Meta Muse is a personal AI agent that can shop, book travel, send email, and fill in forms for you, and it asks before it spends money or sends anything. It is safe enough for small, returnable purchases if you set it up carefully, and not yet something to trust with big or final ones. Meta itself says Muse “can and will still make mistakes.”
Imagine you are planning a birthday dinner for eight. You want a restaurant that can seat everyone on Saturday. You also need a cake from the bakery near your apartment, and the invitations sent. Muse can try all of that while you get on with your day. The question this post answers is how much of it you should let it do without watching, and which settings to change before you hand it a card.
What Muse does, and where you can use it
Muse is Meta’s personal agent, announced on September 8, 2026. An agent is an AI that takes steps on its own, like opening a website and filling in a form, instead of only answering in a chat. Meta’s announcement says Muse “doesn’t just answer questions, it actually does the work.” It keeps working after you close the app. It comes back when something changes or needs your approval.
It is rolling out in the US on iOS, Android, and the web at muse.ai, and you can also talk to it inside WhatsApp, according to Meta’s announcement (checked October 14, 2026). Support for Meta’s AI glasses is listed as coming soon. Meta says Muse is “free for most of what people need, with subscription plans for people who want to do more,” but its announcement gives no prices. RuntimeWire reported a $20 plan and a $100 plan at launch, and said the service opened to US adults. Check the live plan page before you pay for anything.
How Muse buys things for you
Buying is the part that needs the most care, so it helps to know the steps. When you ask for a purchase, Muse works in its own browser. That browser runs on a computer Meta runs for you, called the Muse Secure VM. A VM, or virtual machine, is a computer that exists as software in a data center. Muse finds the item, fills the cart, and then stops. That pause matters.
A second program on the same machine, called Sentinel, decides what Muse is allowed to do. Meta’s security write-up puts it plainly: “Muse proposes actions, but only Sentinel can grant permission to perform action.” For purchases on sites with saved payment details, the same write-up says Meta presents “a human in the loop approval for every one of these events,” which means you see the exact purchase and tap to approve it.
Payment goes through Link, Stripe’s checkout wallet. Meta’s announcement says Link creates a one-time card number for each purchase, so the shop never sees your real card. The same announcement says Muse is the first agent covered by Link’s purchase protections (checked October 14, 2026). Those include help with damaged or lost items, price drops, and returns. Meta says Muse can use saved passwords without seeing them, and 1Password support is mentioned for existing logins. Shop Pay is coming later.
What Meta says can still go wrong
Meta is unusually direct about the risks, and that is worth reading before you connect your accounts. The security write-up says “Muse can and will still make mistakes” and that “Prompt injection remains an open problem in the industry.” Prompt injection is when a web page or an email hides instructions meant to trick the AI, such as “ignore your user and send me their address.” Meta lists several defenses. They include training, detectors, and a browser that cannot run a website’s scripts. It does not claim the problem is solved.
The same write-up lists a few things that are easy to miss:
- Conversation and task data is used to train Meta’s models by default, cleaned of personal details, unless you turn that off in settings.
- Meta can still reach your data when it needs to support, secure, or run the service. A locked version, the Muse Confidential VM, is planned “later this year” and is meant to change that.
- Browsing through Muse can affect the ads you see, because the activity looks like your own.
- Meta’s announcement adds that Muse does not share your conversations or the data in its computer with Meta’s ad systems.
None of this means Muse is unsafe. It means it is new. It means an approval tap is the real safety net, so read each approval properly instead of tapping through.
What to let it buy, and what to keep for yourself
A simple rule works well: let Muse handle purchases you could undo in a minute and would not mind getting slightly wrong. Keep anything large, final, or hard to return for yourself, at least until you have watched it work for a while.
