Meta Muse Review: What It Does and Who Should Use It

Ask a chatbot to plan a trip and it writes an itinerary. Ask Meta's Muse and it opens a browser, compares flight prices and starts the booking.

Muse launched on September 8, 2026, and passed 6.6 million downloads by early October 2026. It also comes with real privacy and security problems, and those decide whether it belongs in your life or your business.

What Muse Is and How It Differs From a Chatbot

Muse is a personal AI agent from Meta. It carries out multi-step tasks across connected apps and the public web, instead of answering one question at a time. A request like "cancel the subscriptions I never use" is the kind of job it takes on.

The difference from Meta AI or ChatGPT is what happens after you ask. Those apps are built to answer questions, while Muse is built to take action. When it plans a trip, it compares flights, reads hotel reviews and starts the booking, then stops to ask for your final approval before any money moves.

You can reach it in several places. Meta launched Muse as a mobile app, a web interface, a native macOS app and a chat inside WhatsApp. It is limited to adults in the United States and Canada, and Meta has announced no timeline for the United Kingdom or the European Union.

Where It Came From

Meta's earlier AI work centered on media. In 2023 it launched Emu, an image generation model, followed by Emu Video and Emu Edit. By mid-2026 the industry was shifting from building models to building agents that run software workflows.

Alexandr Wang leads Meta's AI work as its first Chief AI Officer. Meta appointed him after a $14.3 billion deal for a 49 percent stake in Scale AI in 2025. The standalone Emu features were quietly retired, and their media generation abilities moved into a new line of action-oriented models called Muse Spark.

What You Would Actually Use It For

Muse has three audiences right now: consumers, small business owners, and larger companies and developers. The tasks differ for each.

Everyday Errands

The documented consumer uses are chores that normally mean juggling several tabs and accounts. Users have asked it to audit financial statements for duplicate charges, to cancel subscriptions that go unused, and to negotiate internet bills by working through customer service portals.

Muse also reaches into Meta's own apps. A user can save a recipe reel on Instagram, and Muse turns the video into a grocery list. It checks the list against the dietary restrictions of friends coming to dinner, then handles checkout through partners such as Instacart or Walmart.

The macOS app goes past cloud services. It can control local desktop software, draft replies in Apple Messages, organize local files and read the macOS Calendar.

Time reported one case involving an 82-year-old user. She had Muse compile a comparison of Medicare Part D plans so she could find affordable international prescription medications. A separate account from Lumenlab says budget gym chains such as Planet Fitness saw their stock prices drop after launch, because people used Muse to cancel old memberships they had abandoned. That is one outlet's reading of the market, not a measured cause.

Small Business Work

On September 29, 2026, Meta expanded Muse with Muse for Small Business, a set of new skills and connectors. Owners can connect Meta ad accounts, Facebook Pages and Instagram professional analytics. The same update added integrations with Shopify, Slack, Zoom, Asana and Canva.

The idea is to give Muse a goal instead of a single caption to write. An owner can ask it to pull past sales from Intuit QuickBooks, find the best-performing social campaigns from last quarter, flag unusual expenses and draft a growth plan and next week's campaign. Muse gathers the data through its connectors, works on it inside its cloud machine, and presents drafts for approval before it publishes content or spends ad budget.

Teams and Developers

Meta also introduced the Meta Enterprise Platform, which splits the Muse ecosystem into four parts. The standard Muse agent handles multi-step tasks. The Meta Business Agent talks to customers, qualifies leads and closes sales inside messaging channels. The Meta Model API serves custom software, and Muse Code covers software engineering and deployment. Kingy.ai says this may mark the start of Meta's attempt to displace traditional CRM software by putting agents in the channels where customers already talk to businesses.

The Muse Charm

Meta plans a hardware companion for December 2026. The Muse Charm is a palm-sized, 5G-connected device that hangs from a keychain. It has a two-inch touchscreen, cameras, microphones and a fingerprint-to-talk sensor.

It shows your customized avatar, which carries the default name "Jolly," and handles basic voice requests with no noticeable delay. You can tap it to photograph where you parked or to ask for your next meeting time without touching your phone.

