Meta Introduces Muse, a Personal AI Agent Running on Dedicated Secure Cloud VMs
Meta introduced Muse, a personal AI agent that runs on a dedicated secure cloud VM and handles tasks such as email, travel booking and bill negotiation.
Muse is rolling out in the United States on iOS, Android and muse.ai with a free tier and paid plans. It is built around messaging: a user describes a task or a goal, and the agent plans and executes. The agent can open its own browser, fill forms and negotiate on the user’s behalf. It keeps working after the app is closed and returns only when approval is needed. Sensitive steps, such as sending an email or completing a purchase, always pause for user approval, and a full audit trail shows everything the agent has done and plans to do.
The agent remembers context across conversations; examples cited by MarkTechPost include turning a saved Instagram recipe reel into a grocery list and recalling friends’ dietary restrictions. Each user’s agent, browser and credentials live on a dedicated cloud virtual machine called Muse Secure VM.
Meta has not allowed developers to self-host Muse, the consumer product. Its underlying model, Muse Spark 1.3, is available through Meta Model API and Muse Code at dev.meta.ai, with an open-weights release on Meta’s stated roadmap. Muse Spark 1.3 was released last week by Meta Superintelligence Labs. It targets long-horizon agent work, including zero-shot CLI tool calling, multi-workflow threads and self-correction across messy sources.
In internal comparisons cited by MarkTechPost, the model used roughly 20% fewer tool calls and 25% fewer tokens than Muse Spark 1.2. Meta said it is close to state of the art at resisting prompt injection.
The security architecture places the agent harness in a systemd-nspawn runtime cell with filtered syscalls and limited kernel capabilities. Security-critical services remain outside that cell on the same VM. A separate Sentinel agent approves every connector action and every network request at both layer 4 and layer 7. Credentials are handled through surrogation: the agent only sees placeholder tokens, and Sentinel injects real secrets at the network boundary. Kernel-level eBPF taint tracking marks whether a request has touched user data, and that distinction gates approvals accordingly. The browser subagent sees an accessibility tree instead of the raw DOM and cannot execute JavaScript. The email connector filters out one-time passcodes and password reset links by default.
Muse is available as a consumer service in its own app or directly inside WhatsApp.