Meta has released Muse, a personal AI agent that can perform consequential tasks while placing privacy and security controls at the center of its product design. The agent is available through iOS, Android, Muse.ai and WhatsApp, with support for AI glasses planned. Meta offers a free tier alongside paid subscriptions.
Muse enters a field that includes OpenClaw and Instinct, but its ambitions go beyond conversation. WIRED reports that it can send email, book travel, sell a car and make purchases. For payments, it can use Stripe Link to generate a single-use card and supports returns without a fee. Those capabilities make security architecture part of the product’s basic usefulness rather than a feature that can be added later.
Useful Actions Create More Sensitive Exposure
An assistant that only drafts text can make mistakes. An agent authorized to communicate, spend money and move through websites can create direct consequences. Muse therefore runs user activity inside what Meta calls a Secure VM, an isolated virtual machine intended to contain each task.
A separate system named Sentinel monitors information leaving that environment. Meta says Sentinel is designed to identify prompt-injection attacks, in which malicious instructions hidden in a page or message try to redirect the agent. When it detects a risky action, it can trigger a human approval prompt outside the model itself. That separation is important because an agent influenced by hostile content should not be the sole judge of whether its next step is safe.
The design does not eliminate exposure. Meta technically can access data inside the Secure VM, even though company policy prohibits that access. Users can opt out of having their data used for training, but policy and choice are not the same as a system that makes access technically impossible.
Confidential Computing Is the Larger Promise
Meta says a future Confidential VM will use a trusted execution environment and keys controlled locally by the user. The goal is to prevent even Meta from reading what happens inside the agent’s workspace. WIRED reports that cryptographer Moxie Marlinspike has collaborated on the project.
Select security firms will be able to audit source code, while public binaries are intended to appear in a transparency log. Those measures could give outside researchers a way to compare what Meta says it runs with what is actually distributed. The company has also opened a bug bounty offering as much as $300,000 for some flaws, with prompt-injection findings eligible for rewards up to $130,000.
These are meaningful commitments, but much of the strongest protection is described as future work. The current Secure VM still leaves technical access with Meta. Audits by selected firms are narrower than fully public source, and a transparency log only helps if researchers can examine and verify the relevant builds. The announced architecture should therefore be judged in stages, distinguishing what ships now from what Meta plans to deliver.
Trust Will Depend on Failures and Recovery
Muse’s combination of isolation, external monitoring and human approval addresses real agent risks. It also creates operational questions that product descriptions cannot answer alone. Users need to know when approval is required, what a failed transaction looks like, how an incorrect message can be corrected and how quickly credentials can be revoked if an account is compromised.
The agent’s reach makes those details central. Booking travel and selling a car involve more than a single click; they may expose identity, financial information and negotiations across several services. A secure container can limit what the agent sees, but the user still needs a clear record of actions and control over each connection.
Meta is asking consumers to trust both an autonomous assistant and the company operating its infrastructure. Muse’s design recognizes that this trust cannot rest only on model behavior. The decisive evidence will come from the Confidential VM’s implementation, independent testing and the way Meta handles the first serious failures after real users grant the agent authority.