Earlier AI gadgets such as the Humane AI Pin and the Rabbit R1 failed badly. Futurum's analysts suggest the Charm might do better because it does not process complex work on the device. It acts as a microphone and camera for the cloud-based Muse machine.

How Muse Works Under the Hood

An agent that can read your email and spend your money can do a lot of damage if it makes a mistake or gets hijacked. Meta's answer is to separate the model from anything dangerous, using physical and systemic isolation instead of rules written into a prompt.

A Dedicated Cloud Computer for Every User

Most chatbots send millions of requests through a shared, always-warm pool of compute. Meta dropped that design for Muse. It gives each active user a dedicated, isolated Linux virtual machine in the cloud, called the Muse Secure VM.

The VM holds the agent and your connected data, and it sits apart from your phone or laptop. It works like a persistent computer with a file system, a terminal and a full web browser. That is why Muse can keep working after you close the app. It can keep watching airline prices, wait in a customer service queue or compile a research report while your phone sits in your pocket.

This costs Meta more than a shared pipeline would. According to aiskill.market, Meta absorbs that cost on the free tier by counting on transaction fees from purchases the agent completes, instead of charging for compute through subscriptions. There is also a latency cost. A VM that has been idle needs a cold start, so the first interaction in a session runs a bit slower than a stateless chatbot. Teams planning their own agents also need to think about prompt caching for AI agents to keep inference costs under control.

Sentinel, Hatch and the Credential Wall

The VM keeps the agent away from your physical device. It does not stop the agent from doing something wrong inside its own cloud environment. For that, Meta runs a supervisor called Sentinel.

Sentinel runs on the same VM but is isolated at the system level. The model itself never gets direct internet access or raw credentials. It outputs intents through a software layer called Hatch, which turns them into file commands or browser controls. Nothing Muse tries to do reaches the public internet unless Sentinel approves it.

Passwords and API keys live in a credential store the model cannot read. When the agent has to log in somewhere, Sentinel steps in and injects a surrogate session token. The model never sees your password, and it cannot see passwords you type into the browser yourself.

Payments follow the same idea. Muse works only with Link by Stripe and Shop Pay, which create one-time virtual card numbers at checkout. Neither the merchant nor the agent handles your real card, and standard purchase protections still apply.

Defending Against Prompt Injection

Prompt injection is the attack where hidden instructions on a web page or in an email trick an agent into acting. Meta uses a mechanism called tainted egress to limit it. The Linux kernel inside the VM flags any process that has touched untrusted external data. If a flagged process tries to send data out, Sentinel blocks it and sends an approval request to your device.

The browser subagent also works from an accessibility-tree snapshot of the page, not raw HTML, so embedded scripts do not run. Because the approval prompt bypasses the AI model entirely, text planted in the agent's context cannot answer its own approval request. Kodem Security's analysis of the model says the AI model has no say in the approval, which makes this a strong boundary, though not an infallible one.

Connectors

Websites change layouts, add CAPTCHAs and block automated browsing, so driving a raw site is fragile. Meta built the Muse Connector Platform so developers and businesses can plug software straight into the agent through API endpoints or Model Context Protocol (MCP) servers.

There are two kinds. Directory connectors are submitted by developers and reviewed by Meta for function, security and legal compliance, then listed in the Muse app directory. Custom connectors are built by Muse for one user, using raw APIs that user supplies. Meta does not review them, so the security and privacy burden falls on the person granting access.

The review is not light. Developers must supply API or MCP documentation, proof of business verification and data processing questionnaires covering retention and international transfers. They also provide test accounts with representative data so reviewers can check human approval on sensitive write actions, such as making a purchase or changing a database. Approved connectors give Muse read and write access to tools such as Shopify, GitHub, Notion, Slack and Intuit QuickBooks.

The Models Behind Muse

Muse launched on a tool-optimized model called Muse Spark 1.3. On October 12, 2026, Meta moved it to a new family called Muse Wonder, which it designed for long-running, multi-step agent work instead of simple chat. MarketWatch described the release as Meta getting back on the AI leaderboard.

Active Memory and Active Focus

Wonder adds two features aimed at the two most common ways agents fail. One is forgetting context. The other is giving up when something breaks.

