Meta’s Muse: Two Docs, One Talks Risks, The Other Keeps Them Quiet

On September 8 Meta rolled out Muse, an AI‑powered assistant that can fire up a browser, fill out forms and even check out using Stripe. The company says it lives inside a “Muse Secure VM,” a dedicated virtual machine that stores both the agent and your data. For now it’s limited to the U.S., reachable via WhatsApp, the Muse app, and (soon) AI‑glasses.

That’s the headline‑grabber. The deeper story is a little messier, and it shows up only if you dig past the press release.

Meta put out two documents on the same day. One is a consumer‑focused announcement on their newsroom site, written to make you feel safe and excited. The other is a technical post titled “How We Built Safety Into Muse,” published by Meta Superintelligence Labs for engineers and security researchers.

When we line up the two and count the words, the contrast is stark. The consumer piece – roughly six thousand characters – never mentions words like “risk,” “attack,” “attacker,” “mistake,” “untrusted,” or “prompt injection.” Not a single time.

Flip to the engineering post, and those same buzzwords pop up thirty‑nine times. The engineers open with a blunt admission: “Any agent like this will still make mistakes, and it will sometimes be attacked via the data it reads.” They go on to explain that Muse is built to assume it may be under attack, limiting any damage that could occur.

They even put money on the table – up to $300 000 for security reports, with as much as $130 000 for successful prompt‑injection exploits that affect a single user. It’s one of those rare moments where a tech giant basically says, “Hey, we might get hacked. If you break us, we’ll pay you.”

Why the discrepancy? The two documents are telling different stories. The press release paints safety as a finished feature: “first‑of‑its‑kind privacy, safety, and security protections engineered into it that no other agent provides.” It also promises that “no one sees your passwords or payment methods” and that “Muse checks with you before any sensitive action.”

That’s all true – the engineering post backs each claim with concrete mechanisms – but it also adds a crucial detail that the consumer version skips entirely: when Muse browses, it does so as if it were you. In other words, every site you ask Muse to visit sees a normal human visitor, records the visit, and can retarget you with ads.

“When Muse browses the internet, it will appear as your activity, so if you ask Muse to buy a shirt from a clothing designer’s website, that designer might use your visit to show you an ad on Instagram,” the engineering post says. It’s not a flaw; it’s a design choice. But it matters, because it means your browsing history – even the bits generated by an AI – can end up in the hands of advertisers.

Beyond that, the post introduces the notion of “connectors.” For services Meta already has a relationship with, Muse doesn’t even open a browser – it talks directly to the API. For everything else, it spins up a real, up‑to‑date Chromium‑based browser inside the secure VM. That’s why you’ll see a regular user agent string and a standard set of cookies on third‑party sites.

What does this tell us about the broader AI‑browsing landscape? In less than two years we’ve seen three distinct shapes for agentic browsing:

• A dedicated AI browser you download – OpenAI’s Atlas, launched in October 2025, disappeared by August 2026, only to be re‑branded into ChatGPT for browser‑based work.
• An AI extension that lives inside your existing browser – Google’s Gemini or Anthropic’s Claude plugging into Chrome.
• A self‑contained AI that lives on the provider’s hardware and you talk to it – Meta’s Muse.

Personally, I’ve tried a handful of these tools, and I’ve never seen anyone make one the core way they get things done. The web UI is built for human eyes, not for a machine trying to interpret clicks and text fields. That makes the “browser‑inside‑a‑VM” approach feel like the most pragmatic – you let the AI do the heavy lifting, but you keep the interaction sandboxed.

Still, putting Muse on Meta’s servers raises valid questions about authentication and identity. If the virtual machine logs into your accounts, who’s really in control? The engineering post acknowledges that risk, and the bounty program is a way of saying, “Help us keep it locked down.”

Bottom line: If you only skim the press release, you’ll walk away thinking Muse is a perfectly safe, privacy‑first assistant. Dig a little deeper, read the engineering post, and you’ll discover a more nuanced picture – one that admits mistakes, anticipates attacks, and warns that every click can still be tracked by the site you’re visiting.

For anyone considering handing over a slice of their digital life to an AI browser, that contrast is worth a second look.