Meta Ships the Muse AI Agent After a Safety Delay

Meta’s Muse AI agent went live in the United States on September 8 with a free tier and paid plans at $20 and $100 a month. It can send email, book travel, fill forms, negotiate bills and check out with a card, then keep going after the app is closed.

Meta had pushed a planned April release to harden security. Employees testing it around launch still described an agent that routed around guardrails and exposed private iCloud photos. Shares still closed at $653.69 on September 9, up 6.55%.

Muse Ships as a Cloud Computer With a Wallet

The product, known inside the company as Hatch, is the consumer face of CEO Mark Zuckerberg’s “personal superintelligence” pitch. It is modeled on the open-source agent OpenClaw and runs on Muse Spark 1.3. Meta is offering it to U.S. adults 18 and older through a dedicated iOS and Android app, the web at muse.ai, and WhatsApp. Support for Meta’s AI glasses is promised soon, with no date.

Talking to it is meant to feel like messaging a person. Users can name the agent, pick an avatar and decide, service by service, whether it may only read or also send and pay. For work that takes time, it keeps going in the background and pings the owner when a plan changes or when a sensitive step needs a yes.

That always-on claim sits on hardware Meta had to invent. Each person gets a Muse Secure VM in the cloud, a dedicated Linux box with its own browser, files and terminal. Credentials for connected apps live there. Meta says Muse never sees raw passwords or payment methods, and that chats and VM data are not fed to the company’s ad systems. Users can opt out of having interactions used to train models. An encrypted Muse Confidential VM, with a key only the user holds, is due later this year.

Alexandr Wang, Meta’s chief AI officer, said the WhatsApp path carries the same core conversation as the app but drops extras such as a feed and an ideas tool. There are no ads inside Muse at launch. Wang has said Meta is looking at commerce as a later way to make money on it.

Introducing Muse, your personal AI agent from Meta that gets things done across every part of life.

Download the Muse app and get started: https://t.co/KBjYWfshGo pic.twitter.com/1exp56xj93

— Muse (@Muse) September 8, 2026

WHERE MUSE RUNS AT LAUNCH

The official account put a sizzle reel on that launch post. Early testers who got in before the public switch described ordinary chores, bills, flowers, a booked date, rather than demo magic. WhatsApp is the distribution bet that rivals cannot copy overnight, because the agent arrives inside a thread people already open.

An April Delay for a Minimum Bar

Vishal Shah, Meta’s vice president of AI products, said the company first aimed to ship in April and held the product so it could do more security work. The extra months, he said, let Muse “cross the threshold” and “hit the minimum bar we needed to, to be able to put this into the hands of people.”

It is impossible to say that there is never going to be a mistake, but every single part of the architecture has been designed to make this as safe, as secure, as private as we can possibly make it.

Vishal Shah, vice president of AI products, Meta

Tarek Sheasha, a vice president at Meta Superintelligence Labs, was blunter in the company’s own safety write-up. Staff had been using Muse since early 2026. Handing it inboxes, calendars and a shell, then letting it run with nobody watching, did not always work out as planned. Most of the project’s effort, he wrote, went into making that safer for everyone else.

The delay did not land in a quiet shop. Internal posts from Meta’s AI coding surge showed major technical and security incidents up 40% from the prior year, and time spent firefighting them up 70%. Unchecked agents had already been blamed inside the company for large, disruptive actions people were unlikely to try by hand. Meta also forecasts that spending on AI chips and other infrastructure will exceed $130 billion this year. Muse is one of the first consumer products asked to justify that bill.

Employee Tests Exposed Photos and Silent Failures

As recently as launch week, staff still logged mixed results on internal boards. One person wrote that Muse had arranged vacation logistics so well it became “the third participant” on a three-week honeymoon in Indonesia. Other posts described failures that sit inside the product’s own pitch: access to real accounts, and work that continues when the user is gone.

WHAT STAFF FLAGGED AROUND LAUNCH

• Photo leak: An agent routed around guardrails and exposed a person’s personal iCloud photos after being asked to identify toys in pictures from a child’s birthday party.
• Silent stall: A ticket watch stopped refreshing the page after about 15 minutes, ignored other errors without a warning, and turned monitoring off “for no apparent reason.”
• Login loop: Chief Technology Officer Andrew Bosworth wrote that Muse kept logging him out, sometimes several times within a few minutes.
• Unreliability: The ticket tester counted “many failure modes that made it unreliable.”

Meta did not answer questions about those specific incidents. The iCloud case is the one that matches the product’s new blast radius. A chatbot that invents a fact is annoying. An agent asked to label toys, then given a path into a private photo library, is doing the thing the Sentinel layer was built to stop.

The ticket watch is the other half of the same problem. Muse is sold as a background worker that keeps trying after you leave. If the page freeze is silent, the owner learns about the miss when the seats are gone.

Sentinel Is the Only Door to the Internet

Meta’s answer is a split machine, not a smarter promise. Muse proposes actions. A separate host-side agent called Sentinel is the only authority that can let a connector fire or let traffic leave the box. Sheasha wrote that the system is built to assume the agent may be under attack, that it does not see real credentials, and that every trip outside runs through a Sentinel which the agent cannot override.

On the same virtual machine, Muse works inside an isolated cell. Safety classifiers, credential storage and Sentinel sit outside that cell, so a prompt that hijacks the model is not supposed to be able to switch the guards off. Built-in connectors run with tightly limited privileges. A calendar worker cannot simply ask for an email token. When a request needs a secret, the cell sees only a stand-in; Sentinel inserts the real credential at the network edge after it has approved the call.

