Personal AI agents, software that acts on a user’s behalf across the internet, have been a recurring promise in the technology industry for years. Meta has now entered this space with Muse, a personal AI agent designed to automate digital tasks ranging from sending emails to booking travel to helping sell a car. The product is available on iOS and Android through a dedicated app, on the website Muse.ai, and directly through WhatsApp. Users of Meta’s AI glasses will also be able to interact with it soon. The basic version is free; heavier automation requires a paid subscription plan.
What makes Muse worth examining is not the feature list. It is the architectural and trust problem that Meta is trying to solve, and why solving it is harder for Meta than it would be for almost any other company.
What Muse Actually Does, and How It Does It
At its core, Muse is an agent that accepts instructions in natural language and then executes tasks autonomously. A user can ask it to handle a travel booking or manage a sale, and the agent works through those steps without requiring the user to supervise each one.
The payment dimension is particularly concrete. Muse can make purchases on a user’s behalf using infrastructure built by Stripe. The tool, called Link, generates a single-use card number for each transaction, so the agent never enters a user’s real financial details across third-party websites. Meta describes Muse as the first AI agent covered by Link’s purchase protections, which include guaranteed no-fee returns.
The agent also connects to third-party applications and services, which means it needs access to a significant range of personal data to function well. That access is precisely where the trust question becomes unavoidable.
The Architecture of Trust: Secure VM and Confidential VM
Meta’s answer to the trust problem is architectural. Every Muse user operates within what the company calls a Secure VM, a virtual machine that isolates each user’s activity and keeps data from the web and external integrations separate from the part of the agent that can actually take action. The goal is to prevent untrusted content from influencing the agent’s behavior in ways the user has not approved.
A component called the Sentinel monitors everything moving out of the virtual machine. According to David Singleton, Meta Superintelligence Lab’s vice president of engineering for consumer products, the Sentinel either matches outgoing data to an existing permission policy or surfaces a human-in-the-loop prompt asking the user to approve the action. Critically, these prompts go directly to the user and are not filtered through the model itself. This design choice is a direct defense against prompt injection attacks, a class of vulnerability where malicious content in the environment tries to hijack an agent’s behavior.
Secure VM has already been tested by Meta’s internal red teams and through a private bug bounty program. Meta is now adding Muse to its public bug bounty, with payouts reaching up to $300,000 for valid vulnerability findings and up to $130,000 specifically for successful prompt injection attacks affecting a single user.
A more advanced tier, called Confidential VM, is also in development. In this configuration, each virtual machine runs in a trusted execution environment and the user manages their own access keys locally on their device. The design means that even Meta itself cannot access the user’s agent VM. Confidential VM is being developed in collaboration with Moxie Marlinspike, the creator of Signal and the privacy-focused AI platform Confer. Meta plans to publish the Confidential VM binaries and a transparency log, and will give select security firms access to the source code for regular audits.
One important caveat: Secure VM is not an absolute barrier. Singleton acknowledged that while Meta is barred by policy from accessing user Muse data, it would remain technically possible. Users can also opt out of having their data used for model training.
Why the Trust Problem Is Bigger Than the Product
Here is what most coverage of AI agent launches tends to understate. A personal AI agent is not just a useful tool. It is a delegation of agency. The user is not clicking through a website; they are authorizing a system to act in their name, with their credentials, across services that may include banking, travel, communication, and commerce.
That delegation requires a level of trust that goes well beyond what most software asks for. And Meta, as the company itself implicitly acknowledges, carries a specific history with user data that makes this ask more complicated than it would be for a newer entrant.
The architectural choices Meta has made with Muse, particularly the Sentinel mechanism, the human-in-the-loop approval prompts, and the roadmap toward user-controlled encryption keys, represent a deliberate attempt to make trust verifiable rather than assumed. Whether those mechanisms are sufficient is a question that security researchers, regulators, and users will answer over time. What is already clear is that the industry is being pushed toward a new standard: AI agents should not simply ask for trust. They should be built to earn it through transparency, auditability, and user control.
The $300,000 bug bounty is not just an incentive. It is a signal that Meta understands the stakes.
In Short
Muse is Meta’s personal AI agent, capable of automating tasks like email, travel booking, and purchases on a user’s behalf. Its most significant feature is not the automation itself but the security architecture surrounding it: a virtual machine that isolates user activity, a Sentinel that monitors outgoing data, human-in-the-loop approval prompts designed to resist prompt injection, and a roadmap toward a fully encrypted Confidential VM where even Meta cannot access user data. The product enters a market where trust is the real barrier to adoption, and where the technical design of an agent matters as much as what it can do.
Based on reporting from Wired.