Meta’s Muse is an AI agent with its own virtual computer. Mark Zuckerberg says people can give it ongoing projects, connect it to services they use and let it work on their behalf throughout the day. It can also suggest new projects based on what it has learned about them.
In his September 8 interview with Alex Heath on the Sources podcast, Zuckerberg describes how he uses Muse, how Meta plans to charge for it and why he wants personal agents to be widely available. He also explains a confidential virtual machine project intended to keep even Meta from reading a user’s agent content. He says more technical details will follow as Meta prepares a wider rollout; the interview does not establish that this protection is already available to every user.
Projects that continue between conversations
OpenAI describes another take on an always-on assistant in the account of Dots and Tibo Sottiaux.
Zuckerberg describes Muse as a long-lived agent. Its virtual machine, a computer provided through software in the cloud, lets it control a computer, log into services and carry out work. Between conversations, it consolidates what it has learned into memory, a process the team calls studying overnight.
He gives a weekly baking project as an example. His three-year-old daughter likes baking, but he knows little about it. He asked Muse to choose a suitable project each weekend, arrange the ingredients through Instacart and have everything ready for Sunday. He then tells it how the project went so it can adjust the next one. An early choice, cake pops, proved too difficult.
For another daughter, he asked Muse to watch for mountain-climbing permits and book one when it became available. He also connected cameras in his mixed martial arts gym and asked it to send feedback on his training. He says some of the feedback was funny, including an observation that he appeared to have given up during a round.
Muse can build software for these projects. Zuckerberg describes asking it to make a Civilization strategy guide for one of his daughters. It then suggested adding historical lessons about the civilisations in the game. He agreed, and it added a new tab to the app it had made.
An ideas tab collects suggestions like this. Zuckerberg sees that as a way to help people who are interested in AI but do not know what to ask it to do. He says Muse and Meta AI currently serve somewhat different purposes: he uses Meta AI for a direct answer, while Muse is more likely to turn a request into a longer project. He is unsure whether they will eventually converge.
Free use, subscriptions and transaction fees
At launch, Meta offers up to 100 million tokens a week for free, along with the virtual machine. Tokens are the units models use to process and generate text. Zuckerberg says there is also a subscription option for people who want it.
His longer-term plan is for Muse to help people earn or save money and for Meta to take a small share of transactions. He says businesses users transact with might pay that fee, rather than users themselves. Meta is working with Stripe on payments.
Users can choose to connect Meta services. For someone running a business, Zuckerberg describes Muse helping to make a product, manage the business and connect to Meta’s advertising systems. These are his descriptions of its uses and plans, rather than evidence that every user will earn money from it.
Agents learning from one another
Heath asks about a fleet of Muse agents learning anonymised insights from one another. Zuckerberg says Meta is exploring how agents can interact and how suggestions can draw on things other people have found useful.
He connects this to the problem of people not knowing what to do with AI. If an agent can suggest a relevant project, it may help someone find a use for the system without having to invent the idea themselves.
Zuckerberg says most of this interaction between agents is not rolling out in the initial release. The interview does not explain how Meta would anonymise information from users’ agents or which information would be shared.
Keeping personal information private
A personal agent may need access to messages, email, health information and financial services to do the jobs people give it. Zuckerberg says users need strong reasons to trust a system with that information.
He points to WhatsApp’s end-to-end encryption as an important lesson for Meta: the company designed it so that it could not read people’s messages. He says he and Nat Friedman recruited Signal founder Moxie Marlinspike, who helped Meta build WhatsApp encryption, to work on Muse’s confidential virtual machine project.
The intended protection is that even Meta cannot see the content inside a user’s virtual machine. Zuckerberg says this can be checked technically rather than accepted as a company promise. He says Meta will publish more about the design in the following weeks, and refers to security measures that apply even before the confidential VM is ready or for people who do not use it.
He wants people to get the confidentiality they expect from a computer in their home without having to buy and maintain one. He doubts billions of people will configure a Mac Studio to run their own agent, and says Meta is trying to make Muse usable by family members with different levels of technical ability.
