Meta brings Muse agent to Mac with access to files and core Apple apps

Muse for Mac is reported to interact with native Mac files, Messages, Calendar, Notes and Mail, subject to opt-in permissions and approvals for sensitive actions. Meta’s own download page says the Mac app can organize files, fill forms and pull from Messages, Calendar and Notes “with your permission.” Muse’s exact Mac model/version is not stated; Meta’s launch materials say Muse is powered by Muse Spark, while Muse Spark 1.3 was the current public model release as of September 2. Access is U.S.-focused in launch coverage.

Documented architecture is agent-in-cloud, not purely local Mac automation. Meta says each user gets an isolated Linux “Muse Secure VM” with browser, storage, CPU and memory. The core harness runs in a systemd-nspawn runtime container; credentials, connector execution and durable state sit outside that runtime. A separate Sentinel agent authorizes connector actions and network egress. This resembles a consumerized agent sandbox plus policy gateway. Reproducibility is limited: Muse Spark is closed; Meta has announced future Spark open weights, while separate Muse Glimmer is open but not the Mac product model.

• Vendor-reported: Muse can open a browser, fill forms, negotiate, keep working after the app closes, and ask before email/purchase actions. Meta
• Vendor-reported: Sentinel is the sole permission authority for connector actions and network egress. Meta AI Research
• Independent reporting: Muse launched for U.S. adults and can be used via app or WhatsApp. AP
• Independent reporting: Muse for Mac adds native desktop access to files, messages, calendar, notes and mail. TechCrunch
• Not corroborated by independent evaluation: no reviewed source independently tested Mac permissions, Sentinel enforcement, or end-to-end task success.

Muse fits the broader “computer-use agent” wave: Anthropic introduced public-beta computer use for Claude in October 2024; OpenAI’s Operator/CUA used screenshots, mouse and keyboard actions in January 2025; Google added computer-use tooling to Gemini 3.5 Flash in June 2026. Apple’s Apple Intelligence strategy also targets personal context and cross-app actions on Mac and iPhone. Meta’s differentiation is packaging: a mass-market consumer agent tied to Meta identity, messaging surfaces and a managed VM.

The central limitation is trust calibration. Meta documents strong controls—isolated VM, credential surrogation, Sentinel, audit trail, opt-out from training—but those are vendor claims, not independently audited in the reviewed sources. The Verge incident is narrower than “secret notification spying”: Meta said Muse incorrectly explained how it worked, and that Messages data sync requires explicit access. That still matters technically: an agent that cannot accurately describe its own permissions undermines user supervision.

For leaders, Muse is a distribution play: Meta is moving agents into consumer routines before enterprises settle their own agent stacks. For developers, the design points to practical patterns worth copying—permission cards, audit trails, connector scopes, egress mediation, credential isolation and background-task visibility. For SaaS vendors, Muse-style agents may become a new front end that shops, cancels, books and negotiates across services. For adopters, pilot only low-risk workflows until access boundaries, logging and revocation are verified.