Launched by Meta on September 8, 2026, Muse is presented as a personal agent capable of browsing the web, filling out forms, preparing purchases, booking certain services, negotiating, and continuing tasks in the background. What is new is not that a model generates better advice: the system can act in a digital environment with the permissions the user grants it. This delegation makes questions of control, security, consent, and accountability as important as the capabilities of the model itself.
What Meta actually launched
Meta introduced Muse on September 8, 2026, as a personal artificial intelligence agent. Unlike a chatbot that mainly responds to a query, Muse can receive a goal, use a browser and connected services, and then chain several actions together to try to accomplish it. Meta notably cites sending emails, booking travel, filling out forms, searching for products, making certain purchases, and negotiating. These capabilities are documented by the company in its official announcement, but they should not be interpreted as proof that every task will be performed correctly on every site, in every interface, or in every situation.[1]
Muse runs in a dedicated cloud virtual machine called Muse Secure VM. This architecture provides it with a browser, storage, and a separate execution environment. The user chooses which services the agent can connect to and the level of access granted. For certain sensitive actions, including sending an email or making a purchase, Meta states that human confirmation is required.[1][2]
The initial launch was limited to the United States. This information, accurate on September 8, has since become partly outdated. At Meta Connect 2026, Meta said that Muse was now available in the United States, Canada, and Mexico and that a rollout to other markets was planned, with no specific timeline for the European Union as of October 2, 2026.[4]
What is actually new
Agency does not mean that an artificial intelligence has a will of its own. In this context, the term describes a system capable of using a model, tools, memory, and orchestration rules to carry out a sequence of goal-oriented actions. What is new about Muse therefore lies less in some supposed absolute autonomy than in the integration, within a single consumer product, of an agent, a browser, connected services, permissions, memory, and validation mechanisms.
This shift moves the risk boundary. A wrong answer from a chatbot can mislead the user. A wrong action by an agent can, depending on the permissions granted, change a calendar, send a message, fill out a form, or trigger a transaction. The more an agent can act, the more decisive the quality of its control architecture becomes.
The move from advice to execution also changes the notion of trust. For a personal agent to be useful, it may need access to sensitive information: emails, calendar, preferences, task history, third-party accounts, or payment methods. Usefulness and the risk surface therefore grow together.
Executive MBA AI & Business
Transformation
The MBA reimagined for the AI era. For experienced executives who want to lead their organization’s transformation. Paris, Nice & Dubai.
How Muse works
The architecture Meta describes rests on several layers. The Muse Spark model provides reasoning, planning and tool-use capabilities. The Muse Secure VM offers a persistent environment where the agent can run programs, use a browser and keep track of a task’s state. Connectors allow it to interact with third-party services. A second component, Sentinel, oversees external actions and outbound network traffic.[2]
The main technical building blocks
| Component | Documented role | Point of caution |
|---|---|---|
| Muse Spark | Model used to plan, reason and call on tools for multi-step tasks. | Performance varies depending on the task, the tools available and the information encountered. |
| Muse Secure VM | Dedicated virtual machine with a browser, storage and runtime environment. | Isolation reduces certain risks without eliminating agent errors or vulnerabilities in the client software. |
| Connectors | Controlled access to services such as email, calendar or other applications. | Each additional permission widens the potential consequences of an error or a compromise. |
| Sentinel | Separate authority that reviews connector actions and outbound network traffic. | A control layer reduces risk but is not an absolute guarantee of security. |
| Human approval | Requests approval for certain sensitive operations. | Effectiveness depends on which actions require approval and on the clarity of the consent interface. |
Meta also describes a secret-separation mechanism: the main agent is not supposed to see actual passwords or tokens directly. Specialized components store the credentials and inject them when needed. This design applies the principle of least privilege, under which a component should have only the access strictly necessary for its task.[2]
For purchases, Meta announced an integration with Stripe’s Link using single-use cards, along with the planned arrival of Shop Pay and 1Password. It is important, however, to distinguish what is available from what has merely been announced: at launch, some integrations were still to come.[1]
MSc Generative AI
and Agentic AI
Become an expert in generative and agentic AI: LLMs, transformers, enterprise deployment. Silicon Valley learning trip included. RNCP Level 7 certification (Bac+6).
