Meta Muse Review: America's #1 App, and What It Asks You For
The short version: install it. The free tier of Muse is the most complete consumer agent anybody has shipped, and it is the first one aimed at people who have never heard of an agent. Then stop before you connect your card. Muse does not just watch your life the way a chatbot does — it has its own virtual machine, its own browser and a login for your accounts, so its failures are the kind you cannot undo. Meta's page is unusually explicit about the safeguards and unusually quiet about the number that matters: what the free tier actually runs out of.
Meta's Muse page, read 2026-09-23. Everything below separates what Meta publishes from what press reported at launch. Screenshot: ai.meta.com/muse.
What it is, in Meta's own words (read 2026-09-23)
Strip the marketing and the architecture is the interesting part: Muse runs on Muse Secure VM, a persistent dedicated virtual machine with a browser, so the agent can navigate sites the way you would — opening pages, clicking, filling forms, sitting in a customer-service queue. It books appointments, fills in forms and handles customer service; it works in the mobile app, on Mac, and inside WhatsApp; and it keeps going in the background after you close the app.
The security model is where Meta has clearly learned from the agent launches that went wrong. Logins live in a credential store the agent cannot read, with 1Password integration announced as coming. At checkout, a one-time card number is generated so neither the merchant nor the agent sees your real card, and eligible purchases carry Link's purchase protections — Meta calls it a first for AI agents. Actions like sending mail or buying something are supposed to be approved by you first, with an audit trail of what the agent did and plans to do. Meta also states that your conversations are not shared with Meta's ad systems, and that an encrypted version is planned before the end of the year.
Those are good defaults on paper. They are also all self-reported, which is exactly what the launch thread refused to accept at face value.
The price, and the line Meta leaves off the page
Meta's own FAQ says Muse is “available for free with a usage limit”, and that when you hit it you can upgrade to a paid subscription or wait for the limit to refresh. That is the entire published pricing story. The numbers came from launch coverage instead: $20/month and $100/month, with Zuckerberg quoted as saying the free tier covers a very large weekly token allowance, and reporters noting that a card is required on file even for the free tier. None of that is on the page I read on 23 September, so treat it as reported, not as a price list.
The practical consequence is the same one that shows up in every agent subscription: you cannot budget a bill you can't see a meter for. It matters more here than elsewhere, because a background agent keeps working while you are not watching. Try it on the free tier, and let your first limit reset tell you what your real usage looks like before you type a card number.
Why it charted: Meta is aiming at the people who never heard of an agent
The most useful thing in the whole thread was a story about an accountant. It explains the product's appeal better than any of Meta's marketing:
“I was discussing latest in tech with an accounting friend … and asked which one she used on the desktop 'Work' app, and she responded with, 'just ChatGPT, what is Sol?' … most people just stick with whatever default they're provided with, and it's a lot of them … I'm sure millions of people will gobble up this Muse agent.”
Meta is not competing to be the best agent for readers of Hacker News. It is competing to be the first agent an ordinary person ever uses, and the distribution is already there: WhatsApp, Instagram, Messenger. That is a genuinely different product strategy from OpenAI's and Anthropic's, and it is why the app charted rather than the API. Reuters reported Muse as the No. 1 free app on both US stores on 21 September, and press coverage that week noted it had pushed ChatGPT off the top; Meta shares were up around 10.7% on that Monday. A commenter who tried the email integration made the sharper observation:
“It's hilarious that Meta made a good AI integration for Gmail before Google did.”
The real disagreement is not privacy. It is reversibility.
Plenty of commenters said they would not trust Meta with their data, and that is a fair summary of the company's history — we wrote up what a privacy failure actually looks like when a coding tool leaked in the Zhipu incident. But the sharper comment separates two different risks that the word “privacy” flattens into one:
“The privacy concerns here are valid, but there's a second axis that gets less attention: an agent with its own browser and access to your accounts takes actions, it doesn't just observe. The failure mode isn't only "Meta sees your data", it's "the agent misunderstands you and does something you can't take back" - books the wrong flight, sends the wrong message, buys the wrong stroller. And for all these personal-agent launches, nobody ships public evidence of how the thing behaves under ambiguous or adversarial instruction. The evals that exist are vendor-run and pre-launch. What these systems actually do in the wild, with real users pushing on them in ways the vendor didn't script, is basically unmeasured.”
