Muse, Meta's new personal AI agent, never sees the user's passwords or payment details. Meta launched it in the United States on September 8. The agent connects to email, calendar, the browser, Instagram, Facebook, the car, and the smart home, and runs on Meta's Muse Spark model.
Muse can work in the background on a schedule. According to Meta, it keeps going after the app is closed and returns when something changes or when it needs approval, for example before sending an email or making a purchase.
The Batch newsletter reports that the free tier is capped at 100 million tokens a week. A $20 monthly plan gives 500 million, and a $100 plan three billion.
Two separate zones
Each agent runs in its own isolated Linux virtual machine, with its own file space and memory. Passwords and payment data live outside that machine, in external services.
Meta says nothing Muse does reaches the internet without approval from a gatekeeper it calls Sentinel. Only when a request leaves the machine does Sentinel insert the real credentials, so the agent never sees them.
Later this year, Meta plans a Muse Confidential VM, in which the whole machine is encrypted with a key only the user holds. The company says not even Meta could then access the data.
Defending against injected instructions
According to The Batch, protection against instructions planted in web pages and messages has three layers. Untrusted data is labeled, a set of classifiers looks for attacks, and the browser gives the agent the page structure instead of raw content. The email connector strips one-time codes and password reset links.
Every payment, and every purchase on an unfamiliar site, requires user confirmation. Meta has not published how accurate its classifiers are. It offers up to $300,000 for discovered flaws, including up to $130,000 for a successful injection.
