A First Look at Meta Muse

Meta Muse is a personal AI agent from Meta, launched on 8 September 2026, that runs on a dedicated virtual machine in Meta’s cloud and carries out tasks across a user’s connected apps instead of only answering questions.

If you’ve wired an MCP server into a desktop client and then watched a launch video promise an agent that “does things for you”, your first questions are probably practical ones. Where does the code run? Who holds the API keys? Can I connect my own server?

This article answers those questions using Meta’s published statements and one vendor’s hands-on report. For general background on agents, see the introduction to agentic browsers and how the Manus AI agent works. Every security and privacy property described below is Meta’s claim. No independent security audit of Muse has been published.

What Is Meta Muse and How Does It Differ from a Chatbot?

Meta Muse is a long-running agent with its own computer, not a chat window. Meta’s launch announcement describes Muse as running on a dedicated secure computer with its own browser, and Meta describes each user’s VM as an isolated Linux machine with storage and enough compute to compile and run the code the agent writes. That last part is what lets Muse build its own integrations.

There are two practical differences between Muse and ChatGPT or Claude in a browser tab. Muse keeps working toward a goal after you close the app, and it acts inside your connected services from its own machine instead of returning text for you to act on. One note on naming: Muse is the agent, and Muse Spark is the Meta model family that powers it.

What Can Meta Muse Do?

Muse handles everyday errands that span several services:

• Reading, drafting and sending email
• Making bookings and planning trips
• Shopping and completing purchases
• Filling in web forms

According to Meta, Muse asks for your approval before it sends an email or completes a purchase. Tasks Meta classes as low-risk can go ahead without sign-off.

How Do Muse’s Secure VM and Sentinel Work?

Sentinel is the part of Muse that controls what leaves the VM. According to Meta, a separate agent called Sentinel runs in its own host-side security domain on the same VM, outside the agent’s runtime cell. It approves every outbound network request and inserts real credentials at the network boundary, so the Muse agent itself only ever handles surrogate tokens. Meta’s safety engineering post asks readers to picture one machine split into two separate security domains, rather than a model with root access to the whole box.

As Meta describes it, an outbound request moves through these steps:

1. Code in the agent’s runtime cell makes a request that carries a surrogate token.
2. Sentinel checks the request against your connector policies and any approvals you’ve given.
3. If the request is approved, the real credential replaces the surrogate at the network boundary.
4. The request reaches the external service.

Meta also says the OAuth tokens for your connected services are kept on your own VM rather than in Meta’s central systems.

Built-in and custom connectors are isolated differently. Meta says built-in connector code runs in a privilege-separated worker outside the agent’s runtime cell. According to Parallel’s report, custom connector code runs inside the runtime cell itself and doesn’t get that extra separation.

Sentinel’s credential substitution only covers keys entered through Muse’s secure credential prompt. Parallel’s report notes that if you paste an API key into the chat, that mechanism is skipped and the key stays in the conversation history.

Which Built-in Connectors and Access Levels Does Muse Offer?

Built-in connectors are the integrations listed in Muse’s connector directory. The launch set includes Google Workspace, Ticketmaster, OpenTable, Spotify and Apple Health, plus Meta’s own apps. Since 18 September, outside developers can also submit connectors, which Meta reviews before listing. The list keeps growing, so don’t treat any list as complete.

Access is set per connector. Parallel’s report describes three levels: read-only, require approval, and allow. That lets you give Muse permission to read your email while still having to approve every send. When an approval is needed, Meta says a grant can last for one action, a session, a task, a set time, or permanently, but Sentinel decides which of those options to offer for each request. Don’t expect a permanent option for every action.

Can Muse Use Custom Connectors and MCP Servers?

Muse can use remote MCP servers. To add a service that isn’t in the connector list, Meta’s Help Center says you ask Muse in chat to create a custom connector. According to Parallel’s report, when you give Muse an MCP server URL, it writes an MCP client on its VM using the official SDK, connects over streamable HTTP, and saves the integration as a reusable skill. Plain public REST APIs work the same way: Muse writes the client code itself.

