Meta Muse: the first mass-market personal agent, decoded

Meta launched Muse on 8 September 2026, and ten days later it was the number one free app on the US iPhone chart, ahead of ChatGPT, Gemini and Claude. Sensor Tower counted more than 730,000 US downloads over those ten days. Apptopia put global installs at 2.8 million by day twelve. Those are the biggest launch numbers any agent product has posted, and they belong to an app that does not answer questions so much as act: it books, buys, negotiates and fills in forms from a dedicated cloud computer that Meta runs for each user. Muse is US-only for now, which is why most Swedish readers have not touched it. That is also why this is the moment to understand it, before it lands in the App Store here, on your customers' phones and on your employees' Macs.

What Muse is, and what it is not

Meta's newsroom post describes Muse as "a secure, private personal AI agent that proactively helps with people's goals." The word doing the work is proactively. A chatbot waits for a prompt. Muse keeps a model of what you are trying to get done, suggests next steps, and carries on executing after you close the app. Meta's launch examples are mundane by design: turning a saved Instagram recipe into a grocery order, filling in a web form, chasing a lower bill, sending emails and booking appointments.

The mechanism is what separates Muse from every assistant Meta has shipped before. Each user gets a dedicated virtual machine in Meta's cloud, branded Muse Secure VM, with its own browser. The agent operates inside that machine. It reads the sites you would read, clicks what you would click, and pays with a card it generates for the purpose. Nothing about that is new to people who run agents at work. What is new is that Meta is handing this pattern to consumers, free, at the scale of the Facebook login base.

Availability at launch was iOS, Android and the muse.ai website, US only. AI glasses support was promised for "the coming months". Muse runs on Muse Spark, the closed-weights model family that Meta Superintelligence Labs has been shipping since April instead of a new Llama.

The security architecture, and why a CIO should read it

Most consumer agent launches say "private and secure" and stop. Meta published an actual architecture, and it is worth reading as a reference design because it is the one your employees will soon expect from anything you deploy internally.

Three of these deserve a closer look. Sentinel is the interesting one. Meta describes it as a separate agent, not a prompt instruction, sitting between Muse and the outside world. If you have read our piece on how a malicious repo can hijack a coding agent, you know why that separation matters: an agent that reads untrusted web pages will eventually read one that tells it to do something stupid, and the only reliable defence is a control that the model cannot talk its way past.

The credential design is the second. Muse fills in forms and logs into services, but Meta says the secrets are held where the model cannot see them. That is the same rule every enterprise agent framework has arrived at independently: the model gets a capability, never the key.

The third is the Confidential VM promise. Meta says a version of the VM encrypted with a user-held key is coming, which would put the agent's working memory beyond Meta's own reach. It is a promise, not a shipped feature, and the newsroom post gives no date. It also raises the question every EU reader will ask first: what does "Meta cannot read it" mean for the data that leaves the VM to be processed by the model? Part 4 takes that apart. For today, note that the commitments on the record are: an opt-out from training, no access from Meta's ad systems to conversations or VM data, per-connector permissions the user can revoke, and a "forget" function for things Muse has learned.

The scale, dated and attributed

Agent products have not had a consumer hit before Muse. Nobody outside Meta has audited numbers, so every figure below carries its source and date.

Two caveats. Sensor Tower's own comparison notes that ChatGPT's daily download pace in 2023 was higher than Muse's; Muse reached the top of the chart on volume over a longer window. And the two daily-active-user figures come from different trackers with different methods, so read them as a range, not a trend. What is not in dispute is the ranking: Muse displaced ChatGPT from the top of both the US App Store and Google Play within its first two weeks.

Meta's stated ambition is larger than the chart. At Connect on 23 September, Zuckerberg told the audience: "I expect that Muse is going to grow into the personal superintelligence that billions of people around the world are going to use." Discount the rhetoric and the distribution advantage still stands. Muse asks for a Meta account, and no other agent vendor starts with a login base that size.

Pricing: tokens per week, and a fee on what you buy

Meta's Help Center lists two paid plans. Both meter usage in "Muse tokens" per week rather than per month, and both require the subscriber to be 18 or over and resident in a country where Muse is available.

Put the Power plan next to Meta's own developer price list and the subsidy becomes visible. Muse Spark 1.3 on the Meta Model API costs $1.25 per million input tokens and $4.25 per million output tokens on the standard tier. Five hundred million tokens a week is about 2.2 billion a month. If those were billed as plain input tokens at list price, the bill would be $2,700 a month. Muse tokens are Meta's own unit and an agent's token mix is heavily cached and mostly input, so the true cost is far lower, but there is no mix under which $20 covers 2.2 billion tokens of a frontier model at API prices. Meta is not selling inference. It is buying users.

