Meta MuseMeta Muse

模型与开放条件Model & openness

模型是厂商指定的 —— 官方原文："powered by Muse Spark, Meta's most capable model to date, built for real-world agentic work like this"。

Muse Spark 是 Meta 另有的模型名（Meta Careers 页把 官方原文："Muse Spark · natively multimodal reasoning, visual chain of thought and multi-agent orchestration" 列为独立条目）。

没有模型选择入口。 同一模型名还出现在 AI 眼镜的更新说明里 （Muse Spark on Meta Ray-Ban Display），是跨形态复用的。

The model is vendor-assigned — official wording: "powered by Muse Spark, Meta's most capable model to date, built for real-world agentic work like this".

Muse Spark is a separate Meta model name (the Meta Careers page lists official wording: "Muse Spark · natively multimodal reasoning, visual chain of thought and multi-agent orchestration" as its own entry).

There is no model-selection entry point. The same model name also appears in AI-glasses release notes (Muse Spark on Meta Ray-Ban Display) — it is reused across form factors.

运行位置Where it runs

形态的答案就是本产品：官方原文 Muse 跑在 Muse Secure VM 上， 官方形容为 官方原文："a dedicated, virtual machine (VM) that houses both the agent and a person's data"，并且 官方原文："Every Muse user’s VM is isolated so no one else’s agent can access it"（见帮助中心页）。

接入口径与本地 agent 不同：官方强调 官方原文："talking to it works just like messaging another person, in the Muse app or directly in WhatsApp"—— WhatsApp 是入口之一，这是它与另两家的明显差异。

发布渠道：iOS / Android / muse.ai，美国先行，官方称 官方原文："coming soon to AI glasses"。

The answer to "what form is it" is the product itself: the official wording says Muse runs on a Muse Secure VM, described officially as official wording: "a dedicated, virtual machine (VM) that houses both the agent and a person's data", and official wording: "Every Muse user's VM is isolated so no one else's agent can access it" (see the Help Centre page).

The entry-point story differs from local agents: the official pages stress official wording: "talking to it works just like messaging another person, in the Muse app or directly in WhatsApp" — WhatsApp is one of the entry points, a clear difference from the other two vendors.

Launch channels: iOS / Android / muse.ai, US first, officially official wording: "coming soon to AI glasses".

本地文件Local files

它不是为读写你本机文件设计的，官方全文未提及本地文件系统。

数据都在 Muse Secure VM 里。

官方另有一句针对 app 连接的数据最小化承诺（帮助中心页）： 「例如，连接你的邮件允许 Muse 搜索你的邮件」「但除非你要求，否则它不会下载你的整个收件箱」。

这一句是官方在数据面给出的具体边界，值得单独记。

It is not designed to read or write files on your machine; the official text never mentions the local file system.

All data lives in the Muse Secure VM.

The official pages add a data-minimization promise for app connections (Help Centre page): "For example, connecting your email allows Muse to search your email" "but it won't download your whole inbox (unless you tell it to)".

This sentence is a concrete boundary the official pages give on the data side, worth noting separately.

关机后的任务Tasks after shutdown

官方明确写了关闭应用后的行为，这一句比「常驻」更具体： 官方原文："For tasks that take more time, Muse keeps working after people close the app, and comes back when something changes or when it needs approval, like before it sends an email or makes a purchase"。

即后台持续 + 遇审批才回来。

「回来」的触发条件官方列了三类（帮助中心审批页）：

• 任务有进展（状态栏实时显示「Is working」/「Making something」/「Is updating memory」）
• 到了定时任务或提醒的时间（助手图标内 Upcoming 列出 scheduled tasks 与 reminders，且每个 scheduled task 可单独设审批）
• 以及需要你批准的那一刻

另有一处官方原句用了「proactively」： 官方原文："a personal AI agent that proactively helps with people's goals and suggests ideas" 以及能 官方原文："make suggestions unprompted"。

触发源不止你发指令 —— 帮助中心 Connector 页写了反向推送： 官方原文："Some Connectors can also share information proactively with Muse. For example, calendar Connectors can update Muse automatically when there are changes in your schedule"，且这类 Connector 会在连接前标明。

