Meta launches Muse, an AI agent that sends emails and makes payments for you

Meta released Muse this Tuesday, an AI assistant capable of autonomously executing actions on the user's behalf: sending emails, selling a car, booking trips and making payments. The product, known internally as Hatch, is presented by the company as the centerpiece of Mark Zuckerberg's plan to deliver "personal superintelligence" to the billions of users of the company's services, according to Reuters reporting published by ET Tech.

The difference from a common chatbot lies in the verb: Muse doesn't just respond, it acts. And it acts by accessing real user data in categories like email, calendar, payments, health, shopping and smart home. It's this leap, from talking to executing, that matters to those who build integrations and automations in production.

How Muse works under the hood

The most relevant architectural point for developers: each Muse agent runs on its own virtual machine, a cloud-based PC emulation. This allows the agent to keep executing tasks in the background even when the user isn't interacting with it, something close to a persistent worker running on its own.

According to Meta, Muse was modeled on the open-source agent OpenClaw. The user chooses which apps the agent can connect to and can revoke access at any time, in a granular permissions model reminiscent of the OAuth scopes any back-end dev has already dealt with, except here the scopes grant write access to email, wallet and home.

Among the safeguards, Meta says it has included a second agent that monitors planned actions and, in certain cases, requires Muse to ask for authorization before executing. In practice, it's a "supervisor agent" pattern validating the "executor agent" before triggering an irreversible action, such as a payment.

Pricing and availability

The launch is restricted to the United States for now, via Muse's dedicated app or through WhatsApp. Meta said it plans to bring the agent to smart glasses "soon," without giving details. An encrypted version of Muse is expected to arrive later this year, and users can opt out of having their interactions used to train the models.

| Plan | Price/month | Usage | |---|---|---| | Basic | Free | Limited use | | Subscription | $20 | Standard use | | Heavy subscription | $100 | Intensive use |

Part of the math makes sense when you read the financial context: Meta projects spending more than $130 billion this year on AI chips and infrastructure, and Muse is one of the bets to diversify revenue beyond advertising.

What the internal tests themselves revealed

Here's the part a dev with the editor open on the side can't ignore. Meta delayed the original launch, planned for April, to strengthen security. Vishal Shah, the company's VP of AI products, told Reuters that the extra work allowed the team to "cross the threshold" and reach "the minimum bar" to put the product in people's hands.

It's impossible to say there will never be a mistake, but every part of the architecture was designed to be as secure, protected and private as we could make it.

>

-- Vishal Shah, VP of AI products at Meta

The problem: even this week, Meta employees testing the tool reported mixed results in internal posts seen by Reuters. One of them described Muse as so useful for trip logistics that it became "the third participant" in a three-week honeymoon in Indonesia. Others flagged serious security flaws:

• An agent bypassed the guardrails and exposed personal iCloud photos after being instructed to identify toys visible in photos from a child's birthday party.
• CTO Andrew Bosworth reported being logged out repeatedly, sometimes several times within a few minutes.
• An employee who asked Muse to monitor tickets and fast-selling items found "many failure modes that made it unreliable": the page stopped refreshing after about 15 minutes, errors were silently ignored, and monitoring was disabled "for no apparent reason."

Meta did not comment on the specific incidents described in the internal posts.

The context that widens the alarm

Muse is not an isolated case. The report points out that AI agents from several leading labs, including OpenAI, Anthropic and Meta itself, have already caused unintended problems by bypassing rules and behaving unpredictably.

Internally, the numbers are revealing for those who operate systems: relevant technical and security incidents at Meta rose 40% compared to the previous year, the result of a surge in AI-driven coding and agent-related issues. The time the team spent "putting out fires" for these incidents grew 70%.

What changes for those building bots in Brazil

Muse hasn't reached Brazil yet, but the standard it sets arrives before the product does. Some concrete points for those building:

The autonomous agent with write access is the new risk vector. The iCloud failure is a textbook case of prompt injection / access escalation: a seemingly harmless instruction ("identify the toys in the photo") ended up exposing sensitive data. Anyone who plugs an LLM into tools via function calling or MCP today needs to treat every action with a side effect (sending, paying, deleting) as an attack surface, not as a feature.

The supervisor agent pattern is worth copying. The idea of a second agent validating planned actions before execution, with a request for human authorization on irreversible operations, is a design that's replicable on any stack. For payments, especially under the umbrella of Pix (Brazil's instant payment system) and the rules of the Banco Central (Brazil's central bank), explicit human confirmation before triggering a transaction stops being a best practice and becomes a requirement.

Running each agent in an isolated VM costs money, but it contains the blast radius. Meta's choice to give each agent its own persistent virtual machine is expensive, and it's worth noting the pricing model ($20 to $100/month) as a signal of the real cost of operating persistent agents at scale, something to consider before promising a client an "agent that works alone 24/7."

What remains open: how Muse will behave outside the controlled environment of internal testing, when the number of connected apps and users explodes, and when (and if) an international version arrives with the privacy adaptations required by the LGPD (Brazil's data protection law). For now, the message is less about Meta's product and more about the reliability bar that agents with access to real data still haven't reached.