Meta's personal agent Muse sells trust by design

Muse is available through a dedicated app (iOS and Android), on the web, and inside WhatsApp chats, and the company said it will come to Meta's AI glasses soon. The model underneath is Muse Spark 1.3, which Meta released on September 2. METAL reported that the model outscored GPT-5.6 and Opus 5 on coding benchmarks, and Meta again described it as "the best model we have built for real-world agentic work."

Pricing, as Meta laid it out, is free up to 100 million tokens a week, with two subscription tiers at $20 and $100 a month for heavier use. METAL reported in August that while the product was in development under the codename Hatch, a premium tier at $199.99 a month was under consideration; the actual launch price came in at less than half of that. Rather than going head to head with the top tiers of ChatGPT and Claude ($200 a month), Meta has positioned itself one step below.

What it can do, by Meta's account, runs like this: sending email, filling out forms, booking travel, negotiating prices on the user's behalf, and turning a cooking Reel saved on Instagram into a shopping list. Work continues after you close the app, and the agent comes back to you when a decision is needed, the company explained. Users choose, item by item, which apps to connect and whether to allow read-only or write access, and can disconnect at any time.

Payments are handled by Stripe's Link. When the agent buys something, it is issued a single-use virtual number instead of the user's real card number, and according to Meta, Muse is the first AI agent covered by Link's purchase protection for agents. That includes compensation for damaged or lost items and price drops, plus fee-free returns. Integrations with Shopify's Shop Pay and the password manager 1Password are slated to follow.

The technical document from Meta Superintelligence Labs that METAL reviewed lays out this architecture in considerable detail. Vice President Tarek Sheasha, who wrote the document, stated that "nothing Muse does reaches the internet unless Sentinel approves it." Sentinel is a separate program that inspects the address, port, path, and contents of every request leaving the virtual machine and chooses one of three outcomes: allow, deny, or ask the user. The confirmation prompt appears directly in the app interface, not inside the conversation with Muse, and the scope of approval can be set to once, this session, this task, a limited period, or permanent.

The design of keeping the keys away from the model also stands out. "The model has no need to see API keys, so it doesn't, and therefore it can't leak them by accident," Sheasha wrote. Sentinel swaps in the real tokens for connected services at the network boundary, and for email connections a classifier filters out password-reset links and one-time login codes so the model never sees them. Sub-agents that browse the web on the user's behalf see only the page's accessibility tree, not the raw DOM, and JavaScript execution and developer tools are blocked. What these mechanisms target is prompt injection. Meta claimed that Muse Spark 1.3 is "close to state of the art" at detecting such attacks.

The company has also put money behind the architecture. Meta said it has added Muse to its public bug bounty, paying up to $300,000 for valid vulnerability reports and up to $130,000 for a successful prompt injection that affects a single user. A red team made up of humans and agents kept attacking the system up to launch, and a private bounty ran beforehand, the company explained.

What the current architecture does not do is stop Meta itself. The technical document states that "access to data by Meta employees is limited by operational policy. This does not prevent Meta from accessing data when needed to support, protect, and operate the service." David Singleton, the vice president in charge of consumer product engineering, also acknowledged in a launch interview that the restriction is a matter of policy, and that access remains technically possible. There is a promise not to feed conversation contents into the ad system, but the same document carries a caveat: it does not prevent a merchant site that Muse visited from showing an ad on Instagram based on that visit.

The promise to close that gap is the confidential VM. The plan is to encrypt the entire virtual machine with a key only the user holds so that even Meta cannot open it, run it on a trusted execution environment, open the source code to an outside auditor, and publish the executables and a transparency log. Meta said Moxie Marlinspike, the creator of Signal, took part in this design. Sheasha wrote that Meta "plans to ship it this year," but for now it is open only to a small group of testers. On launch day, Muse is a "trust Meta" product; only the year-end Muse becomes a "you don't have to trust us" product.

The training-data clause is worth reading too. Meta wrote that it uses conversation logs with Muse to train its next models after removing personally identifying information, and that users who do not want this can opt out with a single switch in settings. The default is "use it," and it is on the user to say "leave me out." METAL reported last month that the rival product Instinct drew controversy for putting a perpetual, irrevocable license to user material into its terms; Muse is a step milder than that, but it shifts the weight of the default onto the user.

Seen from the legal side, Muse moves the location of liability to two places. Payment incidents go inside Stripe Link's purchase protection; data incidents go inside Meta's "operational policy." The former is guaranteed by contract, the latter only by the company's word. From the moment an agent buys things and sends email on a user's behalf, "who approved that action" becomes the starting point of any dispute, and Muse's design of keeping the approval prompt outside the model and recording approval scope across five levels reads as an attempt to leave a trail that can answer that question. In July, METAL covered the case in which an OpenAI agent broke into Hugging Face's systems without authorization, escalating into a state attorney general's investigation. That case showed how far an agent with no approval record can become a problem, and Muse's Sentinel is aimed squarely at that gap.

In the market, Muse stands as a late entrant. METAL has traced how, over the past ten months, agents that started in coding tools spread through OpenClaw and into personal assistants, and Meta is the last of the large companies to get on board. What it has instead is something no one else does: the ability to plant an agent inside WhatsApp and Instagram, which more than 3 billion people open every day, and this is the first consumer product from the talent Zuckerberg paid enormous sums to bring in when he founded Superintelligence Labs a little over a year ago. Meta's bet rests on two things, distribution and trust engineering rather than model performance, and of the two, trust is still at the promise stage.

To sum up: Muse is available in the US today, the free tier is generous, and payment protection is bound by contract. Data protection is policy for now and becomes encryption at year end. Whether this product succeeds will be decided less by how smart the agent is than by whether the confidential VM ships on the promised date, and by how often the $130,000 prompt injection bounty ends up being paid out.