Muse Can Shop for You From a Locked Cloud Computer

Meta opened Muse to adults in the United States on September 8. The agent that keeps working after you leave can shop, send mail, book travel, and keep going after the app closes. A payment card is required even to unlock the free tier.

Muse runs on Muse Spark 1.3 inside a dedicated cloud computer Meta calls Muse Secure VM. Checkout goes through Link by Stripe. The pitch is a private butler. The design is a shopper you have to fund.

The Agent That Buys Things While You Sleep

Muse is a personal agent from Meta Superintelligence Labs, not another chat box that waits for the next prompt. You give it a goal. It opens a browser, fills forms, and comes back when it needs a yes. Staff inside Meta have been using it since early 2026, under the internal name Hatch.

Mona Sarantakos, who designed the product with Christine Awad, wrote that the first line of the system prompt is “Your purpose is to make your user’s life better.” In the week before launch she had Muse watching school emails, loading a supply cart, and catching a sports tryout buried in the inbox with twelve hours left.

THE WORK MUSE SAYS IT WILL DO

• Mail and travel: Send email, book trips, and fill forms after you approve the sensitive step.
• Money: Lower a bill, complete a purchase, or help sell a car.
• Home and health: Connect calendar, dining, shopping, music, fitness, and smart-home apps one at a time.
• Memory: Turn a saved Instagram recipe reel into a grocery list and remember a friend’s dietary limits.
• Artifacts: Build a spending tracker, a study guide, a PDF, or a live dashboard, then keep the job on a schedule.

If a service has a public API, Muse can wire a connector with the logins you hand over. If it does not, the agent uses a full browser. Tarek Sheasha, a software engineer and VP at Meta Superintelligence Labs, said the model was trained for zero-shot tool calling with command-line tools and skills, and that it can launch swarms of subagents, build tools, and edit its own code.

Stripe Hands Muse a Card It Cannot Keep

In Meta’s own safety write-up, Sheasha said using Muse to buy stuff is one of the most popular browser use cases. That is the product, not a side feature. OpenAI pulled in-chat checkout in March 2026 after shoppers browsed and did not buy. Meta is walking the other way, into WhatsApp, a dedicated app, and the open web.

Stripe said Meta plugged Link’s wallet for agents into Muse on September 8. At more than 1 million businesses that accept Link, Muse can check out with a US shopper’s saved method. For everyone else, Link issues a single-use virtual card scoped to the purchase. Jay Shah, business lead for Link at Stripe, said Stripe is building the infrastructure that lets agents buy from businesses. Link already counts over 300 million users worldwide. The same wallet also pays for xAI’s Grok Bot and for Instinct.

HOW MUSE PAYS

Meta says Muse is the first AI agent covered by Link’s purchase protections, including coverage for damaged or lost items, price drops, no-fee returns, and a return guarantee on eligible buys. Shop Pay is listed as coming soon, with 1Password support so the agent can use logins you already store. Every payment still needs a human tap. The card in the free-tier setup is how Meta knows it can bill you when the meter runs out, and how the shopper gets a rail to spend.

A Sentinel Between the Agent and the Web

Personal agents, Meta argues, need a new kind of computer. Each Muse gets its own Linux box in the company’s cloud, with a browser, storage, CPU, and memory enough to compile code and run cron jobs. Credentials for connected services live on that machine, not in a central pile. A second program, Sentinel, sits on the same box and is kept apart at the system level.

The harness runs in its own isolated cell, it doesn’t see real credentials, and every interaction with the outside world runs through a Sentinel which the agent cannot override.

Tarek Sheasha, VP, Meta Superintelligence Labs

That line is from Sheasha’s launch post on the Sentinel which the agent cannot override. Muse proposes. Sentinel allows, denies, or asks you. The ask does not go through the chat model. It lands as a dialog in the app, which is Meta’s answer to prompt injection that tries to talk the agent into a bad click.

Built-in connectors run outside the agent’s cell with tight privileges. Surrogate tokens stand in for real secrets until Sentinel swaps them in at the network edge. The email connector strips one-time passcodes, password-reset links, and magic login links, because that inbox is how most other accounts get recovered. Users pick read access before write access. They can tell Muse to forget a memory, opt out of training, and disconnect a service. Meta says conversations and data in the VM are not shared with its ad systems.

