Meta’s Muse Agent Can Spend Before the Privacy Lock

Meta launched Muse on September 8, 2026, a personal AI agent that can email, browse, and pay. It is live in the United States on iOS, Android, the web, and WhatsApp.

Mark Zuckerberg wrote that the free tier covers up to 100 million tokens a week. Stripe’s Link wallet sits at checkout, and the encrypted workspace that would keep Meta itself out of the machine is still listed for later this year.

Muse Ships With Its Own Linux Box

Muse is not another chat window on meta.ai. Each person gets a dedicated virtual machine with its own browser, CPU, memory, and storage, and that box keeps running after the app is closed.

Alexandr Wang, Meta’s chief AI officer, wrote that the product is always on, can use a browser, and connects to apps. People talk to it in a thread, pick a name and avatar, and set which services it may touch. For jobs that take time, it keeps going in the background and pings when a bill, a booking, or an email needs a yes.

JOBS META SAYS MUSE WILL TAKE

• Inbox and calendar: Send mail and work across connected accounts, with a stop for sensitive sends.
• Errands: Book travel, fill forms, cut bills, and turn a saved Instagram recipe reel into a grocery list.
• Goals: Turn a longer aim into a plan, then keep advancing it without a new prompt each step.
• No connector: Write a custom hook if a service has an API or command line; if it does not, use the built-in browser.

The model behind it is Muse Spark, the line Meta Superintelligence Labs opened on April 8, 2026. Muse Spark 1.3, posted on September 2, 2026, was trained for longer jobs, tool use, and asking before consequential steps. Tarek Sheasha, vice president at the labs, wrote that the team had been using Muse internally since early 2026, including handing it inboxes, calendars, and a shell.

Support for Meta AI glasses is listed as coming soon. Shop Pay is listed as another way to pay, and 1Password says vault access is coming so the agent can use passwords a person already stores, with the person still approving each request.

Stripe Already Built the Checkout Path

The launch that will change a shopping tab is not the chat tone. It is a wallet. Muse can complete checkout through Link by Stripe, and Meta says it is the first AI agent covered by Link’s purchase protections, including damaged or lost items, price drops, and no-fee returns on eligible buys.

LINK AT CHECKOUT

• Network: Stripe puts Link at over 300 million users worldwide.
• Instant pay: Muse can check out at more than 1 million businesses that accept Link, using the method a US buyer already saved.
• Everywhere else: Link issues a single-use virtual card scoped to the approved purchase.
• What the model sees: The person approves the total in the chat, and Muse never sees the underlying card or bank details.

Stripe is building the infrastructure that lets agents buy from businesses. By equipping Muse with Link’s wallet for agents, Meta is helping more consumers experience the magic of having an agent shop on their behalf.

Jay Shah, business lead for Link, Stripe

Wang has described paid Muse plans as a way to cover compute for heavy users. The newsroom post is quieter on ads: Muse does not share conversations or VM data with Meta ad systems, even when Accounts Center also holds Facebook or Instagram. Commerce is the path that is live on day one. A store that still relies on a cluttered product page, unclear variants, or a checkout that an automated browser cannot finish will lose that basket, because the buyer is no longer the person clicking through.

WhatsApp Turns the Agent Into a Chat

Meta is not asking people to learn a new command bar. Muse is built to feel like messaging a person, in its own app or inside WhatsApp, which is the distribution other agent makers still have to buy. Instagram and Facebook connectors are in the first set, so a recipe saved on a reel can become a list without a copy-paste step.

https://x.com/Muse/status/2097399178376671666

Ticketmaster said on September 9, 2026 that it is live as a Muse connector for US fans, with seating and pricing pulled into the thread and the actual lock-in still on Ticketmaster’s site. That is the pattern: Muse finds and fills, the merchant still closes the sensitive step, and the person taps yes.

If a site has no official hook, Muse can still open it in the VM browser. That is the piece that does not wait for every company to ship an API. It is also the piece that walks into phishing pages, one-time-passcode inboxes, and prompt-injection text sitting in an email or a product description, which is why the safety post spends most of its length on the harness rather than the model.

