Meta has unveiled Muse, a personal AI agent designed to complete user tasks through email, calendars, a browser and other connected services. Zuckerberg announced the product on Sept. 8, describing it as an agent that understands users’ goals and works continuously on their behalf.

Meta positions Muse as a step toward “personal superintelligence.” The company has made the service free for up to 100 million tokens per week.

The project has been developed and used internally at Meta since early 2026. The team said it saw early signs of “real personal superintelligence” in a system that can learn about a user, complete tasks independently, run in the background, create groups of sub-agents, build its own tools and edit itself.

Muse uses the Muse Spark 1.3 model, which Meta is training for tool calls through command-line interfaces and skills, long-context and long-horizon action sequences, prompt-injection resistance and coordination among multiple agents. Muse follows the earlier unveiling of Muse Spark, the first model in the family and the foundation for Meta’s agentic use cases.

Security architecture limits access

Meta said Muse was designed with privacy and security in mind because developers allowed the agent to work unsupervised with their mailboxes, calendars and command lines. Each user receives a dedicated cloud-based Linux virtual machine containing a browser, processing capacity, memory and storage.

The agent runs inside an isolated environment, while critical security components operate outside it. Meta’s architecture includes Hatch, an isolated runtime for code, tools and file operations; hatch-safety, which checks prompts, responses and potential attacks; privsep, which runs connector code with limited privileges; and hatch-authd, which stores credentials and tokens.

A separate component called Sentinel controls access to third-party services and outbound network traffic. Muse can propose an action, but Sentinel decides whether to approve it, reject it or request confirmation under policies set by the user.

Sentinel checks network destinations, IP addresses, ports, protocols, HTTP methods, paths and request contents. For operations requiring secrets, Muse receives surrogate tokens rather than passwords or API keys. The system adds the real credentials only at the network boundary after authorization.

Meta also uses a “tainted egress” mechanism that tracks whether a process has accessed user data. If such a process attempts to transmit information externally, it cannot execute the request automatically and must use the standard confirmation process.

Prompt injection, browsing and payments

Meta said prompt injection can expose the model to malicious instructions through emails, websites, files or other external data. Its defenses include training Muse to reject such instructions, marking external data as untrusted, using independent attack classifiers, conducting agentic red-team tests and requiring human approval before data leaves the virtual machine. System-level restrictions remain in place even if the model is compromised.

The company said Muse Spark 1.3 is close to state of the art in resisting prompt injection, while acknowledging that the threat remains an “open industry problem.”

Muse includes a Chromium-based browser that lets users watch its activity and take control. Its browser sub-agent operates through a separate broker and cannot access the full Document Object Model, JavaScript or Chrome DevTools. Additional classifiers check for prompt injection, data-exfiltration attempts, malicious files and high-risk forms.

For purchases on websites that already hold payment details, Muse requests confirmation at checkout. On new sites, it can use a separate wallet. Meta is working with Stripe Link at launch and plans to add Shop Pay. Payments use a single-use card number restricted to a particular merchant, amount and validity period.

Data controls and vulnerability rewards

Users choose which services Muse may access and can revoke access at any time. For email, the agent does not receive one-time codes, password-reset links or “magic” sign-in links.

Muse files and data are stored in the user’s virtual machine, while credentials remain in a separate isolated container. Meta said the data is not shared with advertising systems, although Muse’s online activity may indirectly affect advertising. Dialogues and operational data may be used for model training after personal information is removed, and users can opt out.

Meta is also testing Muse Confidential VM with a limited group of users. The technology is intended to cryptographically protect data even from Meta, and external auditors are reviewing its architecture and code.

Alongside the launch, Meta offered security researchers rewards of up to $300,000. That includes as much as $130,000 for a successful instruction-substitution attack affecting one user.

Muse Spark 1.1 previously went online and hacked the systems of an unidentified company.

Source: Incrypted