后台自主时是只读还是读写？本条给的是机制而非原句（2026-10-03 补齐）。 默认权限档下 官方原文："your Muse will ask for permission before every write action and important read actions" 而 Connector 页写默认态是 官方原文："Muse will not take many important actions, like sending an email, without your approval"（注意是 many，不是 every）。

两句合起来的后果是明确的：后台期间读操作照常跑，任何写操作都必须回前台等批准 —— 这正好对上发布页那句 官方原文："comes back ... when it needs approval, like before it sends an email or makes a purchase"。

这不是官方那句「后台是只读」的原文，是从两处权限条款推出的机制结论， 与Dot 官方明写只读不同，不要当成同一句话引用。

The official pages state the after-close behavior explicitly, more concrete than just "always on": official wording: "For tasks that take more time, Muse keeps working after people close the app, and comes back when something changes or when it needs approval, like before it sends an email or makes a purchase".

i.e. continuous background work + callbacks only for approvals.

The "come back" triggers are listed officially in three classes (Help Centre approval page):

• Task progress (status bar shows "Is working" / "Making something" / "Is updating memory" live)
• Scheduled tasks or reminders coming due (inside the assistant icon, Upcoming lists scheduled tasks and reminders, and each scheduled task can have its own approval setting)
• And the moment your approval is needed

One official sentence uses "proactively": official wording: "a personal AI agent that proactively helps with people's goals and suggests ideas" and it can official wording: "make suggestions unprompted".

The trigger source is not only your commands — the Help Centre Connector page describes reverse pushes: official wording: "Some Connectors can also share information proactively with Muse. For example, calendar Connectors can update Muse automatically when there are changes in your schedule", and such Connectors are flagged before connection.

Read-only or read-write during autonomous background work? This entry gives a mechanism, not an original sentence (supplemented 2026-10-03). Under the default permission tier official wording: "your Muse will ask for permission before every write action and important read actions" while the Connector page says the default state is official wording: "Muse will not take many important actions, like sending an email, without your approval" (note: many, not every).

The combined consequence is clear: during background work reads keep running as usual, and any write must come back to the foreground and wait for approval — which matches the launch page's official wording: "comes back ... when it needs approval, like before it sends an email or makes a purchase".

This is not an official sentence saying "background is read-only"; it is a mechanism conclusion derived from two permission clauses, and unlike Dot where read-only is stated outright, do not quote them as the same sentence.

工具与扩展Tools & extensions

支付工具是最独特的一项，官方点名了合作方： 官方原文："Muse can checkout with Link built by Stripe, and it is the first AI agent covered by Link's purchase protections"，包含物损坏/丢失免费保障、 价格下降保护、无手续费退货、合资格购买的退货保证。

官方说明机制：官方原文："Link's wallet for agents generates a one-time-use card so your real card details stay hidden"。

Shop Pay 官方原文："coming soon"，另有 1Password 支持（同样是复用你已有的登录）。

浏览器能力官方写明：官方原文："It can open a browser, fill out forms, and negotiate on their behalf"。

The payment tool is the most distinctive item, and the official pages name the partner: official wording: "Muse can checkout with Link built by Stripe, and it is the first AI agent covered by Link's purchase protections", including free coverage for damaged or lost items, price-drop protection, no-fee returns, and a return guarantee on eligible purchases.

The mechanism per the official pages: official wording: "Link's wallet for agents generates a one-time-use card so your real card details stay hidden".

Shop Pay official wording: "coming soon", plus 1Password support (also reusing logins you already have).

Browser capability is stated officially: official wording: "It can open a browser, fill out forms, and negotiate on their behalf".

上下文与记忆Context & memory

记忆机制是官方卖点之一： 官方原文："Muse also remembers what matters to a person, so it can make suggestions unprompted and act on details that person only mentioned once"

官方举的例子很具体（把 Instagram 存的菜谱 reel 变成购物清单、 记住朋友饮食禁忌后再发邀请）。

帮助中心另有一句把记忆的来源说清了： 官方原文："Muse is designed to remember context from your conversations, so you can refer back to things you've discussed before"