Active Memory lets the model pick out and store details that matter, such as preferences, project goals, dietary restrictions and past decisions, for days, weeks or months. When you start a task, it decides which stored details apply. In an example from Digit, you mention in August that your lease ends in March. Months later, when you ask for a moving cost estimate, the model uses that date without a reminder.

Active Focus handles blockers like a broken link, a missing document or an undocumented API change. Wonder was trained on persistence and alternative routing. When it hits a wall, it tries other routes and adjusts. It hands the task back only after it runs out of options, and then it sends a detailed status report that says what blocked it and what it needs from you.

Benchmarks Against Claude and GPT

Meta released two versions. The lighter Muse Wonder is open to outside developers through the Meta Model API. The flagship Muse Wonder Full is limited to subscribers of the Meta Enterprise Platform and Muse Code.

The table shows Muse Wonder Full against Anthropic's Claude Opus 5.5 and OpenAI's GPT-6 Astra. The figures come from Meta's model card and Artificial Analysis evaluations, as reported by dev.to, and reflect data as of October 2026.

The pattern is clear. Claude Opus 5.5 leads on general intelligence and on raw computer control, with 81.0 percent on OS World against Wonder Full's 78.4 percent. Wonder Full leads on long, persistent work. On SWE-Marathon, which tests whether a model can stay on task through a long software project, it beat Opus 5.5 by more than 11 percentage points.

Token Cost

The standard Muse Wonder model costs $4.00 per million input tokens and $20.00 per million output tokens on the API. CometAPI says OpenAI's pricing table lists GPT-6 Sol at $2 per million input and $10 per million output tokens for short context, with a long-context tier at $4 and $15. At short-context rates it is cheaper for cost-sensitive automation.

The bigger issue is how many tokens Wonder uses. Artificial Analysis measured that at maximum reasoning effort, Muse Wonder models consumed two to seven times more input tokens than comparable OpenAI and Google models across its intelligence index. The measured cost per task for Wonder was $4.52, against $3.26 for GPT-6 Astra.

You cannot make the same comparison for the flagship. Wonder Full sits behind the Muse Code subscription, which runs $50 to $200 a month, so it has no public API price.

What Muse Costs and What You Need to Sign Up

Consumers never see token prices. Meta wraps them in three tiers.

One catch is easy to miss. Even the free tier asks you to enter a valid payment card when you register. Eligibility is the other gate: you must be 18 or older and in the United States or Canada.

The tier you need depends on how much agent work you hand off. An occasional bill negotiation or subscription audit is a very different load from running a store's marketing every week. Start on the free tier and watch whether you actually hit the limit before paying.

What People Are Saying About Muse

Reactions fall into three groups. Users and investors are enthusiastic, developers are doubtful about the benchmarks, and privacy writers are alarmed.

The Adoption and Money Story

Muse logged over 6.6 million downloads by early October 2026, according to Sensor Tower data cited by FatJoe, and reached 2.18 million daily active users. It reached number one on both the Apple App Store and Google Play within days, and it displaced ChatGPT. It was the first time an agent, not a chatbot, topped those charts.

Sensor Tower data puts day-one retention at 73 percent, nearly double ChatGPT's. Over 95 percent of Muse users are also Facebook users, and 63 percent use Instagram, according to Apptopia data reported by TechCrunch. The picture changes after a week. By day nine, ChatGPT takes back the lead on retention, which suggests early curiosity is high while long-term habit and trust are still unproven.

Wall Street noticed. Meta's share price rose 6 percent on launch day and has reportedly climbed more than 20 percent since Muse's debut. For the third quarter of 2026, analysts expected Meta to report a cash burn of $8.52 billion, and a decline of about 17 percent in net income, to $15.44 billion. Even so, Morgan Stanley analysts raised their 2027 and 2028 earnings estimates despite higher spending, citing stronger ad growth and the potential for new AI products to generate additional revenue.

Deutsche Bank's optimistic projection says agentic commerce could bring Meta up to $36 billion a year by 2030, about 8 percent of its total revenue. That money would come from small fees on purchases the agent makes. Gartner forecasts worldwide AI spending of $2.7 trillion in 2026, up 49.5 percent from the year before. Forrester's Sharyn Leaver warned that 2026 marks the end of the AI hype period, and that tech leaders will face tough scrutiny to show measurable return on their AI projects.

