Meta has spent two years talking about agentic AI. This week it shipped one to the public — and asked hundreds of millions of people who already have complicated feelings about the company to hand it their email, their calendar and their credit card.
Muse, which began rolling out this month on the web, iOS, Android and WhatsApp, is built to act rather than merely answer. Where a chatbot drafts a reply, Meta says Muse can send the email; where a search engine returns flight options, Muse can book one. Powered by a model Meta calls Muse Spark, the agent is designed to keep working after a person closes the app, checking back in when something changes or when it needs approval to go further, according to TechCrunch's rundown of the launch.
The task list Meta is pitching is deliberately mundane: paying bills, filling out forms, turning a saved recipe video into a shopping list, planning a trip and then executing the bookings, or renegotiating a subscription. To do any of that, Muse needs to reach into the accounts people actually use — email, calendars, payment apps, smart-home controls, dining and shopping platforms, and music services. Users connect each service individually, and purchases run through Link by Stripe, with Shopify and 1Password integrations described as coming later.
A locked room, on paper
Meta's answer to the obvious next question — what stops an agent with that much access from doing something people didn't intend — is architectural. According to Meta's own announcement, Muse runs inside an isolated environment it calls the Muse Secure VM, with a separate internal system, Sentinel, required to sign off before the agent can take any action that reaches out to the open internet.
Muse won't have visibility into people's passwords or payment methods, and it doesn't share people's conversations or data with Meta's ads systems.
Meta, in its Muse launch announcement
The company says every action Muse takes is logged in an audit trail users can review, that people can opt out of having their data used to train future models, and that a more restrictive mode called Muse Confidential VM — encrypting activity with keys only the user holds — is coming later. Pricing starts free, capped by a usage meter, with paid tiers at $20 and $100 a month for people who want higher limits, and the product is expected to eventually extend to Meta's AI glasses.
The trust Meta is spending
None of those safeguards exist in a vacuum. As TechCrunch lays out at length, Meta is asking for this access from a starting position shaped by a 2011 FTC settlement over consumer data made public without consent, a then-record $5 billion FTC penalty in 2019, a 2023 FTC complaint alleging the company had violated that earlier order, a 2019 discovery that some user passwords had been stored in plain, readable text, and the Cambridge Analytica scandal before that. The company also agreed this past August to an $18 billion multistate settlement over social media's harms to children, on top of a separate $942 million judgment awarded in New Mexico. It is a lot of history for an assistant that wants standing access to someone's inbox and bank-linked payment app.
Meta's bet, visible in the product itself, is that personality can do some of that trust-building work: people can name their agent, pick an avatar and set how it talks to them, turning a permissions dialog into something that feels more like configuring a helper than granting a company access to a life. Whether that framing changes anyone's calculus is untested — early coverage of the rollout notes plainly that "questions remain about whether consumers will extend the company sufficient trust" to let Muse operate as advertised.
Muse also does not arrive into an empty market. Meta frames the release as a broader industry pivot from AI that answers to AI that acts, and it lands alongside comparable pushes already underway at Google and Anthropic, both of which have been building their own task-executing agents this year. What differentiates Meta's version is less the technology than the audience: Muse is aimed squarely at consumers on their phones, not developers or enterprise IT departments, which means its first real test won't be a benchmark score. It will be whether ordinary users are willing to let it read their mail.
