Meta launched Muse on 8 September 2026. It is an agent that sends your emails, books your travel and pays on your behalf. The question is whether it belongs in a company. The answer is no, and what follows explains why, then what to do instead.

‍

“Unlike other agents, Muse was designed for billions of people around the world, with no prior training. It is immediate and intuitive to use, with no technical skills required. It can handle simple tasks, such as sending emails or booking travel, and take on ambitious projects,” says Meta.

‍

In brief

‍

  • Muse is an agent: it acts inside your apps. It connects to your email, your calendar and your payment methods, then carries out tasks from start to finish.
  • It is not an enterprise product, and Meta does not claim otherwise. The 8 September announcement mentions no professional use.
  • It is not available in France. Launched in the United States only, for over-18s.
  • Your conversations are used to train Meta’s models unless you explicitly opt out. That is the opposite of what a business contract requires.
  • The model behind it is good. Muse Spark 1.3 ranks among the leaders, according to the independent evaluator Artificial Analysis.
  • The issue to deal with in-house: WhatsApp. Muse is built into it, and your teams already use it for work. Governance needs to be decided now.

‍

A personal agent is not an assistant

‍

Muse goes further than most: it sticks with a task over time. According to Blog du Modérateur, it keeps working after the app is closed and comes back to ask for your approval before every sensitive action: a send, a purchase.

Watch out for the name, which refers to four things at Meta. Muse is the agent. Muse Spark is the model that powers it. Muse Code and Muse Image are two other products in the same family, for programming and image generation respectively. When an internal memo mentions “Muse”, always ask which one.

Meta deliberately cites household examples: turning a recipe video into a shopping list, sending invitations, getting a bill reduced. TechCrunch adds heavier tasks: selling a car, booking a complete trip.

‍

What happened on 8 September

‍

Muse is not a surprise. Meta announced the underlying model, Muse Spark, in April 2026, then its first action capabilities in July. The agent was due to launch in the spring. It was pushed back by five months to strengthen security.

The delay did not fix everything. Reuters saw internal messages posted by Meta employees in the week of the launch. Three points stand out. One agent bypassed its own guardrails and exposed private iCloud photos after being asked to identify toys in birthday snapshots. A tester tasked with monitoring ticket listings reported “numerous failure modes that made it unreliable”. Andrew Bosworth, Meta’s chief technology officer, flagged repeated disconnections, sometimes several within a few minutes.

Meta does not deny them. Vishal Shah, vice-president of AI products, explains that the delay made it possible to reach “the minimum threshold needed” for a public release, and adds that “it is impossible to claim there will never be an error”.

‍

Muse timeline: Muse Spark announced in April 2026, agentic capabilities in July, launch postponed, release on 8 September 2026, Muse Confidential VM promised for late 2026, no date for Europe.
Seven months between the model and the agent. Europe appears nowhere in the announced timeline.

‍

The figures, and who measured them

‍

Two things that the launch blurs together need to be separated: the quality of the engine, which a third party has measured, and the safety of the agent, which nobody has verified.

On the engine, the figures are solid. Artificial Analysis, an independent evaluator, puts Muse Spark 1.3 at 61 on its intelligence index, level with GPT-5.6 Sol and Claude Opus 5, behind Claude Fable 5.1, which leads at 66. On Tau3-Bench Banking, an agent test in a banking context, it comes first in the panel tested with 47%. It is Meta’s first frontier model since Llama 4 Maverick in April 2025, and the first the company has not released with open weights. One caveat: Artificial Analysis had early access, provided by Meta, to the most powerful variant.

On the agent, however, there is nothing to measure. Meta describes its architecture: a dedicated virtual machine per user, plus a monitoring agent called Sentinel that approves every outbound connection to the internet. And the company claims it offers “protections that no other agent provides”. No third party has audited it. No success rate on real tasks has been published, by Meta or by anyone else.

‍

Table contrasting Muse Spark 1.3 results measured by Artificial Analysis (index 61, Terminal-Bench 85%, Tau3-Bench Banking 47%) with Meta’s claims not verified by a third party.
On the left, what an independent evaluator measured. On the right, what Meta claims without external checks.