The architecture assumes the model will be attacked and will make mistakes. Connecting Gmail on the first night is still the riskiest tap in the setup, because the filters only help if they catch the message. Later this year Meta says it will ship Muse Confidential VM, encrypting the whole machine with a key only the user holds, so not even Meta can open it. That version is a promise. The shopping agent is live.

What $20 and $100 Buy in Weekly Tokens

Meta’s Help Center lists two paid rungs on top of a free meter. The paid plans buy volume, not a different agent. Maximum supplies six times Power’s weekly tokens at five times the price.

THE MUSE PLANS

Subscriptions auto-renew each month. You must be 18, or the age of majority, and in a country where Muse is on. Right now that means the United States, in limited testing, through the iOS and Android apps or muse.ai. Meta says the free tier covers most of what people need. The unit is “Muse tokens,” a house measure that does not map cleanly onto a published model-token table, so the two paid rungs are comparable with each other and with little else.

A chatbot answers and releases the GPU. Muse keeps a full cloud computer assigned to you, then runs subagents and scheduled jobs after you pocket the phone. That is why the meter exists, and why the top plan is $100 a month. An idle second computer for millions of people is a power bill, not a chat bill.

WhatsApp Is Already the Front Door

Talking to Muse is meant to feel like messaging a person, in the Muse app or inside WhatsApp. That is the distribution other labs have to buy. People already open WhatsApp. Meta also built connectors into Instagram and Facebook, so a saved reel can become a shopping list. AI glasses support is listed as coming soon, with no date and no list of which agent tricks will land on the frames.

Ticketmaster posted on September 9 that it is live as a Muse connector for US fans, surfacing seats and prices for artists and teams the user already follows, then sending checkout back to Ticketmaster. That is a clean picture of Meta’s pattern: the agent finds the thing, a partner still takes the money on its own rails unless Link is in the middle.

The product account posted the launch the same afternoon the newsroom did.

Introducing Muse, your personal AI agent from Meta that gets things done across every part of life.

Download the Muse app and get started: https://t.co/KBjYWfshGo pic.twitter.com/1exp56xj93

— Muse (@Muse) September 8, 2026

Referral notes on X were already swapping invite codes for extra Muse tokens within a week. That is a growth loop around a meter, not a hobby chatbot. Avatars and names are part of the sell; Sarantakos called her own Muse Veda. Under the avatar, the app shows a snippet of what the agent is doing. Tap it and you get the activity log and the permissions you have already granted.

Months of Extra Safety Work, Then a Public Bounty

On September 15, a week after the US launch, Mark Zuckerberg used a long post to argue that labs already have reason to care about alignment: people will not use an agent that ignores them, and labs face liability if a model causes harm. He then put Muse on the table as Meta’s example.

Meta delayed shipping Muse for several months to focus on safety and security. We didn’t call for everyone else to do this before we would. We just did it as part of our day-to-day work because it was clearly the right thing for people and for us.

Mark Zuckerberg, CEO, on X

THE ROAD TO THE SHOPPING AGENT

1. Early 2026: Meta staff begin using Muse on their own inboxes, calendars, and shells, and find it does not always behave.
2. April 8, 2026: Meta Superintelligence Labs ships Muse Spark, the first model in the Muse family, and starts the climb toward a personal agent.
3. September 2, 2026: Muse Spark 1.3 lands, tuned for longer agent jobs and coding, and becomes the model inside the consumer agent.
4. September 8, 2026: Muse opens in the US on iOS, Android, muse.ai, and WhatsApp, with Link checkout and a public bug bounty.
5. September 15, 2026: Zuckerberg says the ship date moved by several months so the security work could finish.

The public bounty is live. Meta will pay up to $300,000 for a valid Muse report, including up to $130,000 for a prompt-injection hit that affects one user. Breaking out of a single VM into Meta production sits at the top of that table. Prompt injection, Sheasha wrote, is still an industry problem, and Muse will still miss some of it. The money is there because the company expects people to try.

Coming to Glasses With No Date Attached

Muse is in the US, for adults, on a meter, with a card on file. Glasses come later. Confidential VM comes later. Shop Pay and 1Password come later. The parts that are not later are the dedicated cloud PC, the Sentinel gate, and a checkout path that already spends through Link.

If you try it, start with one boring connector and read the activity log before you add mail. The agent can work while you sleep. That is the feature, and that is the part that had to wait several extra months.