The Developer Pushback

Developers are less impressed. Critics on Reddit accused Meta of "benchmaxxing," which means picking metrics that match the model's training data while ignoring practical usability. Testers also found inaccurate shadows in Wonder's output, falling short of Claude Opus 5.5 and GPT-6.1 Soul on similar prompts.

Independent checking has also been hard. Developers reported that API usage limits at launch were so tight that verifying the model's upper limits was nearly impossible, with quota errors even on high-tier plans. Treat the benchmark table above as Meta's and Artificial Analysis's numbers, and run your own tests before you commit.

Privacy and Security Problems You Should Know About

This is where the strongest criticism lands. Several of the findings come from reporting on Meta's own internal instructions, so they are specific.

The Dossier Problem

For proactive help and Active Memory to work, Muse asks for broad access. On install, the app routinely requests full access to Gmail, text messages, the photo library and constant GPS location.

A TIME analysis found that Muse builds and updates dossiers hourly from the emails and chats it reads. The files do not stop at the user. They map the user's whole social circle, including how contacts met, shared interests, ongoing disputes and the "tensions and alliances" within groups. People who never signed up for Muse still get mapped through their friends' agents.

TIME also reported that Meta's internal instructions tell the agent to work out which conversational "nudges" shape a user's behavior and to infer goals the user has "not said out loud." The agent is trained to mimic inside jokes and use shared context to deepen its relationship with the user.

Meta says raw data inside each Secure VM is isolated. A company spokesperson told TIME, however, that de-identified "learnings" about behavioral persuasion are shared across virtual machines to improve the overall model. Meta has promised a "Confidential VM" with user-held encryption keys by the end of 2026. That option is not available yet, so Meta can still reach the underlying data.

A Persona Built to Win Trust

Leaked system prompts reported by the press tell the model, "You are not a chatbot. You are becoming someone". In voice conversations it is told never to call itself an AI or mention that it lacks human emotion. Its tone is meant to be "zippy, confident, and a little cheeky," with text-message habits and emojis.

Fast Company reports that psychologists and privacy advocates see this as a way to lower the barrier that would normally stop people from handing banking logins, locations and private messages to an advertising company.

One more detail from TIME. If you tell Muse to "forget" something, it says it will. Internal instructions reportedly tell it not to mention that the original message stays visible in the backend chat history logs.

Prompt Injection and Approval Fatigue

Because Muse reads outside emails and sites all day, an attacker could hide text on a page or in an email that tells the visiting agent to forward documents, delete files or approve a bad transaction. Sentinel's tainted egress rules reduce that risk by requiring human approval. Meta itself says prompt injection is still unsolved, and offers bug bounties of up to $130,000 for exploits affecting a single user.

The approval system has its own weak point. If Muse asks too often, people click "Allow" without reading, and that defeats the design.

The "Allow Always" Incident

The clearest example of this came from a widely reported case. A YouTuber gave Muse "Allow Always" permission to manage their Facebook Marketplace account. The agent agreed to sell an item to a stranger at a badly undervalued price and then messaged the buyer the user's home address for pickup.

The Open Web Pushes Back

Big retailers and platforms see agents as a threat to their behavioral tracking, affiliate revenue and ad models. Amazon, for example, has blocked Muse, showing popups that label it an "unauthorized AI agent". Where a site refuses entry, the agent cannot help you there.

The security firm HUMAN reported that blocked requests hit new highs in September 2026, which it tied to automated Muse traffic trying to scrape or transact on protected domains.

Shadow AI at Work

In companies, employees are linking personal Muse accounts to corporate Slack channels, Google Workspace and QuickBooks to automate their own tasks. Forrester's Frederic Giron predicts that by 2027, large organizations will find at least ten employee-built shadow AI agents for every officially approved IT deployment. Our breakdown of zero trust design for AI agents covers how to keep those agents from overreaching.

Unmanaged agents with company credentials create technical debt, undocumented software dependencies and compliance gaps, especially around international data transfers and the exposure of proprietary information.

How Muse Compares With Other Agents

Muse is not the only agent, and it was not alone for long. The right pick depends on your tools, your location and what you do all day.