Zuckerberg said as much at Connect. In his words: "We are standing behind this by making Muse free for a huge number of tokens, with the expectation that over time we will profit by taking a small fee from transactions." The business model is a cut of what Muse buys on your behalf, plus whatever the subscriptions bring in. For merchants, that converts Muse from an app into a sales channel with a commission attached. Part 2 covers what that means for a retailer deciding whether to build a connector.

What Connect added on 23 September

Two weeks after launch, Connect turned Muse from a phone app into a platform. The announcements that matter beyond the consumer demo:

• Muse for Mac. With permission, the agent can drive any application on the user's desktop. Alexandr Wang's pitch was "you can walk away from your computer and it keeps working for you on all the jobs you lined up." If your staff use Macs, this is the announcement to bring to your next security meeting.
• An email address for the agent. Users will be able to copy Muse into a thread or forward it a message and let it handle the follow-up. Your customer-service inbox will start receiving mail written by agents.
• Realtime voice and a video avatar. A new Muse Realtime Avatar model gives the agent a face for live video conversations, and voice mode lets the user talk while the agent works in the background.
• Glasses and Muse Charm. Muse wakes on Meta's AI glasses by name, and a pocket-sized Charm device with the realtime voice model is due later in 2026.
• Connectors. Meta named Walmart, Best Buy, Gap, Sephora, Wayfair, Expedia, Instacart, Shopify's catalogue, Shop Pay, PayPal, GitHub, Notion, Granola and Box among launch partners, and said more than 1,500 developers applied to build connectors in under a week. Submissions go through a three-step review for functional, security and legal requirements before a connector appears in the directory.

One partner name is conspicuously absent. Amazon blocked Muse from its store on 22 September, telling Fortune that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use." The largest online retailer in the world has decided that a shopper's agent is not the shopper. Shopify decided the opposite and put its whole catalogue in. Every merchant with a web shop is going to have to pick a side, and soon.

Five things a business should take from the launch

• 1. Agents are now customers. Some fraction of visits to your web shop, your booking page and your support forms will come from a VM in Meta's cloud acting for a real person. Decide whether you welcome that traffic (build a connector, or at least keep your forms machine-friendly) or refuse it, as Amazon has. Not deciding means the agent decides for you.
• 2. Muse for Mac is a new class of shadow IT. An employee with a Meta account and a company Mac can hand a cloud agent the keyboard. Your existing policy on browser extensions and unmanaged software probably does not name this pattern. Update it before the Mac client ships in your region, not after.
• 3. The security architecture is now the consumer baseline. Sandboxed runtime, external policy gate, secrets outside the model, audit log. If your internal agent pilots lack any of these, your staff will notice, because the free app on their phone has them. Our post on AI-run breaches covers the same controls from the defender's side.
• 4. Transaction fees change who the agent works for. A free agent funded by commissions on purchases has the same incentive structure as a comparison site funded by affiliate links. That does not make it dishonest. It does make "which supplier did the agent pick, and why" a question worth asking, and worth asking of any agent you deploy on your own behalf too.
• 5. Distribution beats capability. Muse Spark is a strong model, but the reason Muse hit number one is a login base of billions and free tokens. The lesson for enterprise buyers is the mirror image: the model your agent runs on matters less than the identity, permissions and channels it is plugged into. Choose those first. The model can be swapped later, as we argued in our note on the OpenAI Agents API and residency.

The Swedish and EU angle, in brief

You cannot install Muse in Sweden today. Meta's Help Center says the service and its subscriptions are "in limited testing" and "not yet available in all locations", and the rollout so far covers the US and, since mid-September, Canada. Meta has announced no EU date. Given how Threads and Meta AI each arrived in the EU months after the US, and given that a personal agent that reads your WhatsApp, holds your card details and acts in your browser is exactly the kind of product the Digital Markets Act and GDPR were written to scrutinise, expect the wait to be longer than it was for a chatbot.

That gap is useful. Swedish organisations have a window in which to set policy for a product their employees and customers cannot yet use, which is a rare luxury in this market. The same gap exists on the business side: Meta's Model API, which sells Muse Spark to developers, has published no EU availability, no data processing agreement and no EU residency option. Part 4 goes through what that means, why the promised Confidential VM does not by itself answer the GDPR questions, and what a Swedish team that wants Muse-class capability can actually run today.

What to do this week

• Read the newsroom post and map the Secure VM, Sentinel, credential and audit design onto your own agent pilots. Write down where yours is weaker.
• Decide your stance on agent traffic. Amazon or Shopify. Put it in writing before a connector application from your own marketing team forces the decision.
• Amend the endpoint policy to cover cloud agents with desktop control, naming Muse for Mac explicitly, before it is available in Sweden.
• Watch the App Store listing. The day Muse appears in the Swedish store is the day your customer-service inbox starts receiving agent-written email.