Glonce

Meta launches Muse, a personal AI agent built on Secure VM

agentsThe Glonce editorsWired🔥73Glonce rating73Impact72Novelty48Relevance98Surprise60Players87Credibility82
Meta launches Muse, a personal AI agent built on Secure VM

Meta announced on Tuesday the release of Muse, a personal AI agent that users message to automate digital tasks such as sending emails, booking travel, helping sell a car, or making purchases, all run inside what Meta calls a secure cloud environment. Muse is rolling out through a dedicated app on iOS and Android, through the Muse.ai website, and through direct messages in WhatsApp; Meta says support for its AI glasses is coming soon. People can try Muse for free, but automating a lot of digital tasks requires one of Meta's AI subscription plans, whose price the company did not state. Muse is a product of Meta Superintelligence Labs, the AI unit CEO Mark Zuckerberg formed roughly a year earlier to catch up with OpenAI and Anthropic, reportedly offering some researchers very large compensation packages to join. Wired had previously reported that Meta tested the agent internally under the codename Hatch, with employees using it to operate third-party apps and browse the web on their own behalf. Meta positions Muse against other viral messaging agents, OpenClaw and Instinct. For purchases, Muse checks out using Stripe's Link payment infrastructure, which issues a single-use card number instead of handing agents a user's real financial details. Meta says Muse is the first agent covered by Link's purchase protections, which guarantee no-fee returns. Meta is late to ship a personal agent and is trying to stand out on security and privacy instead. All users get an architecture called Secure VM, which isolates each user's activity inside its own virtual machine, keeping untrusted data pulled from the web and third-party integrations separate from the part of the agent that can actually act on the user's behalf. David Singleton, Meta Superintelligence Lab's vice president of engineering for consumer products, said the system includes a component called Sentinel that watches everything leaving the VM: it either matches an action to a policy the user or system has already approved, or it interrupts with a human-in-the-loop prompt asking the user to approve the action. Singleton said these approval prompts go directly to the user rather than passing through the model, specifically to guard against prompt-injection attacks. He also said that while Meta is barred by policy from accessing a user's Muse data, doing so remains technically possible; users can opt out of having their data used for training. Meta plans to eventually add a further tier called Confidential VM, in which each VM runs inside a trusted execution environment and users hold their own access keys locally, so that no one, including Meta, can reach that user's agent VM. Confidential VM is being built with Moxie Marlinspike, the creator of the Signal messaging app who also developed the privacy-focused AI platform Confer. Wired reviewed an advance draft of a technical white paper on Confidential VM describing plans to give select security firms access to its source code for regular audits, and to publish its binaries and a transparency log so users can verify their connection to Muse. Singleton said Secure VM has already been vetted by Meta's human and agentic red teams and through the company's private bug bounty, and Meta is now adding Muse to its public bug bounty program, offering payouts of up to $300,000 for valid vulnerability findings, including up to $130,000 for a successful prompt-injection attack that affects a single user.

Key facts

  • Meta released Muse on Tuesday: a messaging-based personal AI agent available via a dedicated iOS/Android app, the Muse.ai website, and WhatsApp, with AI glasses support coming soon.
  • Muse can send emails, book travel, help sell a car, and make purchases through Stripe's Link infrastructure, which issues single-use card numbers and, per Meta, covers Muse as the first agent under its no-fee-return purchase protections.
  • The agent runs on a Secure VM architecture that isolates each user's activity and uses a component called Sentinel to route any action needing approval directly to the user rather than through the model, guarding against prompt injection.
  • David Singleton of Meta Superintelligence Labs said Meta is barred by policy, though not technically prevented, from accessing user Muse data; a future Confidential VM tier, built with Signal creator Moxie Marlinspike, would let users hold their own access keys so no one, including Meta, can reach their VM.
  • Meta is adding Muse to its public bug bounty with payouts up to $300,000 for valid vulnerabilities and up to $130,000 for a prompt-injection attack affecting a single user, after internal red-team and private bounty testing.

Why it matters

Meta is entering the personal-agent race late, well after rivals it names only as OpenClaw and Instinct, and is trying to compete on trust rather than being first. Muse is a product of Meta Superintelligence Labs, the unit Zuckerberg formed about a year earlier specifically to close the gap with OpenAI and Anthropic, reportedly with outsized pay packages to attract researchers. Betting the launch on a security architecture, Secure VM, rather than on raw capability is itself a statement about where Meta thinks it can differentiate.

Who it affects

Anyone with the Muse app on iOS or Android, the Muse.ai website, or WhatsApp can message the agent today; AI glasses users get access soon. Businesses on the receiving end of agent-driven purchases interact with it through Stripe's Link single-use card system rather than a user's real payment details. Security researchers are affected directly: Muse is now in scope for Meta's public bug bounty.

How to use it

Muse is free to try, but Meta says heavy use for automating many digital tasks requires one of its AI subscription plans; the article does not give a price. Access starts through the dedicated Muse app, the Muse.ai site, or a WhatsApp message, with AI glasses support described as coming soon.

How solid is it

Singleton says Secure VM has already been through Meta's human and agentic red teams and its private bug bounty before this public launch, and Meta is now opening Muse to its public bug bounty with payouts up to $300,000 for valid findings and up to $130,000 specifically for prompt-injection attacks affecting a single user. The planned Confidential VM tier goes further: select security firms would get source access to audit it, and Meta says it will publish the binaries and a transparency log so users can verify their own connection.

Risks and caveats

Secure VM is not a fully locked box: Singleton confirms that although Meta is barred by policy from accessing a user's Muse data, doing so remains technically possible, and that gap is exactly what Confidential VM is meant to close later, with users holding their own keys instead of Meta. Confidential VM has no release date; Meta describes it only as coming eventually. Meta also carries a history of user trust issues around data handling, which is the backdrop the article frames Muse's entire security pitch against.

“We know it's really important, if we're going to build a product like this that can access a lot of sources of personal data, that we're really responsible with that, so we've designed this system very deliberately. And we've built what we call the Sentinel that actually looks out for everything that's moving out of the VM and either matches it to an existing policy where the user or the system has given permission for that to happen or presents a human-in-the-loop dialog to ask you to approve the action it's going to take.”

— David Singleton, Meta Superintelligence Lab's vice president of engineering for consumer products