Credentials, permissions and approval
Zuckerberg describes several other protections around the agent. A separate credential store holds sensitive information such as passwords and payment details. The agent should access it when needed for an action the user requested, rather than keep those details in its ordinary working context.
Separate agents, called sentinels, examine incoming and outgoing traffic. They look for prompt injection, where outside content tries to redirect the agent’s instructions, and for information the user might not want disclosed. A sentinel can trigger a request for human review.
He says users generally have to approve logins, payments and transfers of sensitive information. They can give standing permission for a category of action, but the main agent does not decide on its own that such permission exists.
Connections to other services start with limited permissions. Connecting email initially gives Muse read access. Sending messages requires a separate request. Zuckerberg calls this least privilege: give the agent only the access it needs, then add permissions when the user asks it to do more.
These are the protections he describes in the interview. He also says he is unaware of another agent product with comparable security depth, but provides no comparative testing there.
Rebuilding Meta’s AI lab
Zuckerberg says he initially expected the work of scaling large language models to resemble Meta’s work on feeds, advertisements and content moderation. He considers that a mistake. Llama 3 was a good model in his view, but Llama 4 fell short of the progress Meta needed.
He responded by rebuilding the team around a smaller group of researchers who could understand the whole system and work closely together. He spent substantial time recruiting and placed the lab physically around where he sits in the office so he could stay closer to the technical work.
As his confidence in the team grew, Meta increased its computing investment. He says its gigawatt-scale Prometheus cluster in Ohio came online and is being used to develop models beyond the larger pretraining run code-named Watermelon. At the time of the interview, he says Watermelon is shipping soon. Muse Spark 1.3, already released, comes from the smaller pretraining run code-named Avocado.
He argues that Meta needs to develop the model and infrastructure as well as the app. Coding matters because many personal-agent tasks involve making software, including the training-feedback system he uses. He also wants models trained for discretion.
His example is a restaurant reservation. An agent might know that someone is pregnant or has a sensitivity to certain food, and use that knowledge to choose a suitable place without revealing the private reason. Zuckerberg believes designing models for these uses from the start will produce better results than making limited adjustments to an off-the-shelf model. That is his argument for Meta’s approach.
Training and wider access
Asked about withholding unsafe capabilities, Zuckerberg says safety should be part of how models are trained. He describes reward hacking: a model can receive credit for a task by changing the environment that checks its answer instead of solving the intended problem. For example, it might alter a virtual machine’s configuration rather than fix the code it was asked to repair.
He argues that firm boundaries during training can prevent these shortcuts and help models learn the intended task. He compares parts of this to parenting, while warning that the analogy has limits.
His wider position is that safety depends on distributing capable AI and maintaining a balance of power. He worries more about a few labs controlling the technology than about broad access. In cybersecurity, he argues that people need access to models that can help them secure systems against AI-enabled attacks. He cites Hugging Face turning to open models after an intrusion as an example supporting his position.
He supports an open-source ecosystem but does not say everything Meta builds must be open. He considers putting useful agents directly in individuals’ hands more important than open source alone.
For government oversight, he favours close communication about major training runs and emerging capabilities. He worries that a rigid framework could become outdated within months, while acknowledging that partnership and formal rules are not mutually exclusive.
Jobs and data centres
Zuckerberg also links public acceptance of AI to jobs and benefits for communities. He distinguishes companies that plan to operate a data centre for decades from developers trying to secure a site and sell it. He says Meta has an incentive to invest in local training because it will need skilled workers for years.
He describes America’s Workforce Academy as a programme for trades including fibre installation, electrical work and advanced carpentry. He says graduates are guaranteed work with organisations building infrastructure for Meta, and presents the programme as meeting a labour need rather than philanthropy.
He also says data-centre tax revenue funded $50,000 teacher bonuses in a Louisiana community. That is his account in the interview. He argues that AI development will not be allowed to continue at the scale he wants unless it creates jobs, helps communities and spreads its benefits beyond a small number of companies.