Meta's new AI agent Muse can read your email, book your flights, negotiate purchases on your behalf, and pay with your card, and it remembers what you told it the next time you ask. That's the headline. The company whose entire business runs on knowing what you want to buy has shipped a product that lives inside your inbox, your calendar, and your wallet, with memory that carries across every session instead of resetting each time.
Muse launched on September 8, 2026, with a rollout to US users beginning September 9. Meta calls it the company's first standalone personal AI agent, separate from the assistant features already built into Facebook, Instagram, and WhatsApp. It's available on iOS, Android, and a dedicated web app at muse.ai, plus WhatsApp, with support for Meta's AI glasses described as coming soon.
What Muse actually does
Muse isn't a chatbot that answers a question and forgets you five minutes later. Meta built it to take actions with real consequences: reading and acting on your email, booking travel, negotiating on your behalf, and completing purchases using your saved card. The persistent memory is what makes all of that useful instead of tedious. Rather than re-explaining your seat preference, your travel budget, or a dietary restriction every single time, Muse is designed to carry that context forward automatically, across sessions, not just within one conversation.
Meta has also laid out the pricing shape: a free tier exists, alongside paid subscriptions. As of September 2026, independently reported pricing points to tiers around $20 and $100 per month, though that figure comes from outside reporting rather than an official price list published in Meta's own announcement.
- Reads and acts on your email
- Books travel on your behalf
- Negotiates purchases for you
- Pays using your saved card
- Remembers your preferences across sessions, not just within a single chat
Email access is the biggest leap here
Chatbots answering questions from inside a browser tab is one thing. An agent that reads your actual inbox, the place where password resets, medical results, financial statements, and family plans all sit, is a different category of access entirely. Meta frames this as necessary for Muse to act on your behalf: it can't book a flight around a schedule conflict it can't see, or negotiate a refund on an order it can't find in a confirmation email. The capability is genuinely useful for that reason. It's also the single biggest expansion of what a consumer AI product gets to look at, compared to a standard chat assistant that only ever sees what you type into it.
Paying with your card raises the stakes again
Reading is one kind of access, spending is another. An agent authorized to complete purchases with a saved card needs enough context to act correctly on your behalf, which is exactly why the persistent memory and the payment capability are bundled together rather than shipped separately. That bundling is also why the approval mechanism sitting underneath it matters as much as it does: the more autonomy an agent has to interpret 'negotiate on my behalf' and then act on that interpretation with real money, the more a checkpoint before execution is doing real work rather than being a formality.
The tension Meta isn't naming
Meta's revenue is built on advertising, and advertising works better the more a platform knows about what a person wants. Muse asks for a different kind of access than a News Feed ranking algorithm ever needed: your actual email, your actual travel plans, your actual payment card, held in a system built to remember all of it indefinitely. That isn't a knock on the product doing what it was built to do. It's the plain shape of the trade a person makes the moment they turn Muse on.
Meta's answer to that trade is a set of technical and policy safeguards it has stated publicly. Those safeguards deserve to be taken seriously on their own terms, and taken apart carefully so it's clear what they cover and what they don't.
This isn't a hypothetical concern invented for the sake of a contrast. It's the same structural question every ad-funded platform launching an agentic product runs into: the business model rewards knowing more about a user, the product now requires knowing everything about a user to function, and the two incentives point in the same direction even when a company states, as Meta has, that it's holding one apart from the other with policy and infrastructure. Stated separation is not the same thing as structural separation, and it's fair to notice the difference without assuming bad faith on Meta's part.
Meta's stated safeguards: a Secure VM and an approval agent
Muse runs on what Meta calls a Muse Secure VM, a dedicated virtual machine isolated per user rather than shared infrastructure. Layered on top of that is a separate agent called Sentinel, whose job is to review and approve any internet action Muse wants to take before it happens, rather than letting Muse act on the open internet without a checkpoint.
Meta also states that conversation and VM data isn't shared with its advertising systems, and that users can opt out of having their Muse data used to train Meta's AI models. Both are meaningful, stated commitments. Neither is the same as saying the data is technically out of Meta's reach; they describe how Meta says it will use the data, not a barrier that prevents Meta itself from accessing it.
What the approval layer does and doesn't promise
An agent that has to get sign-off before taking an internet action, per Meta's own description, is a real constraint on autonomous behavior, the kind of guardrail that starts to matter once an AI agent can spend your money or send an email as you. It lowers the odds of Muse doing something you didn't intend. It says nothing about who inside Meta can see the data Muse is holding onto in order to do its job in the first place. Per-user isolation and an approval step guard against the agent going rogue. They aren't a statement about who can access the underlying VM.
It's worth separating the two kinds of protection cleanly, because they're solving different problems and get conflated easily. One kind of protection stops the agent from acting against your interests: Sentinel's approval step lives here. The other kind of protection stops a third party, including Meta's own staff or systems, from reading what the agent has stored: that's the domain of encryption and access control, and it's the piece that, per Meta's own roadmap, isn't finished yet.
The Confidential VM is a 2026 promise, not a feature you can turn on
Meta has stated that a Muse Confidential VM is planned for later in 2026. As described, it would encrypt the entire VM, including memory and conversation history, with a key held only by the user, to the point that Meta says even it would not be able to access the contents. That would be a meaningfully stronger privacy position than what Muse ships with today.