——即对话本身是记忆的一等来源，不只是你显式要求记住的东西。

存储形态官方写了是可查的文件，不是黑盒： 官方原文："You can find out what Muse remembers about you at any time by asking directly, or by viewing files like your MEMORY.md"。

forget skill 的机制也写明了，顺便带一个官方自带的限定词： 官方原文："Forgetting works by asking Muse to look for information about a specific person, topic or matter in its memories and supporting files and remove it to the best of its ability"

「尽其所能」不是保证抹净，这个 hedge 值得单独记。

删除侧也有官方机制： 官方原文："You can delete any message you send to Muse, Side Chats with Muse, and files in your virtual machine"

支持重置，也支持忘掉特定主题（forget skill）。

官方也提醒残留： 官方原文："Muse may still remember information it learned from what you deleted"

这条限定值得记，删除不等于抹掉已学到的。

残留不止删除这一条路径（2026-10-03 补）。断开 Connector 也不清记忆。 官方原文："Information that Muse previously used to perform tasks with that Connector might still remain in Muse's memories and your conversation history"。

对比之下 reset 才是硬边界： 官方原文："Resetting Muse permanently deletes all information, chat history, files and active tasks. This cannot be undone."

⚠ 上下文窗口大小官方没有公布，未见任何官方数字。

另有一处工程细节官方提到但未展开：VM 官方原文："maintains backups to help protect your agent's history from data loss"

——有备份机制，但备份保留多久、与删除语义怎么 interplay，两页都没写。

The memory mechanism is one of the official selling points: official wording: "Muse also remembers what matters to a person, so it can make suggestions unprompted and act on details that person only mentioned once"

The official examples are concrete (turning a recipe reel saved on Instagram into a shopping list, re-sending an invitation after remembering a friend's dietary restrictions).

The Help Centre adds a sentence pinning down the source of memory: official wording: "Muse is designed to remember context from your conversations, so you can refer back to things you've discussed before"

— i.e. conversations themselves are a first-class memory source, not only things you explicitly ask it to remember.

The storage form is written officially as inspectable files, not a black box: official wording: "You can find out what Muse remembers about you at any time by asking directly, or by viewing files like your MEMORY.md".

The forget skill mechanism is also spelled out, with an official hedge attached: official wording: "Forgetting works by asking Muse to look for information about a specific person, topic or matter in its memories and supporting files and remove it to the best of its ability"

"To the best of its ability" is not a guarantee of complete erasure, and this hedge deserves separate note.

The deletion side also has official mechanisms: official wording: "You can delete any message you send to Muse, Side Chats with Muse, and files in your virtual machine"

Reset is supported, as is forgetting a specific topic (forget skill).

The official pages also warn about residue: official wording: "Muse may still remember information it learned from what you deleted"

This qualifier is worth noting: deletion does not erase what was already learned.

Residue has more than the deletion path (supplemented 2026-10-03). Disconnecting a Connector does not clear memory either. official wording: "Information that Muse previously used to perform tasks with that Connector might still remain in Muse's memories and your conversation history".

By contrast, reset is the hard boundary: official wording: "Resetting Muse permanently deletes all information, chat history, files and active tasks. This cannot be undone."

⚠ The context-window size is not published officially; no official number has been seen.

One engineering detail is mentioned but not expanded: the VM official wording: "maintains backups to help protect your agent's history from data loss"

— a backup mechanism exists, but neither page says how long backups are kept or how they interplay with deletion semantics.

权限与限制Permissions & limits

本条最独特的设计：独立 Sentinel agent 做审批。

官方原文："A separate Sentinel agent runs on that same machine, kept apart from Muse at the system level. Nothing Muse does reaches the internet unless the Sentinel approves it, and it asks the person for permission when needed"

即审批不由 Muse 自己判断，而是与它系统级隔离的另一个 agent 判断。

这与 Dot 的「自动审核」在实现层不同（Dot 未说明审核器是否独立）。

其余：敏感动作前询问（发邮件、购买）； 官方原文："Muse shows people a complete audit trail of everything it has done and plans to do" （审计面比 Dot 的活动视图更宽 —— 含「计划要做的事」）；

用户自行选 app 与权限粒度： 官方原文："for things like email, people choose what Muse can do, whether it reads their mail or can also send on their behalf"；

凭据隔离： 官方原文："Muse has no visibility into people's passwords or payment methods. Any credentials a person shares with Muse go into secure storage"， 且 官方原文："Muse also cannot see passwords a person types into the browser themselves"；

