Summary: Meta is launching Muse as a personal AI agent that can send emails, book travel and act through connected apps. The more notable change is the infrastructure behind the chat: each Muse runs in its own cloud VM with a browser, while a separate Sentinel system checks outbound actions. Meta is treating the agent more like a privileged computer than a conventional assistant.
Muse initially launches in the US through a dedicated app and WhatsApp. Users choose which services the agent may connect to. Meta says data and credentials for those services are stored inside the dedicated “Muse Secure VM”. A separate Sentinel component is isolated from the agent at the system level; outbound internet actions are checked before execution and sensitive steps can require user confirmation.
The security architecture reveals the real shift
Meta's technical companion post says Muse can do more than invoke tools: it can run long tasks, launch subagents, build its own tools and modify them. That freedom expands the attack surface. An agent consumes webpages, emails and other content that may contain malicious instructions while simultaneously holding access to real accounts.
Meta therefore says it trained Muse specifically for prompt-injection awareness, tool use, long-trajectory instruction following and multi-agent coordination. Reuters reports that internal testing before launch uncovered security and reliability problems. Meta itself says a large share of the engineering effort went into safety and security controls.
Pandorex Analysis
The important development is the separation between the AI that reasons and the layer that controls execution. Once an agent can operate email, calendars, payments or browser sessions, a model-level safety filter is no longer enough. Isolation, permissions, confirmations and an independent policy-enforcement component become part of the AI platform itself.
Meta also says a “Muse Confidential VM” is planned later in 2026, with a key held only by the user. That would extend the security model from isolating users' agents from one another to limiting the infrastructure provider's own ability to access some agent data in plaintext. How well those promises hold up in real-world use still needs independent evidence.