Two more failure modes came up repeatedly and both are worth your attention. The first is commerce hygiene: an agent shopping across unfamiliar sites is a walking target for scams:
“considering the current state of the internet and meta having no control over a solid marketplace (like amazon), it is very hard to see the shopping feature to take off. even if some legit business register/allow the bot to buy stuff, it will be ridiculously overwhelm by scam sites.”
The second is what happens when every consumer runs a browsing bot. This commenter liked the browser he could watch — he calls that part “awesome” — and still concluded it does not scale:
“But now every consumer in the world can just ask a question or say "check all these prices and sites for a thing I want" and go do something else, right out of the box for free, and have thousands of page loads and site interactions fire off for them. Bypassing the branding/marketing funnels or intended UX of sites, through some kind of proxy client amplifying the traffic a human would create, with the ability to let anybody scrape or interact directly with a site's backend … definitely a consumer win, but seems unsustainable.”
That is not hypothetical any more. On 21 September, Amazon was reported to have started blocking Muse's shopping agent from its checkouts — a fight whose stakes one commenter framed through advertising, quoting the reporting that Amazon “generated more than $68 billion in advertising revenue last year”: if agents take over discovery, comparison and purchasing, fewer humans see the ads. Whether you care about Meta or not, expect the sites you shop at to start treating agents as a category to be managed, the way they treat scrapers.
What I would actually let it do
This is the part every review skips, so here is mine, based on what Meta documents and what the thread found. Three tiers, and the line between them is simple: can this action be undone?
| Tier | Tasks | Why |
|---|---|---|
| Safe to hand over | Research across sites, price comparison, summarising long pages, drafting mail for your review, organising the files it can see, watching a page for a change | Mistakes cost you a re-read. This is where the free tier earns its place, and it is genuinely useful even if you never pay. |
| Read the audit trail first | Booking anything with a date, filling government or medical forms, canceling subscriptions, anything touching a shared calendar or a colleague's inbox | Reversible in theory, expensive in practice. Run it twice in draft mode before you let it hit submit. |
| Not yet, on any agent | Storing your primary payment card, unattended purchases, anything with legal or financial consequence, connecting accounts you cannot easily rotate | Meta already limits this for you — one-time card numbers, approval prompts, an agent that cannot read its own credential store. Do not spend an afternoon helping it route around those. |
Two honest caveats on that. The people who said they would simply never use a Meta agent got a fair pushback in the thread — “It's not they who are a ‘special kind of stupid.’ It is us who are a ‘special kind of paranoid.’ Justifiably so, I would contend” — and the honest version of that argument is that the dividing line here is convenience, not principle:
“I distrust Meta but if I'm being honest, if their tools were awesome and cheap enough I might start using Muse. A lot of people are in my camp: aware of privacy issues, too lazy to be strict about it.”
The other caveat: nobody in that thread, including me, has public evidence of how Muse behaves under a deliberately confusing instruction. Both of those are reasons to start on the free tier, not reasons to stay away from the category.
The verdict
Install it if:
You are in the US, you already live in WhatsApp, and you have a pile of browser errands — comparing prices, chasing a refund, filling the same form twice. The free tier is a real product, and the free tier is the one to judge it on. Nothing about the paid tiers is published well enough to buy blind.
Wait if:
You are outside the US (no published date), you need the encrypted version Meta says is coming, or your work involves data you would have to report a breach for. Wait for the encryption, then decide.
Skip it if:
The only thing you want is an assistant that reads your own files, offline, with no account attached. That used to be the expensive option and it isn't any more — start with local LLM vs API, and if your real concern is meetings and notes being uploaded, our note-taking privacy piece is the same argument with different apps.
Local LLM vs API → Note-taking privacy → What a privacy failure looks like →
Method: product claims read directly from ai.meta.com/muse on 2026-09-23; pricing, availability, App Store ranking and stock reaction taken from launch coverage (Reuters, CNBC, TechCrunch, AP as carried by other outlets) and labelled as reported. Quotes are verbatim from the Hacker News threads “Muse – Meta's personal AI agent” (8 September 2026, 666 points, 742 comments) and the 21 September discussion of Amazon blocking Muse from its checkouts (151 points), with comment ids linked. We don't take payments from vendors. Meta is not a sponsor and has not been asked to comment on this piece.