The August Settlement Never Reached This Product

On August 26, 2026, Washington Attorney General Nick Brown announced a $17.1 billion multistate deal over Facebook and Instagram, 13 days before Muse opened. The order puts a default two-hour daily time limit for teens across those two apps, a night block from midnight to 6 a.m., and muted notifications in school hours from 8 a.m. to 3 p.m.

FROM SPARK TO A WALLET

1. April 8, 2026: Meta Superintelligence Labs posts Muse Spark, the first model in the Muse line.
2. August 26, 2026: States announce the teen-safety settlement that rewires Facebook and Instagram.
3. September 2, 2026: Muse Spark 1.3 ships with longer-horizon agent training.
4. September 8, 2026: Muse the product opens in the US, with Link checkout and a WhatsApp thread.

Those teen caps, night blocks, and like-hiding rules attach to Meta’s social apps. They do not put a clock on Muse, do not stop it working after midnight, and do not treat a personal agent as a feed. The settlement’s definition of a new social product that would pull in extra rival terms also sets aside artificial intelligence features and chatbots. Muse sits outside that net.

Part of the cash still depends on whether Snapchat, TikTok, and YouTube take similar teen limits, a structure already laid out in how that payout still hinges on rivals copying limits. None of that language reaches a cloud Linux box that can buy groceries. The company that just agreed to slow teens down on Instagram is now handing adults a worker that does not sleep.

Sentinel Can Stop Muse, Not Meta

Sheasha’s safety post is frank about failure. The team designed the system on the assumption that the agent may be under attack, because it reads untrusted web pages and mail. Muse proposes an action. A separate host-side agent named Sentinel is the only process that can let a connector fire or let traffic leave the VM.

The harness runs in its own isolated cell, it doesn’t see real credentials, and every interaction with the outside world runs through a Sentinel which the agent can’t override.

Tarek Sheasha, vice president, Meta Superintelligence Labs

Passwords and payment secrets sit in a credential store on that VM, not in a central Meta pile, and the model sees a stand-in token. Sentinel swaps in the real secret at the network edge after it has allowed the request. Approvals for a purchase or an outbound email show up as a system dialog in the app, not as a suggestion inside the chat, so a poisoned web page cannot talk the model into skipping the tap.

The email connector strips one-time codes, password-reset links, and magic login links, so connecting Gmail is not supposed to let the agent reset the rest of a person’s accounts. Meta opened a public bug bounty of up to $300,000, including up to $130,000 for a prompt-injection that affects one user.

WHAT WE KNOW

• Isolation: Each Muse VM is walled off from every other person’s agent.
• Ads: Conversations and VM data are not shared with Meta ad systems.
• Training: The setting that lets Meta use Muse interactions to improve models is on when a person first uses the product, and it can be turned off, including for past threads.

WHAT IS UNCONFIRMED

• Operator access: Until Confidential VM ships, Meta can still reach data when it says it needs to run, secure, or support the service.
• Timing: Confidential VM is promised later this year, with a small tester group and outside auditors already looking at the design, not a public date.

That gap is the one that will decide whether people hand over mail and a card. Sentinel can stop Muse. It cannot, on the launch build, stop Meta. Confidential VM is the later design that encrypts the whole machine with a key only the user holds, so not even Meta can read active tasks. Until that ships, the privacy story is policy and isolation from other users, not cryptography against the operator.

A Hundred Million Tokens Sit on the Free Tier

Zuckerberg’s thread put a hard number on the giveaway. Muse is free up to 100 million tokens a week, with paid plans for people who burn more compute. An in-app meter is supposed to warn before an action would require payment. Wang has said most people should fit on the free tier.

MUSE PLANS AT LAUNCH

Paid agent modes at OpenAI and Anthropic still start on $20 month plans, with higher $100 and $200 tiers for heavier use. Muse is pricing the same rungs, then putting a large weekly pile on the $0 row and putting the thread where WhatsApp already is. That is a distribution bet, not a model-benchmark bet.

The US-only door will not stay closed forever. Wang wrote that more countries are coming. Glasses, Shop Pay, and 1Password are on the same later list as Confidential VM. The product that is actually live on September 8 is a cloud Linux box with a Stripe card, a Sentinel gate, a training toggle that starts on, and a promise that the lock against Meta itself arrives before the year is out.