‍

To understand. An engine put through a test bench and a lock whose manufacturer vouches for its own strength are not the same kind of evidence. You can compare engines on figures. For the lock, you only have the seller’s word.

‍

Is Muse an enterprise product?

‍

No. The product was not designed for that use. Measured against the eight basic requirements of a business software purchase, Muse meets one.

‍

Grid comparing eight enterprise requirements with what Muse offers as of 10 September 2026: EU availability, data processing agreement, admin console, exclusion from training, data isolation, audit log, spending limits, reliability commitment.
Only one requirement out of eight is met: technical isolation of data.

‍

Three of these lines carry more weight than the others. First, training: according to Meta’s announcement, users “can opt out” of having their interactions used to train the models. Opt out, then, after the fact. That is the opposite of a business contract, where exclusion is the default.

Second, internal access. David Singleton, vice-president of engineering, admitted to Le Monde Informatique that company policy forbids employees from accessing users’ virtual machines, but that such access remains technically possible. A virtual machine encrypted with a key held only by the user, the Muse Confidential VM, is promised for late 2026. It does not exist yet.

Finally, there is no admin console. Nobody in your organisation can see what Muse does on behalf of your staff, or cap its spending. If what you need is a governed business agent, that is a different project altogether: we cover it in our AI agent development offer, with hosting in France.

‍

What it changes, role by role

‍

Senior management and executive assistants

Today, an executive assistant spends one to two hours a day on coordination tasks: scheduling meetings, booking travel, chasing quotes. That is exactly what Muse targets.

What the tool adds: it chains the steps together without coming back to you at each one. How to start, if your executives travel to the United States: on a single personal, non-work calendar, for non-confidential scheduling. What it costs: an executive’s calendar is a map of the company’s strategy. Connecting it to a consumer service exposes the list of people you deal with.

‍

Procurement and finance

An agent that pays changes the nature of internal control. Muse makes purchases via Stripe’s Link, with Shop Pay announced.

What the tool adds: comparison and ordering in a single instruction. How to start: don’t. There is no configurable cap, no managerial approval and no exportable log. What it costs: spending committed by an agent, on a personal account, outside any approval process, cannot be clawed back after the fact by your financial controllers.

‍

Information security

This is the department for which Muse is already an issue, even without any roll-out. Muse is accessible from WhatsApp, and WhatsApp is used for work in many French companies.

What the tool adds, here, is a risk: an employee travelling in the United States can connect their work email to Muse in a few minutes, without going through you. How to start: map how WhatsApp is used internally and decide in writing. What it costs: doing nothing costs more, because the incident will be discovered afterwards.

‍

Five steps to frame agentic AI in your organisation

‍

Muse may never reach Europe, but other cross-app agents will. These five steps apply to any of them.

  1. Write the rule before the tool. One page: which agents are allowed, on which data, with what budget. Without this document, every employee decides alone.
  2. Rank your connections by sensitivity. Email, calendar, payments, HR files, customer data. A consumer agent touches none of them. A governed agent, only the ones you name.
  3. Set the threshold for human approval. Any irreversible action (external send, payment, deletion, publication) remains subject to human approval, whatever convenience is promised.
  4. Insist on the log. No agent in production without an exportable record of what it did, when, and on what instruction. It is the prerequisite for an audit, and for explaining things to a customer.
  5. Test it on a low-stakes task. Pick a measurable, non-critical process, compare it with the current method over four weeks, then decide on the figures. Our Agent-a-thons are designed precisely to do this sorting with the teams involved.

‍

Key takeaways

‍

  • Do not deploy Muse in your company. It is neither available in France nor designed for professional use.
  • But do not ignore it. Its integration with WhatsApp makes it a workaround risk that needs managing.
  • Check who measured what. The model has been evaluated by a third party; the agent’s safety has not.
  • Treat training as a contract clause. On by default at Meta; excluded by default in a business contract.
  • Write your rule now. It will serve for the agent you actually choose.
  • Keep an eye on late 2026. The Muse Confidential VM, if it is delivered and audited by a third party, will reopen the question.

‍

‍

Sources