part

Read that architecture cold and it is a careful design. A per-user sandbox, a separate gatekeeper isolated at the system level, one-time payment cards, an audit log. That is roughly what you would want someone to build before you let an agent touch your bank account.

Then remember who built it. Meta settled with the FTC over privacy deception in 2011, paid a $5 billion FTC penalty in 2019 over eight more violations, and was caught that same year storing user passwords in readable form on internal systems. The FTC charged it again in 2023 over monetizing kids' data. In August, as TechCrunch points out, it agreed to an $18 billion settlement with 29 states over social media harms to children. This is the company that would now like to sit between you and your credit card.

No amount of VM isolation solves that. Sentinel is a Meta process approving a Meta agent's requests on a Meta server, and the audit trail is one Meta writes. Every guarantee in the design depends on Meta enforcing it against itself.

What it costs, and what you get

Meta's own post says Muse is free for basic features with subscription plans for more, and names no prices. TechCrunch reports two paid tiers, $20 a month for a Power plan and $100 a month for a Max plan, with Meta expecting most people to stay on the free one. Treat those figures as reported rather than confirmed. TechCrunch also says a payment card is required to switch the thing on at all, and that there's a meter showing how much free capacity you have left.

The free allotment is not stingy. Gizmodo's Mike Pearl spent his on a 3D adventure game, a fake bootable Mac OS complete with a working "About This Computer" popup, and 50 genre variations of a theme song, and got through 11% of a weekly 100-million-token allowance doing it. Muse told him he was "nowhere near getting cut off." The output did not impress him. The dubstep version of the song, he wrote, "isn't all that distinct from the 'Sea Shanty' variant," and the adventure game came out "a very bad game" after repeated attempts.

Who it's for

Muse is aimed at people whose lives already run through Meta's apps and who have a pile of small errands they would rather not do: the grocery list, the return, the dinner for six with three dietary restrictions. If that describes you and the agent actually works, the payoff is real, and $20 a month is less than the errands cost you in time.

If you have deliberately kept your calendar and your inbox at arm's length from Meta, nothing announced this week is a reason to stop. The Confidential VM, the one encrypted with a key only you hold, is the piece that would change the calculation, because it takes Meta out of the position of grading its own homework. It isn't here yet.