Meta Muse Tutorial: Set Up the Agent, Delegate One Real Task, and Verify the Work

What Is Meta Muse, and What Can It Actually Do?

Meta Muse is a personal AI agent that completes tasks on its own cloud computer rather than answering questions in a chat window. Meta launched it on September 8, 2026, and our Meta Muse explainer offers a full tour. Here is only what you need to know to follow the steps below.

Muse runs on Muse Spark, the model family from Meta Superintelligence Labs. The newest Spark release is Muse Spark 1.3 from September 2, which Meta ships in Muse Code and the Meta Model API; Meta has not said which Spark version the agent itself uses. As of October 20, 2026, Meta's newest models are Muse Wonder and Muse Wonder Full, released October 12 through the Meta Model API and Muse Code, and Meta says Muse Wonder "will soon power experiences in Muse," rolling out to subscribers first.

Three facts about how it runs matter for everything that follows:

• Muse lives inside Muse Secure VM, a virtual machine (VM), or private cloud computer, dedicated to each user and holding both the agent and your data.
• It has its own Chromium-based browser inside that machine, per Meta's safety write-up, and you can open a window to watch it work.
• It keeps working after you close the app, which is the whole point and also the main risk.

You can reach the same agent from 4 surfaces: 

• The Muse app on iPhone, Android, and iPad
• The web at muse.ai
• WhatsApp
• A Mac app that shipped on September 18 and can read files plus iMessage, Notes, Reminders, email, and Calendar on your computer. 

Meta said at Connect 2026 that Muse is coming to Meta's AI glasses "in the coming months" and that Muse will get its own email address. Meta's posts don't give a firm date for either, and nothing in this guide depends on those. As of October 20, 2026, a native Windows app is also announced but not released: Microsoft said at its October 7 Windows and Surface event that Muse is "coming soon" to Windows, with no date.

Agent vs. chatbot: what changes when software acts

• A chatbot returns advice you then act on. An agent completes the steps and hands back work that has to be checked.
• With a chatbot, the worst outcome is a wrong answer. With an agent, the worst outcome is an accidentally sent email or a deleted folder.
• The architecture behind this, from planning to tool calls to memory, is explained in our LLM Agents article.
• The skill that matters is scoping and verification, not prompting. That is the through-line for the rest of this guide.

What you need before you start

The free tier covers every task in this guide. Meta sells 2 paid plans, Power at $20 per month and Maximum at $100 per month, and both are larger weekly allowances of "Muse tokens" (500M and 3B per week) rather than feature unlocks. As of October 20, 2026, Meta has also said the Muse Wonder model will reach the Muse app for paying subscribers first, so the plans may soon differ by model as well as by allowance.

Meta's help pages describe the free tier only as "available for free with a usage limit." The 100M tokens per week figure you will see quoted traces to Mark Zuckerberg's launch-day post on X, not to Meta's documentation, so treat it as a statement of intent rather than a published quota. You can see where you stand under Settings > Usage (Menu at the top left on mobile, bottom left on the web), and Muse will also tell you in chat.

The rest of the entry requirements, as of October 26, 2026:

• Muse is available in the US and, since September 18, in Canada, where it launched on iOS and the web first, with Android following shortly after. Meta's subscription page says only that Muse is "not available in all locations yet."
• You must be 18 or over. The App Store rating is 18+, and Meta's subscription terms require the age of majority.
• No invite code is needed in the US or Canada. The closed beta before September 8 used invite codes, and that gating is gone.

Step 1: Setting Up Muse and Connecting Your First App

Setting up Muse safely means choosing permissions first and connecting apps second, and most guides get that order backward. A connector is Meta's name for a linked account such as Gmail, and a permission setting decides whether Muse acts or asks when a connector gives it something to act on. 

Muse offers 2 settings, "Always ask" and "Ask for some actions," and the difference is what each one lets happen without you. Meta documents both, and "Ask for some actions" is the default.