Buying, booking and negotiating: from advice to digital mandate
Muse illustrates a shift toward what might be called a digital mandate: the user defines a goal and a scope of authorization, then the agent carries out part of the chain of actions. In commerce, this distinction matters. Recommending a product means providing information; searching for an offer, comparing terms, filling in the required fields and preparing or completing the purchase amounts to taking part in the transaction.
Negotiation is even more revealing. Meta claims that Muse can, in certain scenarios, try to lower a bill or secure better terms. This feature should be presented as a capability announced by Meta, not as a generalized performance demonstrated by an independent evaluation. Whether a negotiation succeeds depends on the website, the service, the commercial rules, the context and the actual room for maneuver available.[1]
For businesses, the arrival of agents capable of interacting with websites could have several consequences: more automated requests, a need to make pricing and contractual information more structured, the emergence of new sales journeys and the development of interfaces designed as much for agents as for humans. These consequences nonetheless remain speculative. There is not yet enough evidence to measure the share of transactions that will actually be initiated or executed by personal agents.
What the evidence actually supports
Meta’s documents establish the existence of the announced features, the architecture of the Secure VM, the role of Sentinel and the presence of human approvals for certain operations. They are useful primary sources for understanding what Meta has built, but they are not enough to demonstrate the product’s average reliability in everyday use, nor to establish that it is safer than any other agent.[2]
The first independent hands-on reports available in late September 2026 paint a more nuanced picture. Journalists reported successful tasks, but also limitations related to websites, integrations or the accuracy of actions. This early feedback is useful for identifying concrete problems, but it does not yet amount to standardized evaluations on large samples.[11]
It is therefore premature to conclude that Muse can replace a human assistant or that it can reliably execute arbitrary workflows. To truly evaluate an agent of this kind, one would need to measure, at a minimum, the task success rate, the number of human interventions required, the frequency of errors, the severity of incorrect actions, robustness against malicious content and the ability to recover after a failure.
MSc Generative
and Agentic AI
Become an expert in generative and agentic AI: LLMs, transformers, enterprise deployment. Silicon Valley learning trip included. RNCP Level 7 certification (Bac+6).
When security becomes a matter of architecture
Meta explicitly acknowledges that an agent like Muse can make mistakes and can be attacked through the data it accesses. The best-known risk is indirect prompt injection: a malicious instruction placed in a web page, an email or a document can attempt to hijack the agent’s behavior. OWASP also identifies tool misuse, privilege escalation, data exfiltration and memory poisoning among the risks specific to agentic systems.[2][6]
Muse combines several safeguards: virtual machine isolation, secret separation, outbound network controls, granular permissions, human approval and logging. This defense-in-depth approach is consistent with cybersecurity best practices. It does not, however, make the system invulnerable.
A concrete example drove the point home a few days after launch. On September 21, 2026, security researcher Patrick Wardle published a proof of concept targeting the Muse app for macOS. The flaw allowed a local process already able to run under the user’s account to modify an undocumented setting and redirect dictation traffic, with a risk of the Muse authentication token being retrieved. The key point is not to overstate the scope of the incident: the attack already required local code execution and did not, on its own, constitute a remote intrusion into an uncompromised Mac. Meta then quickly released a fix, according to several specialized outlets.[7][8]
This incident illustrates a structural challenge: the more permissions an agent has, the more serious the consequences of a vulnerability in the software hosting it can be. An agent’s security therefore depends not only on its resistance to prompt injection, but on the entire software chain: client, authentication, permissions, connectors, browser, operating system and update mechanisms.
