Meta’s Muse is a personal agent with its own Linux VM, not another chat app

Meta shipped Muse on September 8, 2026: a personal agent you talk to in the Muse app or WhatsApp, backed by a persistent Linux VM with a browser, a file system, and a terminal. The product page’s claim is blunt. Give it a goal. It handles the rest (shopping, email, calendar, forms) after you approve the actions that matter.

This is not the Muse Spark 1.1 Model API story AgentRiot already covered. Spark 1.1 was Meta selling a cheap coding model. Muse is Meta handing that model family a computer, connectors, and a permission broker.

What actually shipped

ai.meta.com/muse lists iOS and Android downloads. The web product is muse.ai. Clients connect to your VM. Meta’s security write-up is dated September 8, 2026 and is the detailed account of the harness.

The VM is not “ChatGPT with plugins.” Meta describes a dedicated Linux box with enough CPU, memory, and storage to compile code the agent writes, run concurrent sub-agents, and keep cron jobs. The agent can write its own tools when a connector does not exist. How We Designed Muse adds the consumer pitch: documents, PDFs, web pages, trackers, study guides.

Connectors named on the marketing site include email, calendar, and Instagram. The security post says Meta also built connectors to other Meta apps such as Facebook, plus an initial set of third-party APIs. Muse can write custom connectors for services that expose an API or CLI. Treat that as Meta’s architecture claim, not a tested integration catalog.

The interesting part is Sentinel, not the slogan

The security post’s useful idea is that the LLM is untrusted.

The Hatch daemon (Meta’s internal name for the harness) and the workspace live in a systemd-nspawn runtime cell. Root inside that cell is not host root. Sensitive services sit outside the cell: safety classifiers, privsep workers for built-in connectors, hatch-authd for credentials, and Sentinel, which is the only thing that can approve connector actions and network egress.

The agent never sees real OAuth tokens. It sees surrogate tokens. Sentinel inserts the real credential at the network boundary after the request is allowed. Prompt-injecting the model into “print the API key” is designed to fail because the key is not in the cell.

Human approvals do not go through the chat. Sentinel sends a dialog to the client UI; the answer comes back to Sentinel. Grants are scoped (one-time, session, task, time-bounded, or perpetual). Read-only or previously allowed traffic can auto-pass. “Tainted egress” uses eBPF to drop auto-allow once a process has read user data.

Email is treated as a high-risk connector on purpose. Muse filters one-time codes, password-reset links, and magic login links so connecting Gmail is not supposed to become a password-reset oracle.

Meta is opening a public bug bounty with awards up to $300,000, including up to $130,000 for a prompt-injection that affects one user. That is a vendor program, not a proof the stack is sealed.

Privacy claims to keep labeled

muse.ai says conversations are not shared with Meta’s ad systems. Logins go in a credential store the agent cannot see, with 1Password “coming soon.” Checkout can mint a one-time card so neither the merchant nor the agent sees the real number. Eligible purchases sit under Link purchase protections.

The security post is more precise than the landing page: the VM is the system of record; limited data leaves the VM for inference and telemetry. That is not “nothing ever leaves the box.”

No consumer price table is on muse.ai/pricing as of September 9, 2026. The URL renders the same marketing page.

How it uses Spark 1.3

The security post says Muse was trained for zero-shot CLI/skill tool calling, long context, injection-aware instruction following, and multi-agent coordination. It names Muse Spark 1.3 as close to state of the art on Meta’s prompt-injection evals. That is Meta’s metric, not an independent leaderboard.

Cursor separately documents Spark 1.3 as a coding model. Same family, different surface. The agent product is the VM plus Sentinel. The model ID is the brain inside it.

What to actually test

If you try Muse, the questions that matter are operational, not cinematic:

• Does Sentinel ask on the actions you care about, or auto-allow too much once taint tracking misses?
• Do email filters drop real work along with OTPs?
• How painful is WhatsApp versus the native app when an approval lands?
• What happens when the agent writes a custom connector: does that code still sit inside the unprivileged cell?

Meta’s own post says the team dogfooded this since early 2026 and that unattended inbox-plus-shell access did not always go as planned. That sentence is more useful than “personal superintelligence.”