Setting permissions before you connect anything

Open Settings > Permissions and set both the Connectors default and the Web access default to "Always ask" before anything is connected. An agent with live connectors and loose permissions can act before you have any feel for how it behaves. Under the default, Muse decides for itself which reads count as "important," and you would rather learn where it draws that line from an approval card than from the Activity log after the fact.

The table compares the 2 settings in the 2 places they apply: connectors (actions in apps like Gmail or Calendar) and the web (sites Muse opens).

"Always ask" is noisier. For your first 3 or 4 tasks, that noise is the training data you need, because each card tells you exactly what Muse wanted to do and why. Loosen it later, one connector at a time, once the cards stop surprising you.

Connecting Gmail or Calendar

Connect exactly 1 account. There are 2 routes, and both end at the same authorization screen.

• In chat, type "Connect my Gmail" and Muse walks you through it. 
• In Settings > Connectors, tap Connect next to Gmail or Google Calendar, read the information screen, and tap Continue to authorize, per Meta's connectors help page.

Read the information screen slowly, because it tells you what you are granting. Connecting email lets Muse search your inbox; Meta states it will not download the whole inbox unless you tell it to. Meta also says many connectors can be limited, so Muse only retrieves data and cannot act, for example, by sending a calendar invite.

The help page does not say which connectors offer that limit, so pick the read-only option if your Gmail or Calendar screen shows it. You can widen access later and disconnect any connector at any time in Settings > Connectors. Meta notes that information Muse already gathered may stay in its memory and chat history after you disconnect.

One thing the screen will not tell you: a read-only Gmail connector is still a full read of your correspondence, filtered only by what Muse searches for. That is fine for an expense audit. It is a different decision for an inbox that holds client contracts or medical results, which is why I would start with a personal Gmail, not a work one.

Finding your way around the app

The app is organized around a few places, and knowing where each one lives saves a lot of tapping. Meta's getting-started page documents the Chat and Library tabs, and Meta's data help page mentions the Goals tab and the memory file.

Two of these earn their place immediately. Side chats keep a multi-step project out of the main thread, and the Assistant icon is the front door to the Activity log, which is where Step 4 happens.

Muse’s main window and side bar with extra options

Step 2: Scoping a Task Muse Can Complete

A task Muse can complete is one that meets 3 conditions, and I find the test more useful than any list of prompts to copy:

1. The task arrives as a document, an email, or a date, because Muse cannot reach something that lives only in your head or in a paper drawer.
2. It needs only a connector you already have.
3. The irreversible step can wait for your tap, because you will likely not be there when Muse gets to it.

The 3-condition test for handing a task to Muse. Any "no" means you keep the task, at least for now. Image by author.

Here is a task that passes: a freelancer wants a spreadsheet of business expenses for the quarter, built from the receipts in Gmail, with duplicates flagged. The receipts arrive as emails, Gmail is the 1 connector already attached, and there is no irreversible step at all because the output is a file. This is the running example for the rest of the guide, and I picked it because the output is checkable against a card statement.

Let’s contrast it with a bad example. "Dispute the duplicate charge with my bank" arrives as a date on a statement, but the bank login needs a two-factor authentication (2FA) code Muse cannot receive, and the dispute itself is the irreversible step, executed inside a session you would have to hand over. Conditions 2 and 3 both fail, and the 2FA wall can’t be fixed by permission settings.

The four parts of a request

A request that works states 4 things: 

• The outcome
• Resources Muse may touch
• Actions it may not take
• The point where it has to stop and ask 

A vague request leaves gaps; Muse fills each gap with a judgment call, and every judgment call is something you did not ask for. Here is the expense audit both ways.

Read the scoped version against the 4 parts. 

• Outcome: the first sentence
• Resources: "only receipts and invoices in my connected Gmail"
• Forbidden actions: 2 explicit lists
• Stop point: the last sentence

Each addition is doing work: "do not open any website" removes the judgment call of clicking a "view receipt" link, and the fixed category list removes the judgment call of inventing categories you will then have to reconcile.

