Meta puts its agent on the Mac: Muse desktop app launches with approval gates on deleting files and sending messages

Start with what it is allowed to do. Meta's chief AI officer Alexandr Wang and Mark Zuckerberg both announced the launch on September 17, with Zuckerberg saying on X that Muse for Mac was out that day, that it works across apps, files, calendar, notes and messages on your computer, that you control what it can access, and that the team is shipping fast. The concrete abilities cluster around everyday tasks that span several apps: organising folders, finishing a form using information already stored in files, and building an end-of-day summary out of emails, messages and notes. The real shift is in how context is gathered. A normal chatbot needs you to move material into the prompt; Muse can potentially collate information scattered across applications itself, so one task might touch a calendar event, a mail thread, a document in a folder and a message conversation. It also runs asynchronously: Meta says the agent keeps working in the background even when the desktop window is closed, so you can start something on your phone, check in from a laptop, or nudge it through WhatsApp, with the same task thread carried across devices.

The permission design is the most concrete part of the description. Access to your computer is opt-in and Full Disk Access is optional; you decide what permissions Muse gets and can change them at any time in Settings. More important is the gate on destructive or outbound actions: Meta says sensitive actions such as deleting files or sending messages require approval. Concretely, Muse can sort a folder freely but has to stop before deleting anything, and it can draft a summary but has to ask before sending it. That boundary answers a practical question. Once an agent has its hands inside the local file system, the way things go wrong is usually not that it reasoned incorrectly but that it quietly did something irreversible, and picking out deletion and sending as the two actions that need a lock addresses exactly that class of action.

The stack behind the capability was disclosed as well. Muse is powered by Muse Spark, which Meta's launch post describes as its most capable model to date, built for real-world agentic work; the same model powers Muse Code, a coding agent for macOS and Windows. On the cloud side it runs on what Meta calls a Muse Secure VM: Muse runs on its own dedicated computer in the cloud, contained so that no other user's agent can reach it. A separate Sentinel agent runs on that same machine, kept apart from Muse at the system level, and its job is to watch the network egress, so nothing Muse does reaches the internet unless Sentinel approves it. The design turns every outbound connection into an action a second party has to clear, instead of leaving the primary agent to decide for itself whether it may go online.

There is one qualifier that has to be read carefully, and Meta wrote it into the description itself: Secure VM isolates your data from other users, but it does not prevent Meta from accessing your data when necessary to operate the service. The company plans a Muse Confidential VM later in 2026, which will encrypt the entire virtual machine with a key only the user holds, and it runs a public bug bounty for Muse. Those statements belong together: in the current version the privacy boundary keeps other users out, not the service provider, and the genuinely end-to-end encrypted version is still to come. Two product facts are also worth noting. Muse for Mac is currently available only in the US, as a free download, and it is a hosted consumer agent rather than an open model you can self-host. On adoption, Muse climbed the US App Store quickly after its September 8 launch: according to Sensor Tower data cited by TechCrunch, it moved from No. 4 to No. 2 on Apple's US free-apps chart by September 10 on more than 83,000 iOS downloads, and Wang said on September 18 that Muse had become the number one app in the App Store.