What Is the Recently Popular Muse? #AI - Qiita

Introduction

Muse is a personal AI agent provided by Meta (formerly Facebook). The service launched on September 8, 2026, and is available in the United States, Canada, Japan, and Singapore.
As officially introduced, Muse is designed to align with the communication style users use in their daily lives. As a result, one of its major features is that it can be used as naturally as if you were talking to another person.
For tasks that take a long time, Muse continues working even after the user closes the app, and sends notifications when circumstances change or when approval is required, such as sending an email or purchasing a product. Muse also remembers things that are important to the user and can make suggestions or take action based on past conversations.
https://about.fb.com/ja/news/2026/10/muse-personal-ai-agent-launches-in-japan/

What Can It Do?

After actually trying it out, I felt that I could entrust almost every everyday task to it. The main tasks I delegated to Muse were the following.

• Streamlining Shopping
• Setting the Direction of OSS Activities
• Creating a Daily Schedule
• Meal Management
  Getting started is also very easy. As described below, candidate tasks are listed in the “Ideas” tab. Select one that interests you, and Muse will begin working based on its details. This convenience was one of the things I enjoyed while using it.

Main Chat and Side Chat

Muse has two types of chat: “Main Chat” and “Side Chat.”
Roughly speaking, Main Chat is the central hub, while Side Chats are dedicated chats for individual tasks or topics.
Separating side chats by topic or task makes it easier to follow the flow of a conversation. You can also check the contents of side chats from Main Chat, allowing you to use the two appropriately and comfortably.

Ideas Tab

The Ideas tab displays cards in which Muse proposes ideas such as, “Muse can do this for you, too.” Most of the cards are created by Muse based on your everyday conversations and goals, and when you first start using it, starter cards are also displayed.
When you select a card that interests you, Muse begins working according to its contents. On iPhone, tapping a card first opens the details screen, allowing you to review the content and decide whether to proceed.
In other words, the Ideas tab is a place where Muse can propose ideas to the user. This kind of setup is uncommon in other services, and it is a feature I particularly like.

Muse as a Proactive Agent

Muse does more than simply carry out tasks as instructed. It periodically checks the user’s goals and circumstances, and proactively researches information in advance. It then determines whether what it has found is “worth telling you now” before notifying the relevant side chat.
For example, in OSS activities, Muse not only found recommended issues among the projects I wanted to contribute to, but also re-verified the initial list of issues in the background and corrected it when it found an error in the number of issues presented. Because the information kept being updated without me having to ask again, it was a tremendous help.
Thanks to this, I no longer have to worry about forgetting things I had intended to do, and the time I spend researching has decreased substantially. I also feel that I can now notice changes in my own circumstances more quickly.

Technical Background

AI agents that act on their own without waiting for instructions are called proactive agents. This setup is thought to combine technologies such as background execution, which runs jobs asynchronously in the background; scheduled execution, which launches processing at set times; and event-driven triggers, which initiate actions in response to specific events.
In more recent terminology, this is part of the broader field of Agentic AI. In particular, the type that continues to operate in the background at all times is also sometimes called an ambient agent.

Muse Security

Because Muse is an agent that carries out tasks on your behalf, it is understandable to be concerned that it might “reply to emails or make payments without permission.”
On this point, Meta explained on its official blog that it assumes “agents can make mistakes and can also be targeted by attacks,” and that it is designed to minimize damage in the event of a problem.

Here, I’ll introduce three points that I found particularly important.

1. Isolated in a dedicated VM for each user

Muse runs on a dedicated computer in the cloud (VM) provided for each user. Data and authentication information for connected services are also stored within this VM rather than on Meta’s central servers.

Furthermore, the inside of the VM is separated into the “runtime cell,” where the agent operates, and “host-side services,” which handle security-critical processes. The area where the agent operates is isolated within a container, and its permissions are strictly restricted, so even if the agent were taken over, it would not be able to interfere with critical mechanisms.

2. Only “Sentinel” Is Allowed to Execute

When Muse performs actions such as sending emails or accessing external websites, Muse itself only “proposes” the action. What ultimately determines whether it may be executed is a mechanism called Sentinel, which operates separately from the agent, and Muse cannot override its decision.

For operations that require confirmation, Sentinel halts the process and directly displays an approval dialog on the app’s screen. This approval does not go through a conversation with Muse, so the agent cannot falsely claim that an operation has been “approved” during the conversation.
However, read-only operations and low-risk operations proceed without confirmation, so not every action requires approval.

The scope of approval can also be selected from options such as “only once,” “only for the duration of this task,” or “time-limited,” allowing you to proceed cautiously at first and gradually delegate more as you become accustomed to it.

3. Agents Never See Real Passwords or Tokens

Tokens and login credentials for integrated services are managed in a dedicated area, and only substitute “dummy tokens” are provided to Muse. The real credentials are substituted in at the network boundary at the moment the communication is approved.

Therefore, even if Muse is subjected to a prompt injection attack from a malicious web page or another source that tries to get it to “reveal the password,” Muse does not know the real credentials in the first place and thus has no way to leak them.
Also, when making purchases, measures are taken to make the information difficult to abuse even if it is stolen, such as issuing disposable card numbers limited to a specific merchant, amount, and expiration date.

Summary

• Muse is a personal AI agent provided by Meta. You can converse with it in a way that feels close to everyday communication while entrusting it with tasks.
• You can delegate a wide range of everyday tasks, including shopping, replying to emails, creating schedules, and managing meals.
• You can get an overview of everything in the “Main Chat” while separating conversations by task or topic in the “Side Chat,” making it easier to follow the flow.
• In the “Ideas” tab, Muse suggests ideas on its own, so you can easily start working simply by selecting one.
• Rather than merely waiting for instructions, it acts as a “proactive agent,” regularly checking goals and circumstances, investigating ahead on its own, and, if it finds an error, re-verifying and correcting it itself.
• In terms of security, multilayered measures are in place, including isolation in a dedicated VM for each user, a permission-based execution system using Sentinel, and a mechanism that prevents agents from seeing real authentication information.
• Important operations are executed only after approval, which provides reassurance. However, prompt injection remains an unresolved problem across the industry as a whole, so it is best to use the system while carefully checking the contents of the approval screen.