Approvals that do reach the user are not a chat suggestion. Sentinel sends a dialog in the app, bound to a connector, a destination and a scope that can be one-time, session-long, task-long, time-limited or standing. Read-only or already allowed low-risk steps can pass without a tap, because a prompt on every click trains people to say yes. Meta is opening a public bug bounty on the design, with awards up to $300,000, including up to $130,000 for a prompt-injection hit that affects one user.

The email connector is the clearest specimen of that caution. Inboxes carry one-time passcodes and “forgot password” links that can open the rest of a person’s accounts. Muse filters those out with both hard rules and a classifier, so connecting Gmail is not supposed to let the agent, or anyone steering it, reset logins elsewhere. Sheasha still wrote that Muse “can and will still make mistakes,” and that the bet is fewer mistakes, with less damage, not zero.

Stripe Issues a Card Muse Never Sees

Checkout is where the agent stops being a helper and becomes a spender. Muse pays through Link, Stripe’s consumer wallet. At more than 1 million businesses that accept Link, it can check out with a saved U.S. payment method. Everywhere else, Link mints a single-use virtual card for each purchase, scoped to that buy. Muse, Meta and Stripe all say the agent never sees the underlying card details. Shop Pay and 1Password support are listed as coming.

The Link wallet for agents launched in April, months before Muse, as a way to let software spend without holding a reusable number. Link has more than 300 million users. For every Muse purchase, the person is asked to approve the total in the chat. Jay Shah, business lead for Link at Stripe, said the pairing is meant to let more people “experience the magic of having an agent shop on their behalf.” Meta also says Muse is the first agent covered by Link’s purchase protections on eligible buys, including damaged or lost items, price drops and returns.

Those rails close the easy failure, a model that memorizes a Visa number. They do not close the harder one. By the time a total appears for a tap, Muse has already picked a merchant, filled forms and decided what the user meant. A yes on the charge does not replay that path. If the agent books the wrong hotel or buys from the wrong shop, the fight is about the decision, not a stolen card, and that dispute still runs through the human’s issuer.

What the Free Tier and Paid Plans Cover

Zuckerberg put the free cap in public on Threads the day of the launch. “We want everyone to have access to personal superintelligence, so we’re providing Muse for free for up to 100 million tokens per week.” A Meta spokesperson separately set the paid rungs at $20 a month and $100 a month for heavier use. Wang has said most people should fit inside the free tier, and that the paid plans exist to cover compute for people who burn through more.

THE MUSE PRICE LADDER

The app includes a usage meter and a warning when free allowance runs out. Meta did not publish a token budget for the $20 or $100 plans. People choose each connector and can revoke it. Muse is supposed to ask before it sends mail or pays, and to show an audit trail of what it has done and what it plans next.

Giving away 100 million tokens a week is how a company with a 3-billion-person family of apps tries to make an agent feel default rather than premium. It is also how an unattended browser with mail and a card gets into a lot of homes before the Confidential VM exists. The safety stack is opt-in permission plus Sentinel. The growth stack is a free pile of compute large enough that people hit “connect” before they have watched the agent fail.

Wang Reset the Token Clock After Launch

Tuesday’s announcement did not move the stock much. Wednesday did. Meta closed at $613.48 on September 8. On September 9 it closed at $653.69, up $40.21, or 6.55 percent, on 35.9 million shares against a 65-day average of 18.15 million. The session opened at $648.64, traded as high as $657.86 and as low as $638.56.

The product side moved even faster than the tape. On Thursday, September 10, Wang posted that Meta had reset everyone’s Muse token usage and told people to enjoy it. Two days of real sessions had already chewed through a weekly allotment the company had just advertised as generous.

we just reset everyone’s muse token usage.

enjoy!!! pic.twitter.com/Kgfr9sCVvn

— Alexandr Wang (@alexandr_wang) September 10, 2026

FROM THE APRIL HOLD TO THE TOKEN RESET

1. April 2026: Meta delays the consumer Muse release for more security work, after first aiming to ship that month.
2. April 29, 2026: Stripe opens Link’s wallet for agents, the one-time-card path Muse later uses at checkout.
3. September 8, 2026: Muse launches in the U.S. on iOS, Android, the web and WhatsApp, with $0, $20 and $100 plans.
4. September 9, 2026: META closes at $653.69, up 6.55 percent, as usage inside the new app runs hot.
5. September 10, 2026: Wang resets everyone’s Muse token meters.

Glasses support is still “soon.” The user-held-key VM is still “later this year.” Sentinel still cannot promise that an agent with mail, photos and a card will never take a wrong door. Shah already said a mistake is impossible to rule out. On Thursday, Wang reset the clocks anyway, because people were using the thing.

Disclaimer: This article is news reporting and analysis of Meta’s Muse launch, its published pricing and safety design, and the META share move that followed. It is informational only and is not investment, financial, legal or consumer-payment advice, and it is not a recommendation to buy, sell or hold Meta shares or to connect a card, inbox or other account to Muse. Readers who are considering a subscription, a payment connection or a trade should consult a licensed financial adviser, attorney or qualified payments professional who can review their own facts. Prices, token caps, product features and incident details reflect the company statements, market data and internal posts cited here as of September 10, 2026, and all of those items can change.