Meta Muse vs ChatGPT Agent: Two Companies Built Two Very Different Cages for AI That Acts Like You

Source: jamilxt; Medium · 2026-09-10

On September 8, Meta handed a consumer AI agent three things that used to be considered untouchable: access to your email, your calendar, and a way to spend your money. The agent is called Muse, it launched the same day OpenAI was fielding accusations about a stolen math proof, and the timing was probably not an accident. A launch that would normally dominate the tech news cycle got buried under the Navier-Stokes controversy instead.

Muse is a personal agent that lives in Meta’s cloud. You message it from a dedicated iOS or Android app, from muse.ai on the web, or from inside WhatsApp, and it opens its own browser and does things on your behalf: sending email, booking travel, filling out forms, negotiating bills, turning a recipe reel into a grocery list, and completing purchases.

The pricing structure tells you who Meta thinks will use it:

Free tier with a usage meter that warns you before an action crosses into paid territory.

Power at $20 per month and Maximum at $100 per month for heavy usage.

A payment card is required to sign up, even for the free tier, which TechCrunch flagged as a real friction point for people who just want to try it.

It is powered by a model Meta calls Muse Spark, under Chief AI Officer Alexandr Wang, and it is coming to Meta’s smart glasses later. US-only for now, 18 and older.

None of that is why this launch matters. Plenty of companies have demoed errand-running agents. What matters is the cage Meta built around it, because the cage is an argument about how AI safety should work, and it is a direct rebuttal of how OpenAI does it.

Meta’s architecture has two load-bearing pieces.

Muse Secure VM. Every user gets a dedicated virtual machine, isolated from other users, with its own browser. Untrusted data from the web lives in one compartment. The part of the agent that can actually take actions lives in another, and that acting part never sees your raw credentials. If a webpage contains a prompt injection attack, the theory goes, the malicious text is trapped in the untrusted compartment with nothing valuable to steal.

Sentinel. A separate process that inspects every outbound action before it reaches the internet. It checks each action against the policies you approved, and for sensitive steps like sending mail or spending money, it escalates to a human approval prompt. Meta says those approval prompts bypass the model entirely, meaning a hijacked model cannot forge its own permission. Tarek Sheasha, VP of Superintelligence Labs, put it plainly in the launch materials: the agent runs in its own isolated cell, does not see real credentials, and every interaction with the outside world runs through a Sentinel the agent cannot override.

Payments get their own layer. Checkout runs through Stripe’s Link, which issues a single-use card number per transaction, so the agent never handles your real card details. Meta says Muse is the first agent covered by Link’s agent purchase protections, which guarantee no-fee returns. Shopify’s Shop Pay and 1Password integrations are coming.

The trust extras are unusually specific: you can opt out of your interactions training Meta’s models, you can instruct Muse to forget specific things it has learned, and you can review an audit of its actions. A stronger tier called Confidential VM is coming, which runs the whole VM inside a trusted execution environment with access keys held on your device, meaning even Meta could not read the contents. Meta is working with Moxie Marlinspike, the creator of Signal, on that design, plans to publish the binaries with a transparency log, and is giving selected security firms source access.

And they are putting money behind it: Muse is covered by Meta’s public bug bounty, up to $300,000 for a valid security hole, including up to $130,000 for a reproducible prompt injection that compromises a single user. When a company pays six figures for proof its safety architecture fails, that tells you what they are afraid of.

OpenAI’s consumer agent stack has moved fast this year. The original ChatGPT agent mode, which folded in Operator, is being superseded by ChatGPT Work, launched July 9 on GPT-5.6 with Codex technology underneath. Work runs on a persistent cloud VM on OpenAI’s servers, breaks a stated goal into steps, and works across your connected apps and files for hours, producing finished documents, spreadsheets, and sites.

The safety model is different in kind. Where Meta built architectural walls, OpenAI mostly built a trained, monitored model:

User confirmations before actions with real-world consequences, like purchases or sending email.

Watch mode, which kicks in when the agent touches sensitive contexts such as your email or bank, and pauses execution if you look away.

Browser takeover mode, where you type passwords yourself and the agent is not shown or told what you entered.

Terminal restrictions, at launch limited to GET requests for downloading images and public datasets.

Memory disabled during agent tasks, so a successful prompt injection cannot read long-term context.

The system card publishes the numbers, which I respect. On a synthetic challenge set, ChatGPT agent disregarded irrelevant instructions and exfiltration attempts in the text browser 99.5% of the time, and 95% in the visual browser. But on active data exfiltration attacks in the visual browser, where an adversary actively engineers the attack, the success rate drops to 67%. One in three active attacks got through the model’s training defenses in testing.

That 67% is the single most important number in this comparison, and I suspect it is the number that pushed Meta toward architecture instead of training. If your defense is “the model is trained to resist manipulation,” a 67% defense failure rate under active attack is a thin wall for a system that can send email as you. Meta’s answer assumes the model WILL be manipulated and puts the checkpoint outside the model, in a process the model cannot override.