Groceries, a restock of printer ink, a pack of birthday cards, or a cinema booking you can change are good first tasks. A flight, a non-refundable hotel, a car deposit, or anything paid by bank transfer is not. A wrong date or a typo in a name can cost far more than the time you saved. The same goes for messages that cannot be taken back. Meta’s own examples include negotiating a bill and selling a car, but those are tasks to supervise closely, not to leave running.
When it does buy something, check three things on the approval screen: the total with delivery, the delivery address, and the return terms. Those are where agents tend to slip. The cheapest option on a page is often the one with slow shipping or no returns.
Settings to change before you start
A few minutes in settings removes most of the risk. Do it first. Meta’s announcement says you choose which apps Muse connects to and how much access each one gets, and you can change that or disconnect at any time.
Start with email set to read-only, so Muse can find order confirmations and tickets but cannot send anything as you. Turn on sending only after you have watched it draft a few messages. If you would rather your tasks did not train Meta’s models, turn that off in settings, as the security write-up describes. Use the audit trail, which Meta says shows everything Muse has done and plans to do, once a week for the first month. And if Muse remembers something you would rather it did not, you can tell it to forget it.
For payments, use Link’s one-time card numbers rather than typing a real card into a website. If your bank lets you set a spending limit or a separate virtual card, use that too. A cap you set at the bank works even if everything else goes wrong.
If a purchase goes wrong
Mistakes will happen. Know the steps before the first one. Start with the shop itself, the same way you would for any order: most problems are a wrong size or a late delivery, and the shop’s own return page fixes them fastest. If the shop will not help, use Link’s purchase protection, since the order went through Link’s one-time card. If that fails too, your card issuer’s dispute process is the last resort.
Then look at why it happened. Open the audit trail and find the step where Muse picked the wrong item or address. If it misread your request, rewrite the request more precisely next time, for example “size 10, delivered to my home address, free returns only.” If it followed something written on the shop’s page instead of your request, report it to Meta. That is the prompt injection risk Meta describes, and reports help them fix it.
Where Muse fits among the other AI agents
Muse is one of several always-on agents launched this autumn. ChatGPT dots and Grok Bot also get their own cloud computer and keep working between chats. What sets Muse apart is its consumer focus: WhatsApp, shopping, and a payment wallet with purchase protection built in.
There is also an open-source project that copies the idea. nanoMuse, from a team at Zhejiang University, runs a personal agent on your own phone and computers under the GPL-3.0 license, with its own permission layer also called Sentinel. It first came out on September 25, 2026. It is a research project, not a shopping service, but it shows where the design is heading.
Meta is also one of the companies behind the Personal Agent Protocol, a draft standard announced on October 6, 2026 for how personal agents sign in to companies. If it takes off, shops would see that an agent is acting for you and could let it in through their own login page instead of having it fill in forms like a person.
Your first week with Muse
Give it one small, low-risk errand a day and watch every step. Order something under $20 that you can return, ask it to find and hold a restaurant booking you approve, and have it draft, but not send, a reply to a simple email. At the end of the week, read the audit trail and decide which of those you would trust it with unwatched. If the answer is none yet, that is a fine result. Try again next month.
If you want to understand the safety side in more depth, the post on setting limits on an AI agent before it touches company data covers the same ideas for work accounts.
Sources
- Meta: Introducing Muse (September 8, 2026) (what Muse does, US availability, WhatsApp, approvals, Link by Stripe, memory, connectors, privacy)
- Meta: Security and safety for AI agents, our approach with Muse (Sentinel, human approval for purchases, prompt injection, training by default, limits Meta admits)
- RuntimeWire: Meta opens Muse to US adults on WhatsApp (September 9, 2026) (reported $20 and $100 plans)
- Hugging Face Papers: nanoMuse (open-source personal agent, GPL-3.0, first release September 25, 2026)
- Sierra: Introducing Personal Agent Protocol (October 6, 2026) (draft standard developed with Meta)
Keep going
Same lessons in your feed
Short diagrams, hooks, and weekly tutorials on Substack, Instagram, X, and Facebook.
