Meta Muse explained: connectors, privacy, permissions and limitations
An agent can act across services. Evaluate the access you give it as carefully as the work you want it to do.
Documentation-led analysis, not a hands-on review. Availability and announced US prices are dated; taxes, lenses and regional offers can differ. Practical examples below are proposed evaluations, not measured results.
Muse is Meta’s personal AI agent. Its central promise is completing tasks across services, not only producing answers. The useful question is what it can do with the access you choose to grant.
What is available, and what was announced?
Meta launched Muse on September 8, describing a US rollout on iOS, Android and the web. It runs in a dedicated virtual computer with a browser. Meta describes free usage alongside subscription plans, but this guide has not verified a current plan-by-plan price or usage allowance.
Source: Meta’s Muse launch announcement. Check the price and limits shown to your account before paying.
| Capability | How to read the announcement |
|---|---|
| Connected services | Access depends on each connector and the permissions you grant. |
| Notion, Granola, GitHub, Box and commerce additions | Named at Connect; verify individual availability in your account. |
| An email address for the agent | Announced as forthcoming. |
| Glasses integration | Planned in the coming months. |
| Realtime avatar | Research demonstrations do not all represent avatars available in the app. |
Sources: Connect recap and Meta’s avatar research.
How is an agent different from a chatbot?
A chatbot can draft a response for you to move elsewhere. An agent may have the tools to perform the next step. For a practical evaluation, distinguish reading information, drafting a change and committing it. Those stages carry different consequences.
Illustrative task: ask for a summary of three non-sensitive meeting notes, with links back to each source and a list of unresolved questions. Initially, keep the task read-only. If that succeeds, evaluate a draft follow-up separately. Do not treat a fluent summary as evidence that sending permissions are appropriate.
What do connectors actually change?
Meta’s security documentation describes integrations with service APIs and an independent permission authority called Sentinel. It says requests can be allowed, denied or referred back to the user based on connector policy.
Source: Meta’s security architecture. This is the company’s account of its design, not an independent security certification.
For a small team, the practical issue is scope. Access to a notebook does not imply a need for access to every client file. Before connecting a work account, identify who owns the data, which records are needed and whether the organization permits the integration. Then test whether disconnecting it actually removes the access you intended to revoke.
For a repeatable research process, compare this approach with an explicit workflow such as the one in our n8n research guide. The agent approach deserves evaluation where the steps vary; a fixed sequence may be easier to inspect when the task repeats unchanged.
Privacy controls: what Meta says
Meta says users can choose connector access, review an audit trail, disconnect services and opt out of training on their interactions. It describes confirmation before sensitive actions such as purchases or sending email. The launch announcement places its more restrictive Confidential VM in a future rollout, rather than describing it as universally available at launch.
Source: Muse launch and controls.
These controls answer different questions. A training opt-out does not itself limit which files an agent may read. A confirmation screen is useful only if it gives you enough information to catch the wrong recipient, amount or attachment. Check both the data settings and the proposed action.
The Mac vulnerability and hotfix
Patrick Wardle’s proof of concept described a local process redirecting Muse dictation traffic, potentially exposing prompts or authentication material and abusing the agent’s granted access. The researcher explicitly stated that the attacker needed code execution as the local user.
Primary source: Wardle’s research description.
The Register’s September 22 update reported Meta’s statement that it had issued a hotfix. Meta emphasized the local execution requirement. This guide has not independently tested the repaired app or verified its installed version on your device.
Incident follow-up: The Register’s updated report.
The decision implication is specific: an agent’s connected accounts can make compromise consequential. Updating the client and narrowing access address different parts of that problem. Neither a vulnerability report nor a hotfix is a complete assessment of the entire service.
Platform restrictions and unclear features
Business Insider reported that Amazon asked Meta to remove its marketplace from Muse. That dispute illustrates why web access is not equivalent to reliable permission to transact on every site.
Source: Business Insider’s Amazon report.
Mac computer control needs separate verification of its current rollout, application coverage and permission behavior. Check the current client documentation before treating desktop control as part of a purchase decision. The same principle applies to the agent’s forthcoming email address and glasses access.
A useful first evaluation
- Choose one bounded task and non-sensitive sample inputs.
- Grant the narrowest access that can complete it.
- Require source links, unresolved questions and a visible completion record.
- Check errors and omissions before enabling any external action.
- Record correction time and subscription limits in the Software Decision Workspace.
If meeting notes are the input, the Granola guide helps define what a faithful summary should preserve. Return to the Connect hub for related hardware and creator announcements.