A terminal, a file system and a browser for Muse

Meta announced Muse Agent on September 8. It is a personal AI agent that acts on a user’s behalf, and it runs on Muse Spark 1.3, the model Meta trained for long-horizon agentic workflows and coding. The agent also gets a machine of its own to work on.

“Muse has its own computer, with a file system and a terminal, so it can write its own code and build the tools a task needs,” Meta says in the announcement text shared on Threads. It also gets a full web browser. With it the agent can search, move through sites, fill out forms and complete transactions such as bookings and purchases. The post says Muse is on iOS and Android but appears to be geo-restricted to certain regions. Independent coverage had earlier described Meta testing Muse in an invite-only iPhone app.

That computer is a virtual machine in Meta’s cloud, and each user’s agent gets a separate one. People work with it through a chat interface and can set the agent’s name, avatar and communication style. While it works, they can watch its browser. Wired described Muse as built to compete with OpenClaw and Instinct and reported that Meta said Muse automates digital tasks in a secure cloud environment, with security and privacy “built into it”. The setup matches the Project Hatch materials Testing Catalog reviewed before launch, which described a dedicated cloud environment for each agent.

Hatch is Muse’s internal nickname, according to Futurism. The outlet reports that the agents run on KVM, the virtualization layer built into the Linux kernel, and that these machines are supposed to be isolated from the rest of Meta’s infrastructure. An internal post by Meta executives from barely two weeks before launch described engineers rushing to fix a “sudden spike in reported KVM escapes”. In a VM escape, code inside a guest machine breaks out into the host. One of these flaws could have let an attacker with an ordinary Muse account reach sensitive data in Meta databases. The issue reached Zuckerberg’s desk, and a Meta source called the fixes “half-baked protections being rushed out to enable the launch.”

Meta’s bug bounty pays $300,000 for a vulnerability that causes a KVM escape. “Because a Muse agent holds a user’s most sensitive data and can act on their behalf, we treat compromise of that boundary as a first-class security risk,” the bounty page says. Futurism quotes security researcher Patrick Wardle, who said Hatch “makes the virtualization boundary a production security boundary.”