Meta's two Muses: a cheap agentic model and a consumer agent that wants your passwords

Meta released two things called Muse within a week, and they are worth reading together. On September 2, Muse Spark 1.3 arrived in Muse Code and the Model API, optimised for agentic workflows, competitive programming, tool use and holding context across dozens to hundreds of steps, and positioned explicitly as a cheaper option for high-volume workloads rather than the smartest model available. On September 8, Meta launched Muse, a consumer personal agent (US only, adults only) with always-on browser use, app connectors, an approval layer called Sentinel, hidden credentials, and native integrations such as OpenTable. The model is a routine product decision; the agent is where the questions are.

Muse Spark 1.3: the cheap-and-long tier

The positioning is the news. Meta is not claiming a frontier score; it is claiming that a model can run a useful agent for hundreds of steps at a price that makes high volume sustainable. That is the same axis Google is competing on with Gemini 3.8 Flash, whose $0.75 input and $3.75 output per million tokens hold only until December 31 before doubling, and it is the axis that matters for anyone paying for agent loops rather than single completions. Meta did not publish Muse Spark pricing in the coverage I have (Axios, TechStartups), so I cannot put it on the same table yet. If you evaluate it, evaluate it the only way that matters for this tier: cost per completed task on your own agent workload, not score per benchmark.

Muse the agent: read the approval model, not the demo

An agent that books your table is an agent that is logged into OpenTable as you. Meta's answer to that is the pair of features it names: hidden credentials, meaning you do not see or type the passwords the agent uses, and Sentinel, an approval layer that gates actions. Those are the right two components. Whether they are implemented well is unknowable from a launch post, and critics went straight to the terms of service: Meta may use Muse data to operate the service and, with an opt-out rather than an opt-in, to improve "AI at Meta"; it logs actions; and it may share some queries with partners.

The security question for a personal agent is never how smart the model is; it is who holds the credentials and who can say no before the click.

Compare the design choice made the same week by Perplexity's Hybrid Compute for Mac, which routes private files, personal data and on-device actions to a local model and sends only the rest to the cloud. That is one answer to the same problem: keep the sensitive half of the agent on hardware you own. Meta's answer is to hold the sensitive half for you and ask you to trust the terms.

What I would delegate, and what I would not

Treat a consumer agent with stored credentials as a new employee with your wallet. Delegate accordingly.

• Yes: read-only research, reservations on accounts with no stored payment method, anything you would hand to an assistant without a second thought.
• Conditionally: purchases under a fixed limit on a card with a matching limit, with Sentinel set to prompt on every spend.
• No: banking, primary email, anything with password-reset authority over other accounts, and any account where the terms let the operator log and reuse what happened inside it.
• Always: a dedicated identity for the agent where the service allows it, and a monthly review of what it did.

The attack surface is the one I described for prompt injection in the home: an always-on browser reads web pages, and web pages can contain instructions. An approval layer helps only if approvals are specific enough that "book a table" cannot be quietly widened into "change the email on file". Meta has not published how granular Sentinel is. That is the thing to test adversarially before trusting it with anything that matters.

The honest limitation

Neither product has independent data behind it yet. There are no third-party benchmarks or prices for Muse Spark 1.3, no published specification of how Sentinel scopes approvals or how hidden credentials are stored, and the terms-of-service reading comes from critics' first pass rather than from the document itself. Muse is US-only, so I cannot try it. Everything above is the framework I would apply, not a verdict on how Meta's implementation holds up.