It isn't live. As of this post, in September 2026, anyone using Muse is using the current Secure VM and Sentinel setup, not the Confidential VM. That distinction matters for anyone deciding whether to hand Muse an inbox and a payment card this month: the stronger protection is a stated roadmap item, not something you can inspect or rely on today.
None of this means the current setup is unsafe by definition. A dedicated, per-user virtual machine plus a mandatory approval agent is a meaningfully different architecture than, say, a shared server processing every user's requests through common infrastructure with no isolation between accounts. It means the current setup and the promised future setup are not the same thing, and Meta's own announcement is careful enough to draw that line itself. The rest of this month's decision is simply about which side of that line you're comfortable being on.
| What Muse Does | Meta's Stated Safeguard (Sept 2026) | Live Today or Coming Later? |
|---|---|---|
| Persistent memory of preferences | Stored inside the per-user Muse Secure VM | Live today |
| Paying with your card | Action requires Sentinel approval before it executes | Live today |
| Reading and acting on email | Runs inside the isolated Secure VM | Live today |
| Training opt-out | Meta states Muse data isn't shared with ad systems; training use is opt-out | Live today |
| Full-VM encryption of memory and conversations, key held only by user | Meta calls this the Muse Confidential VM | Coming later in 2026, not yet available |
Muse fits a broader industry shift
Muse isn't arriving in isolation. Consumer AI has been moving for a while from products that answer questions to products that take actions, book things, buy things, send things, on a user's behalf. Persistent memory is what makes that shift work at all: an agent that forgets your preferences between sessions has to be re-briefed every time, which defeats the point of delegating a task in the first place. Meta building memory and action-taking into a single named product, rather than shipping them as separate features, is a sign of where the category is heading, not an outlier move.
The part that's specific to Meta, and worth keeping separate from the general trend, is the company doing the shipping. An agentic assistant from a company with no advertising business raises a narrower set of questions than the same product from a company that has spent two decades building its revenue around detailed knowledge of what people want. That's not a reason to assume the worst about Muse's data handling. It is a reason the safeguards Meta has published, the Secure VM, the Sentinel approval step, and the stated separation from ad systems, deserve more specific scrutiny than they would from a company without that history.
Where Muse works right now
At launch, Muse is US-only, available on iOS, Android, and the web at muse.ai, plus WhatsApp. AI glasses support is described by Meta as coming soon rather than available at launch. Anyone outside the US, or waiting on glasses support, doesn't get to weigh any of the privacy questions above yet, because the option isn't there.
Where your memory lives instead
The honest version of this isn't Muse bad, alternative good. It's a question about what you want your own memory, your preferences, your plans, your history with an AI system, tied to. Muse ties that memory to Meta's infrastructure, inside a company whose primary business is advertising, with a stronger encryption model promised for later in 2026 and unavailable now. MemX starts from a different position: it's built to be private by architecture from day one, not as a future upgrade, and it sits outside any advertising business entirely. That isn't a claim that MemX is end-to-end encrypted or zero-knowledge, it isn't either of those things, and it doesn't need to overstate itself to make the more basic point: your memory of your own conversations doesn't have to live inside the same company that also decides which ads you see.
That's also why the comparison here isn't about which product has the flashier feature list. Muse and a memory layer like MemX aren't solving the identical problem: one is an agent taking actions in the world on your behalf, the other is a place your context and preferences live so that whichever AI model you happen to be using can draw on it. But they intersect on exactly the question this launch raises: who holds your memory, under what business model, and on what timeline for the privacy protections that are supposed to matter most. Muse answers that question today with a Secure VM and an approval agent, and a stronger answer promised for later in 2026. The architecture question is worth asking of any product making a bid for your memory, not just this one.
If you're evaluating any AI agent that touches email, payments, or bookings, ask two separate questions: what stops the agent from acting without approval, and separately, who can access the data it remembers about you today, not in a future release.
01Is Meta Muse end-to-end encrypted?
No, not yet. As of September 2026, Muse runs on Meta's Secure VM with Sentinel approving actions. A fully encrypted Confidential VM is planned for later in 2026 but isn't live, per Meta's own announcement.
02Can Muse actually pay for things with my card?
Yes. Meta says Muse can complete purchases using your saved card, with each internet action first approved by a separate agent called Sentinel before it executes.
03Is Meta Muse free to use?
There's a free tier plus paid subscriptions. Independently reported pricing points to roughly $20 and $100 per month tiers as of September 2026; Meta hasn't published that pricing itself.
04Where is Meta Muse available at launch?
US only, on iOS, Android, and the web at muse.ai, plus WhatsApp, as of the September 8 to 9, 2026 launch. Meta describes AI glasses support as coming soon.
05Does Meta use Muse conversations for ads or AI training?
Meta states conversation and VM data isn't shared with its ad systems, and users can opt out of having Muse data used to train Meta's AI models.
Muse is a real, shipping product with real capabilities, not vaporware, and Meta has published specific, checkable claims about how it isolates and reviews what the agent does. The gap worth watching sits between what's live in September 2026 and what's promised for later this year: a Secure VM and an approval agent are here now, full encryption of the VM is not. Anyone deciding whether to hand an AI agent their email and card should weigh today's setup, not the one Meta says is coming.
