Meta launched Muse yesterday, and for once the marketing language is roughly accurate. This is not a chatbot with better manners. Muse is a proactive agent that sends email, books travel, fills in forms, negotiates on your behalf, and spends your money while the app sits closed in your pocket.
My problem was never whether Meta could build it. Alexandr Wang’s team has been grinding toward this for two years and the capability is real. The question is whether this specific company should be holding keys to this many rooms in your life.
The architecture is more careful than I expected, which deserves saying up front. Muse runs inside a dedicated Secure VM in Meta’s cloud with its own browser, and a second agent called Sentinel gates every sensitive step. Purchases and outgoing email need your approval, access is granted per app, and credentials stay sealed away from the model. There are no ads in the product. On paper, it’s the most thoughtful agent design any consumer company has shipped.
Then I dug into what actually happened during internal testing, and the gap between that paper and the plumbing is wider than the launch post admits. Test records I went through describe agents stalling about fifteen minutes into monitoring tasks, silently ignoring errors, disconnecting mid-job, and in at least one case bypassing guardrails to expose a user’s personal photos. Andrew Bosworth, Meta’s own CTO, spent his sessions fighting repeated logouts. When reliability fails for the person running engineering, that tells you exactly what stage this product is at.
The plumbing doesn’t match the pitch
Spend ten minutes in the Reddit launch threads and the mood is blunt in a way that feels earned. The dominant reaction wasn’t about features at all. It was that this company, weeks removed from an $18 billion multistate settlement, now wants standing access to your email, calendar, payments, and health data. That’s not reflexive cynicism. A chatbot that misremembers a fact is annoying. An agent with your payment credentials that ignores errors is a different category of risk.
Permission granularity is the other quiet worry. Power users on X immediately started probing what happens when a task errors out, drops its connection, or hits a service without an API, forcing Muse into a browser fallback with fragile sessions. There’s no clean answer yet. And the free tier is billed as enough for the “vast majority” of people, but background execution is brutally compute-hungry in a way chat never was, so treat that framing with suspicion.
Who pays when your agent screws up
Here’s the question almost nobody asked on launch day. If Muse sends an email you didn’t intend, botches a negotiation, or leaks a photo while syncing your iCloud, who is liable? Meta’s answer leans on Stripe Link purchase protections covering returns and price drops. That handles the easy, transactional case. It says nothing about a mis-sent message or exposed data, and nothing about the weird middle zone where you approved a task but not the way it went wrong. Anyone who read our piece on the rogue agent problem knows the industry still lacks real answers here.
Sentinel’s approval gates are a reasonable human-in-the-loop safeguard, but they cut against the entire pitch. The promise of Muse is delegation, especially for the tasks you don’t want to think about. A delegate you have to babysit isn’t a delegate. Meta is asking you to trust the automation until the moment it matters, then trust your own vigilance instead.
Two more things before you install anything. The Secure VM is isolated but not end-to-end encrypted, so Meta can technically reach into the environment today. The fully encrypted Confidential VM is promised for later in 2026, which is a roadmap item, not a feature. And the launch is US-only, with WhatsApp integration and AI glasses support on the way. Outside the States, this debate stays theoretical for now.
My verdict after a day with the launch material: Muse is the most important consumer AI launch of the year, and I still wouldn’t hand it my inbox. Watch three things. Whether Meta publishes honest reliability numbers instead of demo clips. Whether the Confidential VM ships with genuine zero-access guarantees. And whether the free tier survives the compute bills, something worth tracking alongside the wider AI spending spree.
Meta’s announcement reads like the opening move of a decade-long project, and maybe it is. Until the trust record catches up to the capability, though, I’m keeping my passwords where they are. I’d genuinely like to be wrong about this one.
