How Does Meta Muse Work? The Secure VM, Sentinel and Memory Explained Simply

"How does Muse actually work?" is one of the most common questions people search after trying it. The short answer: Muse is an AI model with its own computer, a second AI that watches it, a memory about you, and Connectors into your apps. Once you understand those four parts, most of Muse's behaviour (good and annoying) makes sense.

This explainer is based on Meta's announcements, Meta's help pages and a long interview with the Meta lead who built Muse, which we transcribed with our own transcript tool.

The big picture

1. The brain: Muse Spark

Muse runs on Muse Spark, Meta's own model. When you send a request, Spark works out what you want, breaks it into steps ("check the calendar, search for restaurants, compare, draft a booking"), and decides which tools to use for each step.

This is the part that "thinks," and it is mostly what your weekly token grant pays for.

2. Its own computer: the Muse Secure VM

This is the biggest difference between Muse and a normal chatbot. Every user's Muse gets its own virtual machine, a small private computer in Meta's cloud. Meta describes it as Muse's home. It has:

• A web browser that Muse controls like a person would (you can watch, take over or stop it)
• A file system where your documents, images and reports live
• Tools like a terminal for heavier jobs (editing videos, running scripts)

Because the computer lives in the cloud, Muse keeps working when you close the app, and your files and in-progress work are still there tomorrow. It also means Muse never touches your actual laptop unless you install the desktop app and grant it access (see Settings > Computer use and File system access).

3. The watcher: Sentinel

Here is the clever part. On the same VM sits a second, separate AI agent called Sentinel. Muse works for you; Sentinel's only job is to check what Muse sends out to the world: forms it fills, messages it sends, calls it makes.

Meta's Muse lead compares it to a traffic cop. Sentinel:

• Blocks sensitive data such as card numbers or Social Security numbers from leaving
• Inserts your saved passwords at the last moment, so Muse itself never sees them
• Pauses for your approval when Muse contacts a new website or does something risky

That is why you get approval pop-ups, and why some users find them frequent. It is a deliberate trade: one AI to help you, another that exists only to prevent harm.

4. Approvals and permissions: you in the loop

On top of Sentinel, your own settings decide what Muse may do without asking. Each Connector has its own list of actions, each set to Allow, Ask or Deny (most start at Allow, so check them). When Muse needs you, it asks, and you can allow once, allow for the task, or always allow.

Our privacy and permissions checklist explains which settings to change first.

5. Memory and the Soul file

Muse keeps two kinds of notes, both visible by tapping your Muse's avatar, then the fingerprint icon:

• Memory: facts and preferences about you (your city, your family, "no meetings before 10")
• Soul: Muse's own personality and standing instructions (tone, how proactive to be)

Both are editable. Meta is candid that memory is not a solved problem: it does not work like human memory, and Muse can forget or over-remember. Reviewing it every so often is good practice.

6. Connectors: how Muse reaches your apps

Connectors are approved links into services like Gmail, Google Calendar, Instagram, Notion, Shopify and Spotify. You sign in on the other service, choose what Muse can access, and Sentinel handles the credentials. When no Connector exists, Muse can fall back to using a website in its browser, which is slower and sometimes blocked (Amazon, for example, blocks it).

More detail in our Connectors guide.

7. What happens when you send a task

Putting it all together, here is the journey of a request like "book us a table for Friday":

1. Spark reads your request plus your memory (party size, favourite cuisine, dietary needs).
2. It plans steps: check your calendar Connector, search restaurants, compare options.
3. It uses the browser on your VM or a booking Connector to find a table.
4. Before submitting, Sentinel checks what is being sent and your permissions decide whether to ask you.
5. You approve, Muse books, adds it to your calendar, and logs every step in your task history (avatar > list icon).

What is not built yet

• Muse Confidential VM. Meta has announced a more private version, designed with the cryptographer behind Signal's encryption, where your data is encrypted with a key only you hold. It aims for WhatsApp-style guarantees, but it is not live yet. Some videos describe it as current; it is not.
• Better memory. By Meta's own admission.
• Wider calling. Phone calls on your behalf are rolling out gradually.

Watch the builder explain it

The most in-depth source on how Muse works is this long-form interview, including the Sentinel design and the confidential VM plans:

Now that you know how it works, see how it compares in Meta Muse vs ChatGPT vs Claude.