Muse: Meta's Personal AI Agent and Its Permission Model

My notes

Summary

Muse is Meta’s personal AI agent that browses the web, fills out forms, books appointments, handles customer service, and keeps working in the background after the app is closed. It uses a per-action permission model and generates one-time virtual card numbers for purchases so the merchant never sees the real card.

Key Insight

• Three-tier framing Meta uses to position the product: chatbot (single-turn Q&A) versus AI assistant (conversational, generates content) versus personal AI agent (autonomous, multi-step, works across connected apps, keeps running after you close the app). Useful shorthand when pitching or comparing agent products.
• Permission model: for actions like sending messages, making purchases, or sharing data with a connected app, the user is offered a three-state choice per action type, allow once, always allow, or deny, manageable later from a central settings screen. That is a reusable UX pattern for anyone building agent products that need to earn trust incrementally rather than asking for blanket access up front.
• Payment safety mechanism: at checkout, Muse generates a one-time virtual card number so the real card is never exposed to the merchant or the agent itself. Purchases are covered by purchase protections that Meta bills as a first for AI agents, meaning buyer protection extended specifically to agent-initiated transactions.
• Persistent background execution is the actual differentiator from a chatbot. The example given is asking Muse to monitor daily weather and alert on rain, running unattended and reporting back rather than only on demand.
• Monetization: a free tier with a usage cap and a paid subscription to raise the limit, standard freemium agent pricing, with no price disclosed on the page.
• Credential manager integration signaled: 1Password integration is listed as coming soon, suggesting password-manager-mediated auth to third-party sites is becoming an expected pattern for consumer agents, rather than agents directly handling or storing credentials.