Example task of asking Muse to help me handle flight seat selection

Tasks that look delegable but are not

Three kinds of tasks look delegable and are not, and each maps to a condition in the test.

• Anything behind a 2FA code. Your bank, your tax portal, most employer systems. Slate's reviewer watched Muse fail a CAPTCHA during a flight booking, logged in himself, and then saw Muse get kicked out of the browser, with 30 minutes spent and no booking. A 2FA prompt is the same wall with a harder gate, because Muse cannot receive the code at all.
• Anything where Muse cannot reach the source. Paper receipts, a second email account you never connected, a portal that blocks agents. CNN's reviewer found that Amazon blocked Muse outright and Target required manual checkout, and a suggested prompt promised Muse could negotiate with a Facebook Marketplace seller when it could only draft the message.
• Anything whose output you have no way to verify. "Estimate my quarterly tax" fails this test for most people, because checking the estimate means doing the estimate. The expense sheet passes because a card statement exists.

Step 3: Running the Task and Handling Approvals

Running a task means sending the scoped request, answering the approval cards one at a time, and knowing which of the 3 browser controls to reach for. 

Start a side chat for the expense audit so the run stays in one thread, paste the scoped request, and watch the first card arrive. With "Always ask" set, expect the first card to ask to read your Gmail before Muse has done anything.

When your own expense sheet comes back, these are the errors I would look for first:

• A purchase that shows up twice because Muse read both the order confirmation and the shipping notice
• A refund counted as an expense
• An annual subscription flagged as a monthly duplicate
• A vendor with a generic name dropped into "other" when it belongs in "software”

None of these are exotic, and all of them are exactly the rows Step 4 teaches you to check first.

Now the approval card. Open "See task details" first, every time, because it shows what Muse is about to do before you decide. Then pick from the 5 options, which Meta defines as follows.

"Always allow" is where people lose the thread. It is a standing grant on a connector that survives the task, and it removes the one moment where you would have noticed a request that did not match your intent. 

The narrow case where it is reasonable is a read action on a connector limited to retrieving data, such as reading your calendar, because the worst outcome is that Muse reads more of something it cannot change. For the expense audit, "Allow for this task" on Gmail reads is the right answer, and "Allow once" for anything that surprises you.

Watching and taking control of the browser

Muse browses out of your sight by default, and Meta's browsing help page gives you 3 controls in chat. 

• "Open browser" opens a viewing window so you can watch
• "Take control of the browser" pauses Muse so you can act on the page yourself (for example, to clear a login it cannot pass)
• "Stop the task" ends what it is doing in the browser

Muse going through the task on its own browser to help me pick some seats

Each control is the right move at a different moment:

• Open the browser whenever Muse reaches a site you did not expect (which shouldn’t happen under the scoped request).
• Take control when it is stuck on a login or a CAPTCHA, and you are willing to finish that one step.
• Stop the task when the log shows it doing something you did not ask for, and re-scope rather than argue with it in chat.

Where the output lands

Files land in the Library tab, and reminders land under the Assistant icon's Upcoming section. The expense sheet will appear in the Library as a spreadsheet artifact, and Meta's artifacts help page lists XLSX and CSV among the spreadsheet types Muse works with.

Revise the file instead of starting over. Ask in the same side chat for the change you want, such as "Add a total row at the bottom" or "Move the July 14 Adobe row to software," and Meta says Muse will apply the edits and confirm what changed. Starting a fresh request means a fresh read of your inbox and a fresh set of judgment calls, which is a second run to verify.

Step 4: Verifying the Work in the Activity Log

The Activity log is a chronological record of every action Muse took and every permission you gave, and it is the reason you can trust a file you did not build. Tap the Assistant icon and open the Activity log for the expense run. Then read it with one question in mind: where does what Muse did differ from what I assumed it did?

