Meta's Muse agent drives a browser with Gmail, Outlook and Tailscale connectors attached

Tailscale sits on that connector list next to Peloton and Spotify ^[8]. A security team's first task is working out which of the eleven third-party services can reach something the company owns. Four of them are sold with business seats: Gmail, Outlook, Google Docs and Tailscale ^[15]. Counting Meta's own surfaces, the agent can reach seventeen named places once a person switches them on ^[14].

Alexandr Wang said Muse follows a "principle of least privilege," with users deciding which connectors are enabled and whether the agent can read or modify information, and disconnecting them at any time ^[10]. Every control he described belongs to the account holder. No administrator approval, tenant-level block or audit trail appears in Meta's published description of the agent or in Wang's post ^[13]. On that evidence, an employer's only view of the connection is whatever its own identity provider records ^[13].

Meta said Muse runs on a dedicated, secure virtual machine that houses both the agent and the user's data ^[7]. What it does once a connector is live is in Meta's blog post: "Once a person shares a goal with Muse, it helps them develop a personalized plan and coordinate their time and resources, then advances the work on its own. It can open a browser, fill out forms, and negotiate on their behalf," the company said ^[3].

What is public is that blog post, Wang's connector list, and Shopify CEO Tobi Lutke's post on X saying Muse "looks very strong" ^[11][8]. The pricing figure circulating with the launch coverage came from a trader on Stocktwits, not from Meta. The trader wrote that Muse is "free up to 100m tokens a week which is pretty decent honestly" and called it encrypted ^[5].

SecurityWeek, reporting the launch, pointed readers to two of its own earlier pieces, headlined "The Hidden Instructions That Can Hijack AI Agents" and "Meta AI Hacked External Systems During Cybersecurity Testing" ^[12]. That is the class of problem an agent inherits when it opens a browser and fills out forms on pages nobody vetted ^[3].

Mark Zuckerberg set out the destination last month in a 6,500-word essay. "Everyone will have an exceptionally capable personal agent that understands you, your goals, and everything you care about. Your agent will work 24/7 on your behalf to improve your relationships, health, career, finances, home management, hobbies, and more," he wrote ^[6]. Meta said the agent can use a browser, operate continuously, and handle tasks including sending emails, organizing calendars, shopping and making payments ^[4].