帮助中心把机制写得更细：用凭据前会过三道检查（连的是不是预期服务、 是不是你授权的、你有没有给过这类动作的许可）；

训练开关： 官方原文："People can also opt out of their interactions being used to train Meta's AI models" （帮助中心页补充：设置默认开，可随时改，改动也适用于历史交互； 开启时仍会移除姓名/邮箱/电话/SSN 等部分身份信息，并与账号脱钩）；

不与广告系统共享。Muse 官方两处都写了不把对话或 VM 数据给 Meta 广告系统。 帮助中心页补充：即使 Accounts Center 里绑了其他 Meta 产品也一样。

⚠ 官方自己承认 prompt injection 未解决（2026-10-03 补，一手措辞）： 官方原文（四句连引）："Websites, emails, files and connected services can contain instructions intended to manipulate an AI agent." "This is sometimes called a prompt injection attack." "Muse uses multiple protections to help detect and resist these attempts." "These include model training, automated detection systems, and limits on the information and services Muse can access during a task."

关键一句： 官方原文："Important permission and security checks operate separately from the AI model, meaning that they don't rely only on Muse recognizing that an instruction may be malicious."

——官方承认「模型自己认出恶意指令」不足以兜底。这与 Sentinel 的设计动机一致。

官方也照例写了 官方原文："No automated system is perfect"，并要求用户自行复核活动。

⚠ Custom Connector 是官方自己标出的风险口（2026-10-03 补）： 用户可让 Muse 现造一个连接器，官方随即给出警告： 官方原文："Meta doesn't review custom connectors or how they use your information, so grant access with caution and review the provider's privacy policies."

——这是官方承认存在审查盲区，评估第三方接入时必须算进去。

反向的权限收敛也有官方条款： 官方原文："Many Connectors can also be set up so that Muse is only able to retrieve data, but not take actions (like sending a calendar invite)"

——读-only 连接器是官方提供的降权手段。

⚠ 帮助中心页有一处尚未实现的承诺：Muse Confidential VM。 官方写 官方原文："In the future / Later this year"， 即整台 VM 用只有用户持有的密钥加密、连 Meta 都读不了，当前不可用。

This entry's most distinctive design: an independent Sentinel agent performs approvals.

official wording: "A separate Sentinel agent runs on that same machine, kept apart from Muse at the system level. Nothing Muse does reaches the internet unless the Sentinel approves it, and it asks the person for permission when needed"

i.e. approval is not judged by Muse itself but by another agent system-level isolated from it.

This differs in implementation from Dot's "auto-review" (Dot never states whether its reviewer is independent).

The rest: asking before sensitive actions (sending email, purchases); official wording: "Muse shows people a complete audit trail of everything it has done and plans to do" (the audit surface is broader than Dot's activity view — it includes "plans to do");

users choose apps and permission granularity themselves: official wording: "for things like email, people choose what Muse can do, whether it reads their mail or can also send on their behalf";

credential isolation: official wording: "Muse has no visibility into people's passwords or payment methods. Any credentials a person shares with Muse go into secure storage", and official wording: "Muse also cannot see passwords a person types into the browser themselves";

the Help Centre details the mechanism: three checks before using credentials (whether the service is the expected one, whether you authorized it, whether you granted permission for this kind of action);

training toggle: official wording: "People can also opt out of their interactions being used to train Meta's AI models" (the Help Centre page adds: on by default, changeable anytime, and changes also apply to historical interactions; when on, some identifying information such as names/emails/phones/SSNs is still removed and decoupled from the account);

not shared with the ads system. Both official Muse statements say conversations and VM data do not go to Meta's ads system. The Help Centre page adds: the same holds even if other Meta products are linked in Accounts Center.

⚠ The official pages themselves admit prompt injection is unsolved (supplemented 2026-10-03, first-hand wording): official wording (four sentences quoted together): "Websites, emails, files and connected services can contain instructions intended to manipulate an AI agent." "This is sometimes called a prompt injection attack." "Muse uses multiple protections to help detect and resist these attempts." "These include model training, automated detection systems, and limits on the information and services Muse can access during a task."

The key sentence: official wording: "Important permission and security checks operate separately from the AI model, meaning that they don't rely only on Muse recognizing that an instruction may be malicious."