Two direct checks belong in every verification, and both are questions you type in chat:

1. "List every email you used as a source for the expense sheet, with the subject line and date." Muse should return one source per row, and any row without one is a row to check by hand.
2. "Show me every URL you visited between 2:00 and 2:30 pm today." Meta's help pages state you can ask for visited URLs, and under a request that said "do not open any website," the correct answer is none.

Reading the log for the gap between intent and action

The gap between intent and action shows up as a log line you did not ask for. I would expect it to take one of 3 shapes:

• A search you did not specify, such as a query for a vendor's name to decide its category.
• A site visit, such as opening a "view receipt" link because the email body had no amount.
• A filter Muse chose on its own, such as excluding anything under $5 as noise.

None of these is malicious, and each is a judgment call. The scoped request forbade the first 2, so they are violations to correct in Step 5, while the third tells you the request needs a rule about thresholds. Whichever you find, quote that log line when you re-scope.

Spot-checking an output you cannot fully audit

You cannot re-do 40 rows by hand, so check the 3 rows most likely to be wrong and reconcile 1 total. The rows are the largest amount on the sheet, any row Muse put in "other," and any vendor it flagged as appearing twice in a month. The total is the quarter's sum against your card statement for the same window.

If the 3 rows and the total hold, accept the sheet. When 1 row is wrong, ask Muse to fix it and check 3 more of the same kind. A total that is off by more than 1 or 2 receipts' worth means the run failed, and the next step should be diagnosis.

Step 5: Correcting a Run That Went Wrong

A run that went wrong is diagnosed from the log, because the output only tells you the result was wrong, and the log tells you where. Say the sheet comes back with 14 rows when you know the quarter had close to 40 receipts. Open the Activity log and look for 1 of 3 causes.

• Wrong scope. The log shows Gmail searches for "receipt" and nothing else. Your biggest vendors send "Your order" and "Invoice" emails, and the request never said so.
• Missing connector. Half your receipts go to a second Gmail address you never connected, so Muse could not see them and did not know they existed.
• A permission that blocked a step. The log shows a browser request you denied when Muse tried to open a "view receipt" link, and it skipped those rows without saying so.

Real runs fail this way too. Slate's reviewer asked for a calendar event at "10 a.m. tomorrow" and got one 2 hours and 40 minutes in the past, the kind of error an absolute date and time zone in the request leaves no room for. CNN's reviewer got 2 restaurants that had been closed for years, a stale-source failure that a line like "confirm each place is open today" would have caught.

Here is the re-scoped expense request, with only the lines that changed. The rest of the request is the scoped version from Step 2.

The second run should come back with more rows and a "needs manual check" list, and the check list is the point. A run that reports what it could not do is a run you can finish by hand in 10 minutes. A run that silently skips is one you cannot trust.

The loop workflow

That is the full loop: scope the task, run it one approval card at a time, verify it in the Activity log, and correct it from the log line where intent and action parted. Then scope again with what you learned.

The loop this guide teaches: scope, run, verify, correct, then scope again with what you learned. Image by author.

Teaching Muse your preferences so the fix sticks

Muse turns your corrections into memories it carries into later chats: Meta's customization help page suggests feedback as short as "too long" or "be more casual," and Muse builds memories partly from the preferences it observes. 

A rule like "only search my email, not my messages" works the same way. After the second run, tell Muse: "From now on, when you build an expense sheet, use these 4 categories, list anything you could not read at the bottom, and never open a link to get an amount."

Then check what it actually remembers, because a memory is a claim about you that Muse will act on. Open the Assistant icon, then Identity > Memory, where Meta exposes the memory file for direct editing, or ask in chat "What do you remember about how I want expense reports formatted?" 

If a memory is wrong or stale, ask Muse to forget it, and confirm in the file that it did.

What Should You Never Delegate to Muse?

