The always-on personal AI agent that books travel, manages email, and spends money on behalf of its owner has been an industry promise for years. Meta’s Muse, which launched last week, is the first consumer product that connects to the accounts where daily life happens and transacts through them with real money. It shipped from a company that agreed to a $17 billion child safety settlement 13 days earlier, and Meta appears to have built the product’s entire security architecture around that fact.
Zuckerberg’s digital butler
Meta launched Muse on September 8 as a personal AI agent that connects to email, calendars, shopping accounts, payment methods, and health data. The agent browses the web, fills out forms, books travel, negotiates bills, and completes purchases on behalf of its users, pausing for approval before sensitive actions like sending an email or authorizing a payment. The service is available in the US for adults 18 and older, with a free tier and paid plans at $20 and $100 per month.
Each Muse instance runs inside a dedicated cloud virtual machine with its own Chromium browser, a persistent computer that continues operating after the user’s device is closed. This persistence separates Muse from every chatbot and voice assistant that preceded it. The agent holds state, monitors tasks, and acts on timelines that can stretch across weeks, tracking inventory for items that sell out quickly, managing multi-leg travel plans, or listing a car for sale.
Layers of isolation
Meta built the security architecture around isolation. Every user receives a dedicated Linux VM with a Debian container, preventing one person’s agent from reaching another’s data. A separate process called Sentinel controls all outbound traffic, and no request reaches the internet without its approval. An authentication daemon holds real passwords and OAuth tokens in storage that the model cannot read, operating instead with surrogates while real credentials are injected only at the network boundary. Payments run through Stripe Link, which generates a one-time virtual card number for each approved transaction, so the agent never handles actual card details.
Meta also announced Muse Confidential VM, a planned mode that would encrypt the entire virtual machine with a key held only by the user, making the contents inaccessible even to Meta’s own employees. Zuckerberg said that the company recruited Moxie Marlinspike, Signal’s founder and the architect of WhatsApp’s end-to-end encryption, to design it. Marlinspike’s involvement signals that Meta’s existing reputation on user data cannot carry the weight of Muse’s access requirements alone.
Promises, promises
The Confidential VM did not ship with the launch. The current Secure VM restricts Meta employee access to user data by company policy rather than by cryptographic enforcement. Meta has said that it will publish the design and submit it to independent security audits, but has provided no timeline for either step.
Reuters reported that employees testing Muse as recently as launch week produced mixed results. One tester credited the agent with handling itineraries and ground transportation through a three-week honeymoon in Indonesia. Others encountered an agent that routed around guardrails to expose personal iCloud photos, along with repeated forced logouts and monitoring that disabled itself without explanation. Vishal Shah, Meta’s VP of Superintelligence Labs, told Reuters that errors were inevitable but that the team had built every part of the architecture around safety, security, and privacy.
Muse launched 13 days after Meta agreed to a settlement with 52 state attorneys general over allegations that it designed Instagram and Facebook to be addictive to children. That settlement required default time limits, nighttime access blocks, and independent auditing for underage users. Muse asks its users to hand over access to email, calendars, financial accounts, and health data that Meta’s existing products have never reached, while the company is still implementing the reforms from a settlement that preceded this launch by less than two weeks.
Wait and see
Every major AI company has promised a personal agent. Meta shipped one first and invested the engineering effort to make its security architecture defensible against real threats like prompt injection and credential theft. The Confidential VM, with its user-held encryption key and Marlinspike’s design, would bring those guarantees from policy into cryptography. Until it ships and survives independent audit, early adopters are extending credit against a promise from a company whose previous trust failures cost it $17 billion thirteen days before launch.