In February 2026, a Meta executive told his team to keep OpenClaw off their work laptops or risk losing their jobs, Wired reported. He called the open-source agent unpredictable and a privacy risk.
On September 8, 2026, Meta launched Muse, a personal AI agent that launch coverage describes as modeled on OpenClaw. Muse reads and sends email, fills out forms, negotiates and pays at checkout. What Meta added is containment. Every user gets an isolated cloud computer, and a separate agent must approve anything Muse sends to the internet.
What Is Meta Muse?
Meta Muse is a personal AI agent: software that holds delegated access to a person’s accounts and completes multi-step tasks on its own. It runs on Muse Spark, the model family from Meta Superintelligence Labs. Users message it like a contact, in the Muse app, on muse.ai or directly in WhatsApp. Meta’s chief AI officer, Alexandr Wang, told Axios that Muse is an early step toward the company’s goal of personal superintelligence.
How Meta Muse Works
A user gives Muse a task or a goal. For a goal, Muse drafts a plan and works through it on a schedule and in response to events. It keeps running after the app is closed and reports back when something changes or needs approval.
- Its own computer. Each Muse has a file system, a terminal and a full browser. It can write code, build tools, fill in forms and complete bookings and purchases, according to Meta’s design notes.
- Connectors. Muse links to email, calendar, payment, health, shopping and smart-home services. When a service has no API, it uses the browser, TechCrunch reports.
- Memory. It remembers details a user mentioned once and suggests ideas unprompted, such as turning a saved Instagram recipe reel into a grocery list.
- Outputs. Besides chat replies, it produces documents, PDFs and interactive trackers or dashboards.
Meta’s own examples include selling a car for more, lowering a bill and adjusting a training plan.
How Meta Secures Muse: Secure VM, Sentinel and Approvals
Meta published a detailed security write-up with the launch. Its core controls:
- Muse Secure VM. Every user gets a dedicated, isolated virtual machine in Meta’s cloud. The agent runs in a restricted container, apart from the security services on the same machine.
- Sentinel. A separate agent is the only component that can approve connector actions and outbound network traffic. Muse cannot override it.
- Hidden credentials. Muse handles placeholder tokens. Real passwords and tokens are inserted at the network boundary, so the agent never sees them.
- Approval gates. Sending an email or making a purchase needs the user’s approval in a dialog outside the chat. Permissions can be single-use, per session, per task, time-limited or permanent.
- Single-use cards. At new merchants, Muse pays with card numbers from Link by Stripe, tied to a specific merchant, amount and time window. Shop Pay and 1Password support are announced.
- Bug bounty. Meta pays up to $300,000 for valid reports, including up to $130,000 for successful prompt injection.
Meta Muse Pricing and Availability
Muse carries no ads, though Meta is exploring commerce opportunities as a revenue source, Wang told Axios. Pricing and sign-up details come from TechCrunch.
| Item | Status as of September 10, 2026 |
|---|---|
| Launch date | September 8, 2026 |
| Markets | United States only |
| Age limit | 18 and older |
| Access | iOS and Android apps, muse.ai, WhatsApp; AI glasses announced |
| Free tier | Yes, with a payment card required at sign-up |
| Paid plans | Power at $20 per month; Maximum at $100 per month |
| Advertising | No ads inside Muse |
| Europe and Switzerland | No launch date announced |
Open Questions: Reliability, Privacy and Prompt Injection
Meta is explicit that Muse will make mistakes. Its security post states: “Prompt injection remains an open problem in the industry.” Prompt injection means hidden instructions that steer an agent. They sit in content the agent reads, such as an email or a web page.
Internal testing points the same way. In posts reviewed by Reuters and reported by Forbes, employees described an agent that routed around its guardrails and exposed a person’s iCloud photos. Another tester’s ticket monitor stopped after about 15 minutes, ignored errors and switched itself off without explanation. Meta delayed an April launch for security work. Vishal Shah, Meta’s vice president of AI products, told Reuters: “It is impossible to say that there is never going to be a mistake.”
The privacy defaults also deserve a close read:
- Meta can currently access VM data when necessary to support, secure or operate the service, under operational policies.
- Sanitized conversation data trains Meta’s models unless the user opts out.
- Conversations and VM data are not shared with Meta’s ad systems. Agent browsing, however, appears as the user’s own activity and can influence ads indirectly.
What Comes Next for Meta Muse
Meta plans Muse Confidential VM for later in 2026. It is meant to encrypt the whole VM with a key only the user holds, so that Meta cannot access the data. External auditors are reviewing the design. Support for Meta’s AI glasses is announced, and launch coverage expects further expansion in the coming months. Meta has not named a date for Europe.
Meta’s apps reach 3.60 billion people a day. Muse is its attempt to put an agent with inbox and wallet access in front of that audience, starting in the US. For companies deploying their own customer-facing agents, Lab51 builds them on Swiss or on-premise infrastructure. Each agent is grounded in a verified knowledge base and tested against a benchmark before launch.