Some tasks stay with you no matter how well the last run went. Here is where I draw the line:

• Writes with no undo, such as sending an email or paying for something, without a tap every time
• Banking, health records, and employer accounts, at least for now
• Any task that sends Muse to websites the task doesn’t need

Reads versus writes

A read action, such as searching your inbox, is recoverable: the worst outcome is that Muse saw something. A write action, such as sending an email, may not be recoverable at all. Meta’s own help page says you can ask Muse to undo some actions, but logically, something like a sent email cannot be reversed.

So writes with no undo need a tap every time, no matter how many times the previous tap went fine. The approval card is the only moment you see the action before it happens.

Banking, health, and work accounts

Keep these out of scope until the product has a longer track record, since Muse has only been public since September 8. The connector list won’t stop you. Apple Health already puts health data on it, and the payments help page states that you are responsible for every transaction Muse makes on your behalf.

Work accounts have their own route. Meta added Muse for Small Business on September 29, with business connectors such as QuickBooks, Slack, and Shopify. If you want Muse on a company account, start there with your employer’s sign-off rather than with the personal agent you set up here.

Three ways an agent’s guardrails fail

Each of these has already happened to a real agent, and each has a defense on your side.

Two caveats on the Yue story. It is a self-report with no independent review, and OpenClaw has a very different permission model from Muse. Muse routes permission checks through Sentinel, a separate agent outside the model that Meta’s safety write-up describes as the sole authority over connector actions and network access.

The lesson transfers anyway: a rule that lives only in the conversation can be lost. On prompt injection, Meta cites classifiers, model training, and limits on what Muse can reach, and Muse Spark 1.3 claims improved resistance. Our OpenClaw security guide covers general agent hardening, and our prompt injection explainer covers the attack itself.

Your monthly privacy check

Each connected app is a standing grant, so review them on a schedule rather than when something goes wrong:

1. Open Settings > Connectors and disconnect anything you did not use this month. A read-only connector you never use is still access you gave away for nothing.
2. Open Settings > Data controls and decide on the “Help improve our AI models” toggle, which is on by default. Meta says it strips names, email addresses, phone numbers, and Social Security numbers before training, and turning the toggle off also covers past interactions. For an account connected to my inbox, I would turn it off.
3. Open Identity > Memory under the Assistant icon and delete anything stale or wrong, since Muse acts on what it remembers about you.

How Does Meta Muse Compare With Claude Cowork and ChatGPT Agent?

Meta Muse and Claude Cowork solve the same delegation problem from opposite ends: 

• Muse works from its own cloud computer and your connected accounts.
• Claude Cowork reaches into the files and browser on your own machine. 

That difference decides which one fits a given task more than any benchmark does. Here is the comparison that matters for a first-time user:

When to use Meta Muse or alternatives

If the task starts in Gmail and ends in a file, as the expense audit does, Muse's model is the simpler one, and the free tier means you can find out for nothing.

If the task starts in a folder of PDFs on your laptop, I recommend reading our Claude Cowork tutorial and using Anthropic’s tool instead of Muse. 

And if you have used OpenAI's agent, our ChatGPT Agent guide covers its variant, which also works from its own virtual computer with a browser and will feel familiar after this guide.

Final Thoughts

The expense audit was the example, but the loop works the same for a packing schedule, a subscription cull, or a week of calendar triage. Scope it with the 4 parts, approve one card at a time, spot-check 3 rows and the total, and fix the run from the log rather than the output.

What changed with agents is where the skill sits. Writing a good prompt mattered when software returned words. But now that software acts, the skill is defining a task tightly enough that the judgment calls disappear, and checking the result closely enough that the ones you missed can’t hide.

That is already a data professional’s skill. I think people who work with data will be better at delegating to Muse than the people it was marketed to.

If you want the foundations under agents, start with our Introduction to AI Agents course, then go further with the AI Agent Fundamentals track.