Meta has shifted from passive chatbots to proactive agents with the launch of Muse, a personal AI that executes tasks like booking travel or negotiating bills. Unlike standard assistants that wait for prompts, Muse operates asynchronously. It keeps working in the background after you close the app, only returning when it needs your approval for sensitive actions. This rollout is currently limited to the US on iOS, Android, and web, offering both free and paid tiers. The move signals a clear industry pivot: users want results, not just conversation.
The technical backbone relies on Muse Spark 1.3, a model optimized for long-horizon tasks. Meta engineers report this version uses 20% fewer tool calls and 25% fewer tokens than its predecessor while maintaining state-of-the-art resistance to prompt injection. It handles messy sources and self-corrects across multiple workflow threads. While consumers get the finished agent, developers can access the underlying model via the Meta Model API today. Open weights are promised for the future, but self-hosting the full Muse agent is not an option.
Security architecture is where this launch gets interesting. Each user receives a dedicated cloud virtual machine, the Muse Secure VM, isolating the agent, browser, and credentials. A separate “Sentinel” agent acts as a gatekeeper, approving every network request and connector action. Crucially, the main agent never sees real passwords. It works with placeholder tokens, and the Sentinel injects actual secrets only at the network boundary. This design makes credential exfiltration via prompt injection structurally impossible because there is nothing real for the agent to steal.
This surrogation approach solves a major headache in agentic AI: trust. By filtering out one-time passcodes and restricting the browser sub-agent to an accessibility tree rather than raw DOM execution, Meta reduces the attack surface significantly. It is a heavy infrastructure lift for a consumer product, but it sets a new baseline for safety. If competitors want to match this level of autonomous action, they will need to match this level of isolation. The question now is whether users will tolerate the latency of these security checks for everyday convenience.
