What has Meta actually built to protect your data?
More than you would expect. Each user gets a dedicated virtual computer, a separate gatekeeper agent checks every outbound action, the model never sees your passwords or card numbers, and purchases use single-use virtual cards. Reviewers call it the strongest security design shipped in a consumer agent so far.
Muse runs in what Meta calls a Secure VM, a dedicated virtual computer for each user with its own browser. A separate gatekeeper agent called Sentinel sits on the same machine but is kept apart from Muse at the system level, and every outbound action passes through it. The model never sees your actual passwords or payment details. Purchases run through Stripe's Link with single-use virtual card numbers. You set per-app permissions, so you can let it read your inbox without letting it send. There is an audit log of what it has done and what it plans to do.
Reviewers who have gone through the architecture in detail have called it the strongest privacy and security design shipped in a consumer agent so far. That is a fair assessment, and it is not the reason to keep it away from your business.
Is Muse a business product now?
Partly, as of September 29, 2026. Meta launched Muse for Small Business, which connects to apps like QuickBooks, HighLevel and Stripe and prepares back-office work for your approval. It still has no built-in field service connectors and does not answer a business phone.
This section originally said Muse was not built for business and that Meta did not claim otherwise. That is no longer true, and the correction matters more than the original point.
Meta has launched Muse for Small Business. You give it a goal, connect your business accounts, and it prepares work for you to review. It reads sales performance, drafts growth plans, flags unusual expenses and surfaces emails that need attention. Nothing publishes, sends or spends without your approval. Pricing runs free, $20 a month and $100 a month, and you choose what each connected app can reach, disconnect any of them, and opt out of having your interactions used for training.
So the blunt version of the old argument is dead. What replaces it is narrower and, for a contractor, more useful.
Look at what it connects to: fifteen apps including QuickBooks, HighLevel, Shopify, Stripe, Slack, Asana and Notion, plus Facebook Pages, Instagram analytics and Meta ad accounts. QuickBooks and HighLevel are real wins for a contractor. What is missing is anything that touches the field: no built-in Jobber, Housecall Pro or ServiceTitan, nothing for dispatch, estimating or a crew schedule. Microsoft 365 and Teams are missing too, which is its own problem if that is where your office lives.
The other thing it does not do is answer your phone. A contractor's single largest leak is the call that rings out at 4pm on a Friday, and a tool that drafts a growth plan does not plug that hole.
What happened with the Mac app vulnerability?
A researcher found that the Muse app for Mac let any program on the computer change its settings, including where voice data was sent, which could hand an attacker control of the agent. Meta has shipped a hotfix. It happened this month, and it turns the abstract risk into a concrete one.
A macOS security researcher found that the Muse app for Mac had settings any program running on the machine could change, with no special permissions required. One of those settings controlled where Muse sent voice data for transcription. Point that at a server you control, capture the token that proves the user is who they say they are, and you have the agent. In demonstrations the researcher was able to make Muse write malicious files and take pictures with the camera, with no warning to the user.
Meta has pushed a hotfix. The company also runs a bug bounty program and says it hardened Muse through adversarial red teaming before launch, which is how this kind of thing is supposed to be found.
The lesson is not that Meta built it badly. It is that an assistant holding wide access to your email, calendar, messages and payment methods is now a target worth attacking, and that the value of compromising one is enormous. That calculus applies to every agent, not just this one. It is simply a bigger problem when the account holds a business rather than a person's dinner reservations.
| Action | Default |
|---|---|
| Read your connected email | Allowed once you connect it |
| Send email | Needs your approval |
| Spend money | Needs your approval, one-time virtual card |
| Use your conversations for training | On unless you opt out |
| Confidential VM with keys only you hold | Announced for later in 2026, not shipped |
What does the training opt-out actually mean?
It means Meta uses your Muse conversations to improve its models unless you turn that off. Connect a business inbox and leave the setting alone, and your customer conversations are in scope by default. That is not what most business owners would choose.
Meta uses interactions with Muse to improve its models unless you opt out. The company says it scrubs critical personally identifying information first, and that Muse conversations and Secure VM data are not fed into its advertising systems. Both of those are meaningful commitments.
But opt-out is not opt-in. If you connect a business inbox and never change the setting, your customer conversations are in scope by default. A stronger Confidential VM, encrypted with keys only the user holds so that Meta itself cannot read it, has been announced for later in 2026 and has not shipped. Until it does, the honest framing is that the design is excellent and the question is who the custodian is.
So what should a contractor actually use?
Use Muse for your own errands and keep it away from anything a customer touches. Customer-facing work needs tools that belong to the business, where permissions survive an employee leaving and something answers the company phone.
For your own errands, Muse is fine and genuinely good. Booking your travel, chasing a refund, comparing prices on a tool purchase, sorting out your own calendar. It is a personal assistant and it does that well.
For anything a customer touches, use something scoped to the business rather than to your personal Meta account. That means a phone line that answers as your company, a system where the permissions belong to the business and survive an employee leaving, and a record you can hand to someone else. That is what Orion is, and it is the actual answer to the question rather than a way of changing the subject.
One more thing worth saying, because it gets lost in the noise. Muse is twelve days old at the time of writing and gained major capabilities twice in that window. Any advice about it, including this, has a short shelf life. Check the current state before you act on it.
