Meta Launches Muse, a WhatsApp AI Agent That Shops, Emails, and Negotiates on Users' Behalf

Meta has launched Muse, an AI agent that users control through WhatsApp to handle tasks like booking travel, shopping, and negotiating prices, according to the company.

Meta says Muse can take on both simple requests, such as sending an email, and multi-step goals that require planning and coordination over time. The agent opens a browser, fills out forms, and negotiates on the user's behalf. According to Meta, Muse can sell a car for more than the initial asking price, lower a bill, or adjust a workout plan. For longer-running tasks, Meta claims Muse keeps working even after the app is closed, checking in with the user only when something changes or when approval is needed — for example, before sending an email or completing a purchase.

Payment feature OpenAI abandoned

Muse completes purchases through Stripe's Link service after user approval. Meta says Muse is the first AI agent covered by Link's purchase protection, which addresses damaged or lost items, price drops, and returns. Each transaction generates a one-time card so real card details stay hidden. Shop Pay integration and a connection to 1Password are planned to follow.

This puts Meta in territory OpenAI recently exited. OpenAI shut down ChatGPT's direct payment feature and returned checkout responsibility to merchants, after users researched products in chat but completed purchases elsewhere.

Isolation as the security model

Meta says Muse runs on a dedicated cloud virtual machine — called Muse Secure VM — walled off from outside agents. Login credentials for connected services are stored there. A separate process called Sentinel runs on the same machine and is supposed to clear any outbound action before Muse can reach the internet. According to Meta, Muse itself never sees passwords or payment methods directly; credentials sit in a secure store the agent can use but not view.

Meta says users control which apps Muse can access and to what extent — for instance, whether it can only read emails or also send them — and that access can be revoked at any time. The company has not published quantitative security metrics or third-party audit results for the system.

The isolation architecture responds to a documented risk category: agentic AI systems being hijacked through manipulated web content. Security researchers previously showed that a doctored calendar invite was enough to compromise a password manager account through Perplexity's Comet browser.

Ad data separation and rollout

Meta says Muse conversations and VM data do not feed into its advertising systems, and users can request the agent forget what it has learned. This differs from Meta AI, whose interactions have been used for ad and content personalization on Facebook and Instagram since December in most regions, excluding sensitive categories like religion, health, and political views. Later this year, Meta plans a Muse Confidential VM option that encrypts the entire virtual machine with a key held only by the user.

Meta positions Muse as an early step toward what it calls "personal superintelligence," a term also central to a recent essay by CEO Mark Zuckerberg. The underlying model has reportedly improved on the Artificial Analysis Intelligence Index v4.3 from 31 points in April (Muse Spark) to 44–48 points as of early September (version 1.3), depending on tier. For comparison, GPT-5.6 Sol scores 47 on the same index, while GPT-6 Astra and Claude Fable 5.1 reach 53. Muse is believed to build on Hatch, an agent Meta was reported to be training in May inside simulated web environments modeled on real sites like DoorDash, Etsy, and Reddit.

Muse launches first in the US on iOS and Android, with integration to Meta's AI glasses planned. Free usage is capped with periodic refills; Meta plans paid subscription tiers, with earlier reports suggesting pricing as high as $200 per month.

What this means

Muse is a product bet, not a new foundation model — it wraps an evolving Meta model in an agentic framework with payment rails and sandboxing. The real test is whether Meta's isolation architecture holds up against the same prompt-injection and content-hijacking attacks that have already compromised competing agentic browsers. Handing an AI agent direct purchasing power via one-time virtual cards is a meaningful step past OpenAI's retreat from in-chat checkout, but it also concentrates risk: a single successful jailbreak against Sentinel could mean unauthorized purchases, not just leaked text.