Muse is the first personal agent from a company that already owns the thread. Everything else in this directory reaches a messaging app from the outside, through a business API, a review process and a provider that carries the messages. Meta reaches WhatsApp because Meta is WhatsApp, and Muse launched on 8 September 2026 already inside it, alongside its own app on iOS, Android and the web.
What it does is the same job the rest of this set describes: email, calendar, bookings, travel, research and long-running plans, with a memory that persists across conversations and files you can edit. It also makes audio: on 11 September 2026 Meta said every user can ask for a podcast episode on any topic, and a user had it read a whole article that way. No field here covers that, so it stays a sentence. Two things about how it does it are unusual. It runs in a dedicated virtual machine with its own browser, so the browsing and the credentials sit in a computer allocated to you rather than in a shared pool. And a separate agent, Sentinel, holds the permission to approve anything leaving that machine, which Meta describes as the sole authority for connector actions and all network egress.
Calls are not on its pages and are on its record: on 11 September a user posted that Muse had called JetBlue for him and rung him back once a person answered, by 14 September users were posting that their Muse could place phone calls through two named voice agents, and by 16 September a Meta employee had described one in full, a carrier call handed back to him when the agent hit a verification text. The capability row here comes from Meta's pages and stays as they state it until they say.
What it connects to is the row that moved most this week. On 23 September its product lead published every partnership announced so far, five groups of them, all stated as live or coming very soon, and opened a platform where a business can apply to add its own. The integrations row above is that list, and the shape of it is the finding: 18 of the 38 are places to spend money, where the other 83 listings here name a median of four connections each, six name a merchant at all, and none names more than two. A keychain device followed on the 24th, the first hardware from any product in this directory, shipping in December.
On 23 September 2026 Meta published a research post giving the agent a face: Realtime Avatar, animated from the same speech stream as its voice, 448 by 768 at 25 frames a second, about 870 milliseconds from the end of your turn to the first byte back, with an invisible watermark in every frame and no ship date. No page of the product mentions it, so no row here moves; it is the first latency figure anybody in this directory has published for a spoken reply.
On 24 September 2026 its chief AI officer announced Muse mail, an email address of the agent's own that you add to a thread or forward things to, which is the same feature Instinct shipped on 8 September and the second product here to give the agent an inbox rather than access to yours.
On 23 September 2026 its own account listed four connectors announced in a day, Shopify for one-tap checkout, PayPal for payments, Expedia for hotels and Instacart for groceries, all of them coming soon, and ElevenLabs announced a fifth the same evening for voiceovers, soundtracks and video. None has a date and nothing on Meta's pages names them, so the capability rows here do not move; the partners' own announcements are on the market wall.
What is in that machine was described from the inside on 24 September, by a developer rather than by Meta: around 70 preloaded skills with command-line tools, a website builder called Spaces that deploys to Cloudflare when you share a site, a database of its own that a skill queries for the agent's memories under guard rails, the freedom to install anything, and a zip of the sandbox's file tree handed over on request. His account is on the market wall; none of it is on a page Meta publishes.
Since 12 September it also writes its own connectors: a Meta engineer demonstrated Muse writing software and running it in the per-user cloud VM to reach a service with an API that has no built-in integration, which is the same VM the security write-up describes as holding the credentials.
On 29 September 2026 Meta launched Muse for Small Business: connectors for Shopify, Stripe, QuickBooks, Canva, Slack, Klaviyo and a dozen more, Instagram analytics, Facebook Pages and Meta ad accounts, free with usage limits and with Meta's own line that nothing publishes, sends or spends without approval. The same week its head of communications confirmed that the Mac app has a Messages connector, opt-in behind Full Disk Access, in reply to a columnist who says Muse read his messages unasked.
It is also the only listing here that has published a threat model.
Meta's security write-up states that credentials stay in the user's VM rather than in central infrastructure, describes layered defences against prompt injection including a set of detection classifiers running independently of the model, and pays up to $300,000 through its bug bounty, of which up to $130,000 is for a successful prompt injection affecting one user. The same document says plainly that Muse is not immune to attack and that prompt injection remains an open problem. Every other product in this directory reads your messages and says nothing at all about that class of attack.
Read against the document rather than the launch copy, the privacy picture is more specific and more interesting than the announcement. Meta states that Muse does not share your conversations or the data in your virtual machine with its ad systems, and then gives the exception itself: if you ask Muse to buy a shirt from a designer's website, that designer might use your visit to show you an ad on Instagram. The agent browsing on your behalf is still a visit, and the retargeting that follows is somebody else's.
On access, the write-up is unusually direct: the VM restricts access to your data by Meta personnel through operational policies, and it does not prevent Meta from accessing data when necessary to support, secure or operate the service. A Confidential VM intended to cryptographically prevent that is promised for later in 2026, with an external audit that Meta says will be inspectable by anyone. Training defaults to on with sanitised trajectories and a stated opt-out switch in settings.
On 9 September 2026 Zuckerberg described that Confidential VM in an interview, saying every user can have a cloud machine holding private data that Meta itself cannot see, and that he knows of no other agent product with anything close. That is the claim; the write-up above is the document, and until the two agree the rows here follow the document.
Two things are still unrecorded here. Nothing we found says what happens to the VM and its contents when you stop using Muse, and nothing addresses the people on the other end of a WhatsApp thread who never agreed to any of this. Muse links Meta's general privacy policy for everything the security write-up does not cover, which is why the rows above cite the write-up by name.
Read again in September, and the shape of the gap has not changed. Everything recorded here about how Muse handles data comes from a published security write-up rather than from a privacy policy for the product, so the rows a policy would answer, what happens to your data when you stop, what the people in a thread with you can ask for, and how long anything is kept, are answered by Meta's general company policy or not at all. It is the largest company in this directory and the document is the least specific to the product.
Muse