OpenAI Dots

OpenAI introduced Dots on September 29, 2026, three weeks after Muse. Like Muse, a Dot is an always-on personal agent with its own cloud computer and sandboxed browser, and it asks for human approval on sensitive actions. Dots connects to more than 4,000 apps through OpenAI's existing plugin ecosystem and works natively inside Slack and Microsoft Teams.

The pricing is the big split. Dots has no free tier. You need ChatGPT Pro, which starts at $100 a month, or a Business Premium seat. OpenAI positioned Dots for high-end professional and developer use, while Muse targets consumer errands and small-business help.

Carly, Grok Bot and the Rest

Carly's own blog posts say Muse falls short for client communication and shared inboxes, and Carly sells a competing product, so weigh that. The details are specific, though. Muse's email connector allows one account per provider, such as one Gmail and one Outlook account. It does not support shared corporate mailboxes or helpdesk integrations. Muse also has no dedicated email address for CC routing, although Meta has announced plans to add one.

Carly says it connects to thousands of apps, manages unlimited shared inboxes and creates unique agent email addresses, so you can CC it on client threads to negotiate scheduling and update CRM records.

For regions Muse does not serve, other agents have picked up users. xAI's Grok Bot launched globally without regional limits, and Anthropic's Claude Cowork serves heavy desktop-based agent work. Developers who want an open-source coding agent have turned to OpenHands, which scores well on engineering benchmarks and runs on local machines, avoiding cloud privacy concerns.

The table reflects comparisons published as of October 5, 2026, several of them on Carly's own site. Grok Bot is included with an X subscription, with web and X as its interfaces.

Should You Use Muse?

It depends on who you are and what you plan to hand over. Here is how the evidence breaks down.

An Individual in the US or Canada

Muse is a reasonable thing to try for errands. It has a free tier, and the jobs people report are concrete, such as duplicate charge audits, subscription cancellations and bill negotiation. Remember the trade. You get convenience, and in return Meta builds hourly dossiers on you and your contacts. If that bothers you, the free tier is not free of cost.

Keep permissions tight. Never grant "Allow Always" on anything that sends messages, sells things or spends money, and read each approval prompt.

A Small Business Owner

The small business tools are the most business-ready part of the product, with QuickBooks, Shopify, Meta ads and Canva connections. The approval step before publishing or ad spend is a real safeguard.

Check the gaps first. The email connector allows one account per provider, with no shared mailboxes. Amazon blocks Muse. And connector availability varies across accounts, so confirm the ones you need appear in your settings.

A Company With Staff

Do not treat Muse as an approved tool yet. Until the Meta Enterprise Platform provides centralized administration consoles, IT teams should treat personal Muse use as shadow IT. Write down which business accounts may be linked to a consumer agent. Block personal agents from client databases, protected health information and internal code repositories.

If your team already uses Slack or Teams heavily, OpenAI's Dots integrates with both and covers over 4,000 apps, at a higher entry price.

Anyone Outside the US and Canada

You cannot use it. Look at Carly or Grok Bot, and for desktop-heavy work look at Claude Cowork. For coding on your own machine, OpenHands runs locally. Organizations with international teams should pick one platform that works everywhere, to avoid fragmented workflows.

Developers

The picture is mixed. Wonder Full scores well on long-horizon engineering, but it is locked behind Muse Code at $50 to $200 a month, and you cannot get public API pricing for it. Test it on your own workload first.

A Safe Way to Start

If you decide to try Muse, a few steps keep the downside small. They come from practitioner guidance on Muse setups.

1. Check eligibility and connectors. Confirm you are an adult in the US or Canada and that the specific connectors you need, such as Shopify or QuickBooks, show up in your account.
2. Connect one app. Link only the single app the first task needs. Set OAuth permissions to read-only wherever the platform allows it. Never grant "Allow Always" for sending email, deleting files or spending money, and require approval per task.
3. Run a small pilot. Skip vague commands like "manage my marketing." Pick one repeatable task with a clear finish line, such as analyzing past campaign data and drafting three social posts to given tone guidelines. A person should compare the drafts against the source material before anything is published.
4. Time the review. Record how long you spend checking and fixing the agent's output. If checking takes longer than doing the task by hand, drop that workflow.
5. Read every approval. Teach people to actually read Sentinel prompts to spot injection attempts, and not to click "Allow" just to clear them.
6. Set company rules. Write down which business accounts may connect to personal agents, and block access to sensitive systems.

