Meta Muse: The Personal Agent That Buys for You
Meta launched Muse on Sep 8 — a personal agent that shops, books and emails for you inside a Secure VM. Free to $100 a month; here's what it means.
Meta launched Muse on September 8, 2026 — a personal AI agent that shops, books appointments, and sends email on your behalf, all inside a purpose-built secure environment. It starts free, with paid tiers at $20 and $100 a month, and it's the clearest sign yet that the big platforms think the "do it for me" agent is about to be the default consumer tool.
Where a chatbot waits for your next message, Muse is built to finish a task. Give it a goal — "find a table for Saturday and email my sister the plan" — and it opens a browser, fills in forms, sends the email, and pays the bill inside your own connected accounts. Mark Zuckerberg called it a system that "works 24/7 to get things done for you", and it lands in the middle of the current agent moment.
What Muse actually does
Muse connects to your email, calendar, shopping accounts, and health data, then acts across them instead of just answering questions:
- Shopping: completes purchases using Link by Stripe, which generates a single-use card number so the merchant never sees your real card.
- Booking and scheduling: makes appointments and reservations and handles the back-and-forth in your inbox.
- Email and forms: writes, sends, and fills in the paperwork for you.
- Long-running tasks: keeps working after you close the app, coordinating resources until it needs your input.
Meta says most people will stay on the free tier, and an in-app meter warns you before you hit a usage limit.
Where it runs: the Secure VM
The interesting part isn't the shopping — it's how Meta contains it. Muse runs in a Muse Secure VM, a dedicated, secure computer with its own real Chromium browser sitting behind a virtualization layer. Under the agent, Meta layers deterministic boundaries that apply even if Muse is persuaded to behave badly:
- Privacy: the VM limits which code can see which credentials, and policy bars Meta itself from reading your Muse data.
- Safety: a separate Sentinel safety agent evaluates every action and all network egress before it happens.
- Approvals: sensitive actions like payments carry a human approval boundary.
That's a genuinely different posture from an agent living in your general-purpose browser and wandering. Meta is explicitly selling trust — and it has a real audience to win it from. OpenClaw and Instinct already showed that people will happily hand a task to a text thread and let it run.
What it costs
The pricing is the headline for most people:
| Plan | Price | What you get |
|---|---|---|
| Free | $0 | Baseline tasks, with a usage meter |
| Power | $20/mo | More usage for everyday handoffs |
| Maximum | $100/mo | Highest usage and longest-running tasks |
It's US-only at launch, for people 18 and over, on iOS, Android, and the web — with no date yet for the UK or the rest of Europe.
The catch: trust
WIRED's reporting makes the fine print clear: the Secure VM is built to protect you, but it is not a locked box. Meta says it is barred by policy from accessing your Muse data, but it would still be technically possible. The agent also needs real access — email, calendar, payments, health — which is the exact trade-off that fueled the privacy backlash across the category.
If you're going to hand a shopping list and a payment method to an agent, the single most useful habit is to give it the least access it needs and keep the approval boundary on for every transaction. That's true whether it's Meta, Microsoft, or a self-hosted agent you run yourself.
What it means for you
Muse makes the case that personal agents are about to be a mainstream product, not a hobbyist tool. The practical takeaway: an agent that pays for things is powerful and worth using — as long as you remember it's a browser running on a secure VM, not a magic wand with your card. Grant access the way you'd choose a password: scoped, approving, and reversible.
