Meta launched a personal agent on 8 September 2026. By the end of September it sat at number one on the App Store. It will read your mail, book your travel and sell your car. It would also like to hold your passwords.
This is an assessment, not a review. I have not run Muse. It is American-only and I am not American, so nothing below is a measurement of mine. What I did was read Meta’s announcement, its privacy and safety page, ZDNET’s hands-on account, and the argument that followed when a journalist said the agent had read messages he had refused to hand over.
That argument is the interesting part. Not for the reason the headlines suggested.
What the thing actually is
Muse is an agent, not a chatbot. You give it a goal — book the trip, chase the refund, sell the thing in the garage — and it works on it after you close the app, coming back when it needs a decision. It runs on Meta’s own model, Muse Spark. It lives inside the Muse Secure VM — a cloud virtual machine, one per person, holding the agent and the credentials for whatever you connect.
A second agent, Sentinel, sits on the same machine and is walled off from Muse by the platform itself. Nothing gets out to the internet without Sentinel’s approval, and Sentinel is what stops to ask you before something sensitive happens. Connectors cover email, calendar, payments, health, shopping and the smart home. Payments go through Stripe’s Link, which hands out a card that works once, so the agent never handles your real card number.
Most of what it does costs nothing, with 20 and 100 dollar monthly tiers above that. It is American-only: iOS, Android, muse.ai and WhatsApp, with glasses promised next.
The permission list is the product
ZDNET’s reviewer installed it in the smallest cage she could build. Muse asked for contacts, calendar and email. It offered to store her logins and passwords. It asked for Full Disk Access on her Mac, plus app links for Mail, WhatsApp, Notes and Messages. Her line about the timing beats anything I would have written: it wanted the whole of it before they had even been on a first date.
One detail keeps nagging at me. Muse will not go near the personal Facebook profile. Only a Page. The company that built the largest social graph in history has made an agent that wants your private mail but not your friends list. Work out which is worth more to an advertising business.
No permission dialog on your own machine can fix the next part. Gizmodo reported that the agent never says who it is when it acts, and Amazon’s position is that this makes it an undisclosed third party reaching into customer accounts without authorisation. Every website you use now has to guess whether the thing logging in as you is you.
One journalist, one denial, and a mechanism nobody has explained
In September, Inc. columnist Jason Aten reported that Muse had read his private messages, and that he had not granted access to them. He says he had never switched Full Disk Access on. When he asked the agent how it had managed this, Muse told him it was syncing his device notifications. Which would mean the text of banner alerts on his Mac was reaching the agent.
Meta answered in two layers. Its communications vice president, Andy Stone, said the Mac Messages integration is entirely opt-in, and that Messages stays unreadable until both Full Disk Access and its connector are switched on. David Singleton, an engineering vice president in Meta’s superintelligence unit, described three separate application-level permission steps plus macOS protections. Those, he said, hold even if the Muse app turns out to have a bug. He also said the agent had been confused when it explained itself.
So Meta’s position is that what Aten describes did not happen, and could not have.
Both accounts can be true at once, and that is not a dodge. If notification text was being passed to the agent as “device notifications”, Aten is right about the effect and Meta is right that the Messages database was never opened. The two claims are about different pipes. Nobody has published the mechanism that settles it. Until someone does, the honest description is this. A credible journalist says the agent surfaced content he never gave it. The vendor denies the specific route. And the explanation on offer is that the agent got its own conduct wrong.
The finding is not that Muse is malicious. It is that an agent with this much reach could not say accurately what it had done, and its maker’s defence was that it was wrong about itself.
Training is on when you arrive
From Meta’s help page, which is worth reading in the original rather than in a summary.
Meta’s models may learn from your conversations unless you change a setting that ships switched on. The toggle lives in Settings, under Data controls, and flipping it applies retroactively. Leave it on and Meta removes categories of identifying information — names, phone numbers, email addresses, Social Security numbers — then breaks the link to your account.
Deleting is less complete than the word suggests. You can delete messages, side chats and files, or reset the agent entirely. But the page says plainly that after you delete something, Muse may still remember what it learned from it. There is a “forget” skill that hunts through the agent’s memories and files and removes what it can find. Meta also points out that you can see what it remembers by asking, or by reading files such as your MEMORY.md.
An agent that keeps a MEMORY.md about you, inside a virtual machine you do not own, in a business that earns its money by knowing people, is not a scandal. It is a description. It is also the best argument for reading the settings before the first conversation rather than after the hundredth.
Credit where it is due
One part of this design beats the market average.
Sentinel sits outside the model. Wired’s interview is specific about the detail that matters: the permission checks are not filtered through the model. A prompt injection that talks Muse into mailing out your address book still has to get past a control that is not the model deciding whether it feels like asking. My rule has been the same for years. The gate that stops the catastrophic action must not be a sentence the model is asked to remember.
Two more terms before signing up. Meta keeps backups of your agent’s history against data loss, so what it learns lives in more than one place. And a full reset claims to delete all your Muse data — stronger than the caveat above it.
Where the lock would be
Here is the gap, in Meta’s words. Muse Confidential VM arrives later this year. Everything in it, your data and conversations included, is encrypted so that you hold the only key, and “not even Meta can access it”. Today’s Muse is not that.
Wired put the difference precisely: what stops Meta reaching into your agent’s data is policy, and not architecture. Policy is a promise an institution makes about its own future conduct. Architecture is a lock. They are not interchangeable, and 20 years of this industry have shown what happens when customers accept the first and assume the second.
What you can do now
Do not give an agent Full Disk Access. No errand is worth it. Point it at one folder, or one mailbox, or one service.
Keep it away from the accounts that define you — primary email, banking, identity, the password manager. If it needs one, create a fresh account that exists only for the agent’s work.
Turn training off before the first conversation, not after. On this product that is Settings, Data controls, and the model-improvement toggle.
Read the audit trail weekly. Not because you expect an incident. Because the trail is the only part of the product that tells you what the thing did rather than what it meant to do.
And if the capability is what you actually want, run the agent on hardware you own. Smaller machine, duller weekend. That is the difference between delegating to something you can inspect, and renting an assistant that keeps a file about you in a building you will never enter.
A better model does not answer the question of what an agent may do on your behalf. What answers it is what can stop the model, and who holds that thing. On Muse it is well designed, plainly documented, and still a promise.
If you want the engineering version of this argument — bounded, observable, recoverable, and the ten rules I use for delegated permissions — that is here: Handing Over the Keys.