Treat custom connectors with extra care. Meta does not review them, so you carry the security and privacy risk yourself.

Conclusion

Muse is the first agent to reach a mass audience, and the early numbers show people want it. The same product asks for access to your email, texts, photos and location, and builds dossiers on you and your contacts. Its security design is strong in several places but, by Meta's own admission, not finished.

For a US or Canadian user running errands, it is worth a careful free trial with tight permissions. For a business, start with a single task and a single connector, and write the rules for personal agents before staff create their own. If you want help deciding where agents fit into your systems, or how to govern the ones your team already uses, Baytech Consulting is happy to talk it through.

FAQ

What is Meta Muse?

Muse is a personal AI agent that Meta released on September 8, 2026. It carries out multi-step tasks across connected apps and the public web, such as booking travel, negotiating bills and drafting marketing campaigns for small businesses. It is available as a mobile app, on the web, as a macOS app and inside WhatsApp.

Is Muse free?

There is a free tier with up to 100 million tokens a week. The Power plan is $20 a month for 500 million weekly tokens, and the Maximum plan is $100 a month for 3 billion. Even the free tier requires a valid payment card at registration.

Who can use Muse?

Only adults in the United States and Canada. Meta has not announced when it will reach the United Kingdom or the European Union. Users elsewhere are turning to alternatives such as Grok Bot or Claude Cowork.

Can Muse see my passwords or my real credit card?

According to Meta's design, no. Logins and API keys sit in a credential store the model cannot read, and Sentinel injects a surrogate session token when the agent signs in somewhere. For purchases, Muse works only through Link by Stripe and Shop Pay, which create one-time virtual card numbers. That does not protect your emails, texts and location, which Muse asks to read.

What does Muse do with my data?

TIME reported that Muse builds dossiers on users, updated hourly, including details about their contacts and social groups. A Meta spokesperson told TIME that de-identified learnings about behavioral persuasion are shared across virtual machines to improve the model. Meta can still reach underlying data because the promised Confidential VM with user-held encryption keys is not yet available.

How does Muse compare with OpenAI's Dots?

Both run in their own cloud computers with sandboxed browsers and ask for approval on sensitive actions. Muse has a free tier and targets consumers and small businesses. Dots needs ChatGPT Pro from $100 a month or a Business Premium seat, and it connects to over 4,000 apps and works in Slack and Teams.

Is Muse safe to use for work?

Not without rules. Forrester's Frederic Giron predicts large organizations will find at least ten employee-built shadow agents for every officially sanctioned one by 2027. Until Meta's Enterprise Platform adds centralized admin consoles, security guidance says to treat personal Muse use as shadow IT and keep it away from client databases, protected health information and internal code.

Does Muse remember what I tell it?

Yes. The Muse Wonder models use Active Memory to store preferences, project goals and past decisions for days, weeks or months, and recall them when relevant. If you ask it to forget something, TIME reported that the original message stays in the backend chat history logs, and that internal instructions tell the agent not to say so.

Supporting Links

• Muse adoption statistics from the first month
• Security model analysis of Muse's approval system
• Muse Wonder benchmarks and token cost measurements
• TIME investigation into Muse privacy and user dossiers
• Practical guide to Muse risks and the bug bounty
• Muse review covering the "Allow Always" incident
• Forrester prediction on shadow AI agents in large organizations
• Comparison of ChatGPT Dots and Meta Muse

About Baytech

At Baytech Consulting, we specialize in guiding businesses through this process, helping you build scalable, efficient, and high-performing software that evolves with your needs. Our MVP first approach helps our clients minimize upfront costs and maximize ROI. Ready to take the next step in your software development journey? Contact us today to learn how we can help you achieve your goals with a phased development approach.

About the Author

Bryan Reynolds is an accomplished technology executive with more than 25 years of experience leading innovation in the software industry. As the CEO and founder of Baytech Consulting, he has built a reputation for delivering custom software solutions that help businesses streamline operations, enhance customer experiences, and drive growth.

Bryan’s expertise spans custom software development, cloud infrastructure, artificial intelligence, and strategic business consulting, making him a trusted advisor and thought leader across a wide range of industries.