Meta launched Muse, a personal AI agent that runs inside a persistent dedicated virtual machine in the cloud and can take actions across connected services, moving autonomous consumer AI beyond a chat interface and into an isolated execution environment.
The company released Muse in the United States on September 8 through a dedicated app and WhatsApp. Meta says each user’s agent operates in a Muse Secure VM with its own browser, storage, CPU and memory, while the same environment holds data and credentials associated with connected services.
Infrastructure model
Each Muse runs in a persistent, dedicated cloud VM designed to isolate the agent, its workspace and connected-service data from other users’ agents.
A cloud computer for each agent
The infrastructure behind Muse is central to how Meta is attempting to turn an AI model into software capable of working autonomously. Rather than limiting the agent to generating responses, the dedicated VM gives it a persistent computing environment in which it can browse the web, execute tools, compile code and coordinate concurrent sub-agents.
Meta’s technical documentation describes each VM as an isolated Linux system with enough compute and storage to perform real work. The core Muse runtime, internally known as Hatch, operates inside a system-level container with its own filesystem and virtual network interface. Meta says privileges and system calls are restricted to reduce the consequences if the agent behaves unexpectedly or encounters malicious content.
The architecture also makes the VM the system of record for information a user places in Muse. Mobile and web clients connect to the environment through a secure transport layer, while connectors allow the agent to interact with external services.
Muse can act across connected services
Users can authorize Muse to work with services including email, calendars and other applications. Meta says the agent can perform tasks such as sending emails, booking appointments, filling out forms, making purchases and handling customer-service interactions. It can also continue working on goals in the background rather than requiring a user to direct every individual step.
That capability materially changes the security problem compared with a conventional chatbot. An agent able to browse external sites and act through authenticated services can encounter untrusted instructions while simultaneously holding permission to perform consequential actions.
Meta has therefore separated the core agent from some security-sensitive functions. A second agent called Sentinel operates on the same VM but is isolated from Muse at the system level. According to Meta, outbound actions do not reach the internet unless Sentinel approves them, and the system can require explicit user authorization for sensitive operations.
Security is part of the launch story
The safeguards arrive after security and reliability issues surfaced during development. Reuters reported that internal testing uncovered cases involving sensitive data, monitoring failures and inconsistent agent behavior. Meta had initially planned to launch Muse earlier in the year but delayed the release while working on security, according to Reuters.
Meta acknowledges in its own engineering account that giving autonomous software access to inboxes, calendars and a shell created new operational risks. The company says Muse was trained with attention to prompt injection, tool use, long-running instructions and multi-agent coordination.
Credential handling is also separated from the agent where possible. Meta says login credentials are stored so that Muse itself cannot directly read them. For payments, the company says one-time card numbers can be generated at checkout rather than exposing a user’s underlying card details to the agent or merchant.
Why the VM architecture matters
For infrastructure operators, Muse is notable because Meta is treating persistent compute isolation as a core component of a mass-market autonomous agent rather than merely as backend hosting. Each agent needs an execution environment capable of retaining state, running tools and communicating with external systems while maintaining boundaries around user data and privileged services.
That creates a different infrastructure profile from stateless chatbot inference. Persistent agents can require storage, runtime isolation, browsers, scheduled processes and policy enforcement in addition to model inference capacity. Meta has not disclosed the per-user compute allocation or the total infrastructure capacity provisioned for Muse.
The scale of that architecture will depend on adoption. Muse is initially limited to U.S. users aged 18 and over, so Meta has not yet demonstrated what operating dedicated persistent agent environments at the scale of its global consumer platforms would require.
What happens next
The immediate test is whether Meta’s isolation and authorization controls hold up as Muse encounters the open web and a wider range of third-party services outside internal testing. Independent scrutiny of the Secure VM and Sentinel design will be particularly important because the agent can combine access to personal information with the ability to take external actions.
Meta has positioned Muse as a foundation for broader autonomous computing, but the infrastructure claim is already concrete: the company has launched a consumer agent whose operating model includes a dedicated persistent cloud VM for each user. Whether that architecture can be operated securely and economically at much larger scale is now an infrastructure question rather than a product-design hypothesis.
Meta’s descriptions of Muse Secure VM, Sentinel and its security properties are vendor claims. Reuters and AP independently confirmed the September 8 launch and the use of dedicated virtual machines; Reuters separately reported security and reliability issues identified during internal testing.
