Meta Introduces Muse, a Personal AI Agent That Runs on Its Own Dedicated Secure Cloud Computer

Meta has rolled out Muse, a personal AI agent that can take action on a user’s behalf instead of stopping at an answer. It can send emails, book travel, negotiate bills, and keep pushing toward longer-term goals. The service is going live now in the US on iOS, Android, and muse.ai, with both free and paid plans.

The sharper story is how Meta is building it. Every user gets a dedicated cloud virtual machine called Muse Secure VM, and that machine holds the agent, its browser, and the user’s credentials in isolation. Muse itself is a consumer product, so developers can’t host it themselves. But Meta is opening the model side: Muse Spark 1.3 is available through the Meta Model API and Muse Code, with an open-weights release on Meta’s roadmap.

Muse is built around a messaging flow. A person describes a task or goal, and the agent plans, opens a browser, fills forms, and works through the job. Meta says it can remember context across conversations too, so a saved Instagram recipe reel can become a grocery list, and friend dietary restrictions can carry over into later chats. Sensitive steps still stop for approval, including sending email and finishing a purchase, and the system keeps a full audit trail.

Under the hood, the security setup is doing a lot of the heavy lifting. The agent runs inside a systemd-nspawn runtime cell with filtered syscalls and limited kernel capabilities, while a separate Sentinel agent approves every connector action and every network request. Credentials are never shown in full to the agent; Sentinel swaps in the real secrets at the network boundary. Meta also says eBPF taint tracking helps separate clean requests from ones that touched user data, and the browser agent only sees an accessibility tree, not raw DOM, while the email connector blocks one-time passcodes and password reset links by default.

The model behind all this is Muse Spark 1.3, which Meta Superintelligence Labs released last week. Meta says it is aimed at long-horizon agent work like zero-shot CLI tool calling, multi-workflow threads, and self-correction across messy sources. In internal comparisons, Meta engineers say it used about 20% fewer tool calls and 25% fewer tokens than Muse Spark 1.2, and Meta also says it is close to state of the art at resisting prompt injection.