On September 8, 2026, Meta launched Muse, a personal AI agent for the general public in the US and Canada. Within six weeks, according to Mark Zuckerberg, more than 10 million people had set one up. The most common use is shopping.
The consumer product isn’t the interesting part. The design underneath is, and Meta published it in unusual detail. It answers the question every operations leader asks before letting an agent act: how do you make sure it only does what it’s allowed to?
Where this comes from
Not a chatbot: an agent with a goal
A chatbot answers and waits. Muse takes an objective (cut my car insurance, turn a recipe into a grocery list, organize a dinner) and works on it in the background, on a schedule and in response to events, even with the app closed. It only pings you when something is genuinely new or when it needs approval.
To make that possible, every user gets their own Linux computer in Meta’s cloud, with a browser, a terminal, files and a database. People talk to it through the app, the website, WhatsApp or the Mac.
What kind of harness Muse is
The harness is everything around the model: instructions, tools, permissions, memory and checks. Muse’s is called Hatch, and it is an agent-with-its-own-computer harness. That sets it apart from a browser agent, which acts inside the user’s session, and from a coding harness, which runs in a developer’s terminal.
- Tools are command-line programs. Each connector (email, calendar, bank, store) is a terminal program guided by saved instructions called skills. If a service has no API, the agent uses the browser.
- The browser is a separate sub-agent. It reads the page’s accessibility tree, can’t run code on the page, and the user can watch and take over.
- Memory is files. What the agent learns lives in files the user can read, edit and tell it to forget.
- Long work becomes a team. The agent splits tasks across sub-agents, schedules routines and writes its own tools when it needs them.
Two sides of the same machine
Meta’s own phrase sums up the design: “two isolated security domains on one box,” not an agent with full access. The agent and its tools run in a locked-down container. Outside it sit the services that hold secrets and grant permission.
- Who acts. The agent runs isolated, with no privileges on the machine, and only talks to the rest through authenticated channels.
- Who holds the passwords. A vault on the user’s own machine hands the agent surrogate tokens only. The real password never passes through the model.
- Who authorizes. A second agent, Sentinel, is the sole permission authority. For every outside action it answers allow, deny or ask the owner, and only then swaps the surrogate for the real credential.
Rules are enforced at the tool boundary, so they don’t depend on the model remembering them.
One clever detail: the system flags any process that has read user data as “tainted.” A clean process can reach the internet within a narrow allowlist without asking; a tainted one loses that pass. That is how a malicious instruction hidden in a web page is stopped from getting the agent to send your data out.
Approval lives outside the conversation
Sending an email, buying something or anything else hard to undo opens an approval card in the app, separate from the chat. Because it’s a fixed screen rather than generated text, the agent can’t pretend you said yes. A grant can last for one action, one task, a set time or forever.
At checkout, the agent gets a single-use card locked to one merchant, one amount and one time window. Reading and sending email are separate permissions, and the connector filters out verification codes and password-reset links.
How Meta plans to make money
- Free for most people, with $20 and $100 monthly plans for heavy users.
- A fee paid by the merchant when the agent helps close a sale. To get there, Meta and Sierra proposed a standard for how personal agents deal with businesses.
- No ads in Muse, according to Meta. Conversations train the models by default, with an opt-out.
The math doesn’t work yet. Zuckerberg called Muse “very compute-intensive to run,” which is why it’s only available in the US and Canada.
What it means for your company
The takeaway isn’t to use Muse at work. It’s a consumer product, it trains on conversations by default and it isn’t enterprise-ready. The takeaway is that a safe agent has a recognizable design, and it applies to any operation: a machine per client, passwords out of the model’s reach, a separate guard that clears every action, and human approval with a button, not with free text. It’s also the kind of design that holds up under GDPR and similar rules.
- The AI Analyst maps which tasks an agent can do on its own and which need sign-off.
- The Forward Deployed Engineer builds that design into your systems: a credential vault, egress rules, approvals in a dashboard or chat app, and a log of everything.
- Training teaches the team to approve safely and to read what the agent did.
Reconciliations, onboarding, collections, purchasing and customer support are just examples. If a task repeats, it can be automated, with the same care Meta put around Muse.
Ten million people learned in six weeks what an agent that acts looks like. The question now is who will design yours with the same care.
Enjoyed this article?
Get the next one before it hits the blog.
A short email per issue with what actually matters about AI agents at work. No spam.