Meta’s Muse took the idea behind OpenClaw, the viral DIY open-source agent, and put it in front of millions who have never used a terminal before.
Jason Aten installed Meta’s Muse agent on his iPhone and on a Mac mini he keeps for testing AI tools. Within a day, the Inc. columnist wrote, Muse was pitching him story ideas drawn from texts he had sent his podcast co-host. He says he had never given it access to his messages.
Asked how it knew, Muse said it had read the banners of incoming messages. Aten went digging. By his account, it had synced about 187,000 lines from his Mac’s Messages database, with Full Disk Access switched off.
Meta says Muse cannot read Messages without several separate opt-ins. Public reporting has not settled who is right. Meta’s own help page carries a line that fits either version: “Your Muse can make mistakes or take unexpected actions.”
That sentence is the manual in miniature. Muse, which launched on September 8, 2026, gets things done rather than answering questions. It can open a browser and fill in forms for you, and keeps going even after you close the app, returning only when something changes or when it needs your approval.
The box in the cloud
Meta’s safety case is architectural. Each user’s Muse runs in a dedicated virtual machine in Meta’s cloud. A second agent, the Sentinel, sits on the same machine, walled off from Muse, and nothing reaches the internet without its approval. Credentials sit in separate storage and, in Meta’s design, are swapped in at the network boundary so the agent never holds them.
The weak point was the user’s own Mac. On September 21, Patrick Wardle of the Objective-See Foundation disclosed that the Muse Mac app kept an undocumented setting, endo_voyager_dictation_endpoint, naming the server that received dictated audio. Any process running under the user’s account could rewrite it, capture the token that controls the agent, and inherit the permissions the user had granted.
Meta shipped a hotfix removing the setting shortly after midnight, Gizmodo reported; David Singleton of Meta Superintelligence Labs (MSL) called it a local privilege escalation, since an attacker needed code on the Mac first.
That closed the hole Wardle found. Aten’s complaint, which Meta disputes, stayed open.
| The Many Muses of AI | ||
| Name | Who built it | What it is |
| Muse | Meta Superintelligence Labs (MSL) | Personal AI agent |
| Muse Spark (1.1, 1.2, 1.3) | MSL | Meta’s model family that powers the Muse agent |
| Muse Code | MSL | Terminal coding agent |
| Muse Wonder/Wonder Full | MSL | Meta’s first frontier models built for agents. Meta says they will soon come to Muse too |
| Muse Charm | Meta | Palm-sized device for using the Muse agent |
| Muse (WHAM) | Microsoft Research with Xbox’s Ninja Theory | A generative AI model that can produce game visuals and controller actions |
The lobster in the machine
The next day brought a concession of a different kind. Users had noticed that Muse’s workspace reused OpenClaw’s file names, down to a near-identical Soul.md, the plain-text file that sets an agent’s personality and limits. OpenClaw, an open-source, local-first AI agent platform featuring a lobster mascot, went viral in January 2026.
On September 22, Nat Friedman, head of product at Meta Superintelligence Labs, answered a viral thread on X. Muse, he wrote, was built from scratch but “definitely heavily inspired as a product by OpenClaw.” As for the files, he said, “Peter got those things exactly right.”
‘Peter’ is Peter Steinberger, the Austrian developer who released OpenClaw in November 2025.
Friedman also explained how it started. After he used OpenClaw in January 2026, he ended up buying hundreds of Mac minis for the MSL team and, “lots of us fell in love with using OpenClaw (and other personal agents).” Aten’s test machine, the one where he says Muse read his messages, was a Mac mini too.
Mark Zuckerberg has said Meta expects to “profit by taking a small fee from transactions”.
Muse, then, is OpenClaw moved out of the passion-driven user’s home, and into the commission-driven Meta’s data centre.
Meta is not alone
On October 21, Anthropic opened a waitlist for Claude Duet, an agent that works on its own computer in the cloud and asks before it sends a message or makes a payment. OpenAI launched its own always-on agent, Dots, a few weeks prior to that.
| Muse vs OpenClaw: Ready-Made or DIY? | ||
| Muse | OpenClaw | |
| Who makes it | Meta Superintelligence Labs | Peter Steinberger, who joined OpenAI in February 2026; the project is now stewarded by the non-profit OpenClaw Foundation (since July 8, 2026) |
| Where it runs | A dedicated virtual machine per user in Meta’s cloud (“Muse Secure VM”) | Hardware the owner controls: laptop, home server or VPS |
| Licence | Proprietary | MIT open source |
| Safety model | A separate Sentinel agent on the same VM must approve all outbound traffic; Muse asks before sensitive actions; it keeps an audit trail | Configured by the owner; OpenClaw 2.0 ships with the sandbox off and secrets unencrypted at rest (The Register) |
| Your data | Meta trains on interactions by default, with an opt-out; data not shared with ad systems; encrypted ‘Confidential VM’ promised later in 2026 | Files stay with the owner; prompts still go to the chosen model provider |
| Price | Free tier; Power $20 a month (500M tokens a week); Maximum $100 a month (3B tokens a week) | Free software; the owner pays for hosting and model use |
| India (as of Oct. 15, 2026) | Not available | Usable by anyone who installs it |
| Built for | Mainstream consumers who never touch a terminal | Technically confident users willing to own the risk |
How do I get started?
As of October 15, Muse was live in the US and Canada, with no date for India. These tips hold for any agent that holds your logins.
1. Audit before you ask. Muse works through connectors such as email and calendar, so open Settings, then Connectors, before the first task. Some can be set to read-only, so Muse can see your calendar but not send invites to your in-laws for the office Diwali party.
2. Give it goals with a stop line. Muse drafts a plan and pushes on unattended, so name the point where it must stop and show you, such as before it pays anyone. By default, it asks before sensitive actions like sending email, so leave that on. Read the plan before a long task runs.
3. Edit what it remembers. Muse keeps its picture of you in plain files you can open and change: Memory.md for what it has learned, Soul.md for its personality. Read Memory.md after a week and tell Muse to forget anything you do not want acted on. Deleting a chat may not delete what the agent learned from it.
4. Treat home-made tools as untrusted. Muse can build custom connectors when a service has none, and Meta’s help page says it does not review them.
5. Lock down the desktop. The Mac app is where Muse meets your local files, and where its one confirmed flaw sat, so grant macOS permissions sparingly. Windows is browser-only for now.
| Meta has a Sentinel for the internet. For your agent’s memory file, the only sentinel is you. |
Bonus tip. Turn off training if you plan to use Muse on sensitive or proprietary data. Meta trains on Muse interactions unless you opt out under Data controls.
| In Muse’s first fortnight on Earth, a security researcher showed how to make it work for somebody else. |
What’s next?
Meta’s next step points somewhere harder to inspect. Muse Wonder, announced October 12, brings what Meta calls Active Memory, which carries what matters across conversations, and will begin powering Muse, starting with subscribers.
Add the custom connectors Muse already builds, and the memory file stops being a page you audit once. It becomes something the agent keeps rewriting, beside tools no one at Meta has reviewed. What you check in week one may not be the agent you have in month six.
Right now, somewhere in Meta’s cloud, Memory.md is getting longer. Its owner can open it any time; Aten found his problem by looking.
Dilin Anand is Senior Vice President at EFY.