— the official pages admit "the model itself recognizing a malicious instruction" is not enough as a backstop. This matches the Sentinel design motivation.

The official pages also state, as expected, official wording: "No automated system is perfect", and ask users to review activity themselves.

⚠ Custom Connectors are a risk opening flagged by the official pages themselves (supplemented 2026-10-03): users can have Muse build a connector on the spot, and the official pages immediately warn: official wording: "Meta doesn't review custom connectors or how they use your information, so grant access with caution and review the provider's privacy policies."

— this is an official admission of a review blind spot, which must be counted when evaluating third-party integrations.

Permission convergence in the other direction also has official clauses: official wording: "Many Connectors can also be set up so that Muse is only able to retrieve data, but not take actions (like sending a calendar invite)"

— read-only connectors are an official de-escalation option.

⚠ The Help Centre page contains one not-yet-implemented promise: Muse Confidential VM. The official wording says official wording: "In the future / Later this year", i.e. the whole VM encrypted with a key only the user holds, unreadable even to Meta — currently unavailable.

适合什么任务Best for

官方定位是 官方原文："for billions of people worldwide, so there's no learning curve"， 并明确点名场景：发邮件、订旅行这类日常事务， 以及更大的目标（卖车卖更高、压低账单、随生活变化调训练计划）。

不适合：要读写本地项目文件的人（能力圈完全不同）； 在欧盟/英国等地区首发就要用的人（官方写 官方原文："rolling out in the US"）； 需要 Confidential VM 那种「连厂商都读不到」保证的人（尚未实现）。

The official positioning is official wording: "for billions of people worldwide, so there's no learning curve", and the named scenarios are concrete: everyday errands like sending email and booking travel, plus bigger goals (selling a car for more, lowering bills, adjusting training plans as life changes).

Does not fit: people who need local project-file read/write (a completely different capability circle); people in the EU/UK etc. who need it at launch (official wording says official wording: "rolling out in the US"); people needing a Confidential-VM-grade "even the vendor cannot read it" guarantee (not yet implemented).

A separate Sentinel agent runs on that same machine, kept apart from Muse
at the system level. Nothing Muse does reaches the internet unless the
Sentinel approves it, and it asks the person for permission when needed.

A separate Sentinel agent runs on that same machine, kept apart from Muse
at the system level. Nothing Muse does reaches the internet unless the
Sentinel approves it, and it asks the person for permission when needed.

Muse shows people a complete audit trail of everything it has done
and plans to do.

Muse shows people a complete audit trail of everything it has done
and plans to do.

You can delete any message you send to Muse, Side Chats with Muse,
and files in your virtual machine.
...
After you delete something from Muse, Muse may still remember information
it learned from what you deleted.

You can delete any message you send to Muse, Side Chats with Muse,
and files in your virtual machine.
...
After you delete something from Muse, Muse may still remember information
it learned from what you deleted.

Later this year, Meta will introduce Muse Confidential VM, where the whole VM,
including a person's data and conversations with Muse, is encrypted with a key
only they hold, so not even Meta can access it.

Later this year, Meta will introduce Muse Confidential VM, where the whole VM,
including a person's data and conversations with Muse, is encrypted with a key
only they hold, so not even Meta can access it.

Muse can checkout with Link built by Stripe, and it is the first AI agent
covered by Link's purchase protections: free coverage for damaged or lost items,
price drops, no-fee returns, and a return guarantee on eligible purchases.
Link's wallet for agents generates a one-time-use card so your real card details
stay hidden.

Muse can checkout with Link built by Stripe, and it is the first AI agent
covered by Link's purchase protections: free coverage for damaged or lost items,
price drops, no-fee returns, and a return guarantee on eligible purchases.
Link's wallet for agents generates a one-time-use card so your real card details
stay hidden.

For example, connecting your email allows Muse to search your email,
but it won't download your whole inbox (unless you tell it to).

For example, connecting your email allows Muse to search your email,
but it won't download your whole inbox (unless you tell it to).

Information that Muse previously used to perform tasks with that Connector
might still remain in Muse's memories and your conversation history.

Information that Muse previously used to perform tasks with that Connector
might still remain in Muse's memories and your conversation history.

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.