Meta Launches Muse: A Personal AI Agent Built Around Privacy

Meta announced Muse on Tuesday, a personal AI agent available immediately on iOS, Android, and WhatsApp, as well as the standalone website Muse.ai. The agent can autonomously handle tasks like sending emails, booking travel, and making purchases on a user's behalf. It launches with a privacy architecture called Secure VM, designed to isolate each user's session from untrusted external data. A subscription plan is required for heavy use, and a more private "Confidential VM" tier developed with Signal creator Moxie Marlinspike is in the works.

What happened

Detail	Fact
Launch date	Tuesday (this week)
Platforms	iOS, Android, WhatsApp, Muse.ai website
Pricing	Free tier available; heavy automation requires a Meta AI subscription
Payment partner	Stripe Link (single-use card numbers)
Bug bounty max payout	$300,000 total; up to $130,000 for prompt injection attacks on a single user
Developer	Meta Superintelligence Labs, formed roughly one year ago

Muse is Meta’s entry into the personal AI agent category, competing directly with agents like OpenClaw and Instinct. The product comes out of Meta Superintelligence Labs, the unit Mark Zuckerberg stood up about a year ago to close the gap with OpenAI and Anthropic. WIRED reported previously that the agent was tested internally under the codename “Hatch.”

Users interact with Muse through natural language. The agent can send emails, arrange travel, help sell a car, or complete purchases. For purchases, Muse uses Stripe’s Link product, which generates a single-use virtual card number so the agent never enters a user’s actual payment credentials anywhere online. According to Meta, Muse is the first AI agent covered by Link’s purchase protections for agents, which include no-fee returns.

Meta also says users of its AI glasses will be able to interact with Muse in the near future.

How the privacy architecture actually works

Every Muse user starts with what Meta calls a Secure VM (virtual machine). The idea is simple: your agent activity runs in a sandboxed environment, keeping untrusted data from the web and third-party integrations away from the part of the agent that can take real action on your behalf.

Sitting on top of that is a component Meta calls the Sentinel. According to David Singleton, VP of Engineering for consumer products at Meta Superintelligence Labs, the Sentinel monitors everything leaving the VM. It either matches an outgoing action against an existing user-approved policy or surfaces a human-in-the-loop prompt asking the user to approve the action. Singleton notes these prompts go directly to the user, not through the model, specifically to guard against prompt injection attacks (where malicious instructions embedded in a webpage try to hijack the agent).

There is an important caveat. Singleton acknowledges that while Meta policy bars the company from accessing user Muse data, it would still be technically possible. Users can opt out of having their data used for model training.

What is Confidential VM and why does it matter?

A stronger tier called Confidential VM is coming. Under this design, each session runs in a trusted execution environment and the user holds their own access keys locally on their device. This means Meta itself would have no technical path to the data, not just a policy restriction.

Confidential VM is being developed in partnership with Moxie Marlinspike, the creator of Signal who also built the privacy-focused AI platform Confer. Meta plans to give select security firms ongoing audit access to the Confidential VM source code, publish the machine-readable binary files, and maintain a public transparency log so users can verify the integrity of their connection to Muse. WIRED reviewed an advance draft of the technical white paper describing this setup.

Meta has also added Muse to its public bug bounty program, with total payouts reaching up to $300,000. Researchers who find a successful prompt injection attack affecting a single user can earn up to $130,000. The agent was previously vetted by Meta’s internal human and AI red teams and through a private bounty before this public launch.

Why it matters

Personal AI agents that can spend money, send messages, and access accounts represent a significant jump in what AI can do autonomously. That raises the stakes on security considerably. Prompt injection, where an attacker hides instructions in a webpage or document that the agent then executes, is one of the most serious risks in agentic AI right now. Meta’s Sentinel architecture and the high bug bounty specifically targeting injections signal that the company is at least aware of the threat.

The Secure VM model, if it works as described, could set a useful baseline for the industry. Confidential VM goes further: user-controlled keys and external audits are the same tools that made end-to-end encryption credible in messaging. If Meta ships Confidential VM with the same rigor, it would be a meaningful privacy step for AI agents broadly. You can follow developments across the AI agent space in Lumien’s AI news coverage.

Our take

Meta’s trust problem is real, and the company knows it. The Secure VM and Sentinel design is genuinely thoughtful compared to most agent releases, which ship with few guardrails and vague privacy promises. The Confidential VM roadmap is the more credible signal: user-held keys, public binaries, and third-party audits are verifiable, not just marketing claims.

That said, Confidential VM is not here yet. What ships today is Secure VM, which still technically allows Meta access. For most users, that is the relevant version for the foreseeable future. Businesses considering whether to let an AI agent touch their communications, calendars, or finances should weigh that gap carefully.

The Stripe Link integration is the sleeper feature. Single-use card numbers for agent purchases solve a real problem elegantly, and the no-fee return guarantee removes one of the bigger objections to letting an agent check out on your behalf. If you are exploring AI integration for your business, payment safety is a non-trivial detail worth watching across all agent platforms, not just Muse.

What to do about it

1. Try Muse on a low-stakes task first. Use the free tier to test email drafting or a simple search before connecting any sensitive accounts.
2. Review each third-party integration permission before granting access. The Sentinel will prompt you, but read those prompts rather than approving reflexively.
3. Opt out of data-for-training if you handle confidential business information through the agent.
4. Watch for the Confidential VM rollout before connecting accounts with sensitive financial or client data.
5. If you run a security team, look at Meta’s public bug bounty scope for Muse. The $130,000 prompt injection payout is a signal of where the real risk sits.

The practical takeaway: Muse is worth testing for low-sensitivity tasks today, but wait for Confidential VM before trusting it with anything that would hurt if it leaked.

Source: WIRED · AI