Personal data, consent and the European framework
Muse’s personalization relies on retaining information and on connections to third-party services. Meta states that users can choose which apps are connected, change permissions, ask for certain information to be forgotten and opt out of having their interactions used to train models. The company also states that Muse conversations and data from its VM are not shared with its advertising systems. These are commitments declared by Meta; a full assessment also requires examining the contractual policies and the data processing actually carried out.[1]
In the European Union, the relevant legal framework is not limited to the AI Act. If Muse were offered there, the processing of personal data would in particular have to comply with the GDPR. The obligations would depend on the nature of the data, the purposes, the responsible parties and the connected services. For interactions with an AI system, Article 50 of the AI Act has imposed, since August 2, 2026, certain transparency obligations so that people know when they are interacting directly with an AI. These rules do not mean that all personal agents are automatically classified as high-risk systems.[9]
Purchasing or booking operations also raise questions of consumer law and proof of consent. An agent may technically prepare a transaction, but user identification, understanding of the total price, contractual terms, return conditions and the ability to dispute an error remain decisive. Automation does not erase these obligations.
Where Muse is available as of October 2, 2026
Muse’s availability has evolved quickly. On September 8, Meta announced a rollout in the United States on iOS, Android and the web. On September 24, the company said the service was now available in the United States, Canada and Mexico, with more markets to follow.[1][4]
Muse is also available on Mac, and Meta has announced its integration into its AI glasses. These extensions show that Meta no longer positions Muse as a simple app: the company is seeking to turn it into an assistance layer accessible across multiple devices and services.[4]
As of October 2, 2026, Meta had not announced a specific launch date for Muse in France or, more broadly, in the European Union. It would therefore be incorrect to present the product as already available to the French public. Any change on this point should be verified before the article is published or updated.
What to watch next
Muse is a particularly visible example of the shift from conversational AI to action-taking AI. But the decisive question is not only how many tasks the agent can perform. It is determining under what conditions delegation becomes reliable, reversible and understandable enough to be acceptable.
Several indicators will be decisive in the coming months: the actual frequency of errors, security incidents, the quality of consent mechanisms, how permissions evolve, the ability to explain the actions performed, international availability and any adjustments imposed by regulators. It will also be important to see whether users choose to grant an agent lasting access to the most sensitive areas of their digital lives.
The major change introduced by Muse, then, is not that an AI can book or buy. It is that generative software can become an active intermediary between a person and the digital services they use. As this delegation expands, trust will have to rest less on the promise of ever more autonomous intelligence than on verifiable guarantees of control, security and accountability.
Further reading
To dig deeper into the transition from conversational assistants to agents capable of taking actions, four articles from the aivancity blog extend the analysis.
Sources
[1] Meta, September 8, 2026. Introducing Muse: The World’s First Personal AI Agent Built for Everyone. View source
[2] Meta AI Research, September 8, 2026. How We Built Safety Into Muse. View source
[3] Meta AI, 2026. Muse: Your Personal AI Agent. View overview
[4] Meta, September 24, 2026. Meta Connect 2026 : Meta annonce de nouvelles lunettes IA, des nouveautés pour Muse et les Meta VR Glasses. View source
[5] Meta AI, 2026. Download Muse. View page
[6] OWASP, 2026. AI Agent Security Cheat Sheet. View recommendations
[7] InfoQ, September 24, 2026. Un-Mused: How a Single Debug Setting Bypassed macOS Security in Meta’s AI Client. Read article
[8] The Verge, September 2026. Meta Patches Muse Exploit That Let Attackers Control the AI Agent. Read article
[9] European Commission, July 20, 2026. Lignes directrices sur les obligations de transparence pour les fournisseurs et les déployeurs de systèmes d’IA. View guidelines
[10] European Commission, February 17, 2026. Deux ans de règlement sur les services numériques garantissant des espaces en ligne plus sûrs. View source
[11] Business Insider, September 2026. 5 BI Staffers Who Put AI Agents to Work Share What Worked and What Went Wrong. Read article