Meta Launches Muse, Its First Personal AI Agent, With a Privacy Architecture Designed to Keep Your Data Away From the Web

Key points

• Meta launched Muse, a personal AI agent (software that carries out multi-step tasks on your behalf), on Tuesday for iOS and Android.
• Muse runs inside a security architecture Meta calls Secure VM, which isolates each user's activity so the agent cannot act without permission.
• Stripe's payment tool, Link, generates a one-time card number for purchases so Muse never enters your real financial details on third-party sites.
• Meta's bug bounty programme pays up to $300,000 for security flaws found in Muse, including up to $130,000 for a successful prompt injection attack.
• A more private tier called Confidential VM, where only the user holds the access keys, is coming later.

Meta on Tuesday released Muse, a personal AI agent, meaning software that can carry out tasks on your behalf by operating apps and browsing the web independently. You can reach it through a dedicated Muse app on iPhone and Android, through the website Muse.ai, or by messaging it directly inside WhatsApp. Meta says support for its Ray-Ban AI glasses is coming soon.

Basic access is free. Automating larger volumes of tasks requires one of Meta's paid AI subscription plans.

What can Muse actually do?

Muse handles practical errands: sending emails, booking flights, and even listing a car for sale on your behalf. It can also make purchases. For that, it uses a payment tool from financial technology company Stripe called Link, which creates a single-use card number for each transaction so your real bank details are never passed to any third-party website. Meta says Muse is the first AI agent covered by Link's purchase protections, which include no-fee returns.

The product is a direct answer to AI agents such as OpenAI's products and Anthropic's offerings. It comes from Meta Superintelligence Labs, the division chief executive Mark Zuckerberg formed roughly a year ago, partly by recruiting researchers with unusually large compensation packages.

Wired AI first reported that Meta had been testing the agent internally under the codename "Hatch."

Should users be worried about handing Meta this much access?

That is exactly the question Meta is trying to pre-empt. The company has a long public history of privacy stumbles, and a personal agent needs far more access to your life than a social media account ever did.

Meta's answer is a security layer called Secure VM. Think of it as a walled-off private room for each user: the agent works inside that room, and anything trying to leave, whether data heading to a website or an action about to be taken, is checked by a system Meta calls Sentinel.

Sentinel either matches the action against a rule you or the system already approved, or it pauses and asks you directly before proceeding. Crucially, that check-in message goes straight to you and is not processed by the AI model first. That design is a defence against prompt injection, an attack where hidden instructions buried in a webpage or email try to hijack what the agent does next.

David Singleton, vice president of engineering at Meta Superintelligence Labs, put it plainly: "We've built what we call the Sentinel that actually looks out for everything that's moving out of the VM."

Secure VM is not a perfect seal. Singleton acknowledges that Meta could technically access user data even though company policy bars it. Users can opt out of having their data used to train Meta's AI models.

What extra protection is coming later?

A future tier called Confidential VM goes further. Each user's private environment would run in a trusted execution environment, a hardware-level secure zone, and only the user's own device would hold the keys to unlock it. Not even Meta could get in.

Meta developed Confidential VM with Moxie Marlinspike, the creator of the encrypted messaging app Signal. Select security firms will audit the system's code regularly. Meta will also publish the software's machine-readable instruction files and a public log so independent researchers can verify the privacy guarantees hold.

Muse is already included in Meta's public bug bounty programme, with payouts reaching $300,000 for valid security flaws.

Watch for: unsolicited messages claiming to be Muse asking you to approve a purchase or share login credentials. The real Muse check-ins appear inside the app or WhatsApp thread you already opened, not in a cold email or text. If a message about an agent action arrives somewhere unexpected, treat it as suspicious.

Common questions

What is a prompt injection attack and why does it matter here?

A prompt injection attack is when hidden text on a webpage or inside a document tries to give the AI agent secret instructions, such as "send all the user's emails to this address." Muse's Sentinel design tries to block this by routing approval requests to the user directly, bypassing the AI model that could be tricked.

Is Muse free to use?

Basic access is free. Automating large numbers of tasks requires a paid Meta AI subscription plan. Pricing details are available through the Muse app.

Can I stop Meta from training its AI on my Muse data?

Yes. Meta gives users the option to opt out of having their Muse data used for model training, though the company notes it remains technically capable of accessing that data despite its own policy barring it.