Meta’s new Muse personal AI agent is built around more than a model. It runs inside a dedicated Muse Secure VM with its own browser, file system and execution environment, while a separate Sentinel agent controls what can reach the internet. Muse can keep long-running work active after the app closes, retain context across conversations, create its own tools for tasks and pause for explicit approval before sensitive actions.
Muse gives the AI agent its own computer
Meta introduced Muse on September 8, 2026 as a personal AI agent designed to do work rather than stop at an answer.
The important part is the runtime behind it.
Muse has access to its own computer, including a file system, terminal and full web browser. It can search the web, navigate sites, fill forms, work across connected apps and produce files such as documents, PDFs and web pages.
Meta also says Muse can write code and build tools when a task needs them.
That makes the product easier to understand as an execution system. Muse Spark provides the model intelligence, but the agent also has a place to run software, store working context and interact with the web. The model is one layer inside a larger operating environment.
Muse Secure VM turns the agent into a persistent runtime
That operating environment is called Muse Secure VM.
Each Muse runs inside a dedicated virtual machine in the cloud. Meta says the VM contains the agent and the person’s connected data, and is isolated so another person’s agent cannot reach it.
The architecture gives Muse something a normal chat session does not have: a persistent computer that can remain available while work continues.
A task can begin in conversation, move into the browser or file system, continue after the app closes and return to the user when the next decision is needed.
The VM therefore becomes more than hosting infrastructure. It is the workspace where the agent can preserve state while a task moves through multiple steps.
Sentinel creates a separate control path to the internet
Meta added another agent to the architecture, but gave it a different job.
A separate Sentinel agent runs on the same machine and is kept apart from Muse at the system level. Meta says nothing Muse does reaches the internet unless Sentinel approves it.
That creates a useful separation between planning and external action.
Muse can decide what a task needs and prepare the next step. Sentinel sits on the path between that work and the outside world, checking whether the action is allowed and asking the user for permission when required.
Meta also uses structured approval controls for sensitive actions. The result is an agent architecture where execution can remain fast for normal work while explicit decisions still have a deterministic approval surface.
Credentials can be used without being exposed to the model
Connected services add another boundary.
Meta says Muse has no visibility into passwords or other stored credentials. When a person connects a service, the credentials are kept in secure storage so Muse can use the connection without reading the secret itself.
That is a meaningful architectural detail.
An agent often needs authenticated access to complete a real workflow, but the reasoning model does not need to know the credential value in order to use an approved connection.
Muse also uses granular permissions. A person can decide which apps are connected and what the agent is allowed to do inside them.
That separates identity and authorization from model reasoning: the agent works through approved capabilities rather than receiving every secret as part of its conversational context.
Background work changes the interaction model
Muse is not designed around a strict one-prompt, one-response loop.
Meta says it can manage multiple tasks, continue work on a schedule and react to relevant events while the app is closed. When something meaningfully changes or user input is required, Muse can surface the update.
The product interface is built around that behavior.
An activity view shows what Muse is working on, along with a log of completed actions and approved permissions. A Goals tab tracks longer-running objectives and the plans attached to them.
That turns the chat into one control surface rather than the entire product.
Conversation starts the work, but the work itself can live across time, goals, browser sessions, files and background execution.
Memory and Artifacts make the workspace persistent
Persistence also changes what Muse can produce and remember.
Meta says memory carries across conversations, while side chats can keep separate projects or contexts from becoming mixed together. Users can inspect and edit Memory files directly.
Muse can also create what Meta calls Artifacts: richer outputs that can live beyond a block of chat text.
A task might end as a document, a web page, an interactive study guide or another structured interface instead of a long message.
That combination matters because agent work often creates state that should survive the conversation.
Memory preserves useful context. Side chats isolate project context. Artifacts preserve the output in a form that can be used again. Together, those pieces make the product feel closer to an ongoing workspace than a disposable transcript.
The agent can build tools as the task evolves
One of Muse’s more technical capabilities is easy to overlook.
Because the agent has a terminal and file system, Meta says it can write its own code and build tools needed for a task.
That changes how a personal agent can approach unfamiliar work.
Instead of relying only on a fixed catalog of commands, the runtime can combine browsing, code, files and connected services around the goal in front of it.
The same architecture also supports proactive work. Muse can continue following a plan, observe when something relevant changes and decide whether the result is worth surfacing.
Meta is rolling Muse out in the United States on iOS, Android and muse.ai, with AI glasses support planned next. Later in 2026, Meta says it plans Muse Confidential VM, where the complete VM will be encrypted with a key held only by the user.
The Upgrade Feeling
Muse is interesting because the model is no longer the whole product.
The system includes a reasoning model, a dedicated computer, a browser, a terminal, persistent files, memory, connected services, an approval interface and a separate Sentinel agent controlling the path to the internet.
Each layer solves a different part of agentic work.
The model decides. The runtime gives it somewhere to work. Permissions define what it can access. Sentinel controls external actions. Memory carries context forward. Background execution keeps the task alive after the conversation stops.
That is the upgrade.
The personal AI assistant is starting to look less like a chat window with extra commands and more like a persistent computing environment that can reason, build tools and carry work forward inside clearly defined boundaries.