Whether Muse can reach your server depends on where the server runs:

Before you hand a URL to Muse, check that the server lists its tools to a remote client. The script below runs the same connect-and-list-tools sequence that Parallel reports Muse performing. It uses the v1 maintenance line of the official MCP TypeScript SDK. The file uses the .mts extension so that tsx runs it as an ES module, which the top-level await needs:

// check-mcp.mts
// Confirms a remote MCP server answers over streamable HTTP and lists its tools.
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const url = new URL(process.env.MCP_URL ?? "https://mcp.example.com/mcp");

const headers: Record<string, string> = {};
if (process.env.MCP_TOKEN) {
  headers.Authorization = `Bearer ${process.env.MCP_TOKEN}`;
}

const transport = new StreamableHTTPClientTransport(url, {
  requestInit: { headers },
});
const client = new Client({ name: "reachability-check", version: "0.1.0" });

await client.connect(transport);
const { tools } = await client.listTools();
for (const tool of tools) {
  console.log(`${tool.name}: ${tool.description ?? ""}`);
}
await client.close();

npm install @modelcontextprotocol/sdk@1
MCP_URL=https://mcp.example.com/mcp npx tsx check-mcp.mts

Run it against the server’s public URL, never localhost. If it succeeds, the server is reachable and lists its tools. That doesn’t guarantee Muse will work with it.

Then give Muse a prompt along these lines:

Build a custom connector for [service name] using its MCP server at
[https://mcp.example.com/mcp]. It uses streamable HTTP and [needs / does not need]
authentication. If a key is required, ask for it through the secure credential
prompt, not in this chat. List every tool the server exposes, test each one,
show me the results, then save the connector as a reusable skill.

Meta does not review custom connectors. Connecting one means trusting whoever runs that API or MCP server with any data Muse sends to it.

Limits and Open Questions

Muse launched for adults in the US, on iOS, Android, muse.ai and WhatsApp. Since then, Meta has released Mac and iPad apps and expanded Muse to more countries, including Canada and, on 27 October, Singapore. Meta has said support for its glasses is coming. The plans are Free, Power at $20 a month and Maximum at $100 a month. Parallel reports that you need a payment card on file even for the free tier. Meta’s launch materials don’t state usage limits for each plan.

Meta also makes privacy claims. In its safety post, it says you can opt out of having your conversations used for training, and that conversations and VM data aren’t shared with its ad systems. It also says how you use Muse can still affect your ads indirectly. For example, a store Muse visits or buys from on your behalf may see that as your visit and show you ads for it.

The table below separates what was live at launch from what Meta has only announced, based on Meta’s launch materials:

The bigger gap is verification. The isolation model is well documented, but only by Meta. Until an independent security audit is published, treat Sentinel’s guarantees as design claims rather than tested properties.

Conclusion

Muse is a cloud VM with an agent inside it and a separate gatekeeper, Sentinel, in front of the network. That design explains both what it can and can’t do. It can build its own clients for any public API or remote MCP server, but it can’t reach anything that lives only on your machine, and it only protects keys entered through the secure credential prompt. If you plan to connect your own service, deploy the MCP server at a public streamable HTTP endpoint and run the reachability check first. Give Muse the narrowest access level that still lets it do the job.

FAQs

Can Meta access the data inside my Muse VM?

Yes. Meta's safety write-up says the Muse Secure VM isolates each user's data from other users and limits Meta staff access through operational policies, but does not prevent Meta from accessing data when needed to support, secure or operate the service. The announced Muse Confidential VM is meant to cryptographically and verifiably block that access. Meta says a small group of trusted testers already use it and that it has begun sharing the design and source code with external auditors.

Is there a public API for controlling Meta Muse?

No. According to Parallel's report, there is no public API for driving a Muse agent or reading its skills from outside the app. Developers can submit connectors to Meta for review, but that doesn't give them control of anyone's agent. Meta also offers the Meta Model API, a separate service in public preview that serves the Muse Spark models through OpenAI- and Anthropic-compatible endpoints at api.meta.ai. It gives you the model, not the agent, its VM or Sentinel.

Does Sentinel protect Muse against prompt injection?

Only partly. Meta calls prompt injection an unsolved problem across the industry and says Muse will still make mistakes. Its defences are layered: model training against injected instructions, labelling all external content as untrusted, detection classifiers trained separately from the main model, and human approval for actions that move data out of the VM. Approval requests appear as system dialogs, not chat messages, so injected text cannot fake your consent.

Why does Muse ask for approval on some outbound requests but not others?

Sentinel tracks which tool processes have read your data. As Meta describes it, a process that has not read user data can reach a short list of pre-approved destinations on its own, while a process that has read user data must ask you before it sends anything out. Your per-connector access settings also apply, and Meta says Muse checks in before sending email or completing a purchase.