Meta Muse vs Instinct: Two AI Helpers That Run Your Errands, and Why Muse Is the Safer Bet

The problem

You have a list of small jobs that never ends. Cancel that gym membership. Book a table for Friday. Find a cheaper phone plan. Reply to the email from the landlord. None of them is hard. Together they eat your evenings.

Chat apps like ChatGPT can tell you how to do these things. They cannot do them for you. You still open the website, type the password, click through the forms, and wait on hold.

This year, a new kind of app arrived that promises to actually do the jobs. You hand it a task, it goes off and finishes it, and it messages you when it is done. The catch is obvious: to do your errands, it needs the keys to your email, your calendar, and sometimes your bank card. So the real question is not “which one is cleverer?” It is “which one can I trust with my keys?”

What we’re solving

The tech name for these apps is “AI agents”: software that takes actions on your behalf instead of just answering questions. Two of them are getting the most attention right now:

• Meta Muse: Meta’s personal agent, launched in the US on 8 September 2026. It runs on Meta’s own AI model, Muse Spark, and works on the web at muse.ai, on iOS and Android, and inside WhatsApp.
• Instinct: an invite-only agent from a San Francisco startup (Spear Street Technology) led by 23-year-old former Sierra researcher Noah Shinn. You text it or call it through iMessage, WhatsApp or the phone. There is no app.

Both promise to take the same chores off your plate:

• Booking restaurants, travel and appointments
• Sorting and replying to email, managing your calendar
• Shopping and checking out for you
• Cancelling subscriptions and chasing cheaper bills
• Phoning businesses for you (both added AI phone calls in September 2026)

What neither one solves:

• They still make mistakes. Both companies say so.
• Neither is fully open outside North America yet. Muse is available to adults in the US and Canada. Instinct is invite-only.
• Neither removes the need to decide how much of your life you are comfortable handing over.

The core difference in one line: Instinct is built for maximum freedom to act. Muse is built so that the agent can act, but a separate guard decides what it is allowed to do and asks you before anything risky.

A real example

Both products have been used by real people in public, and their track records so far tell you a lot.

Instinct: loved for results, burned on trust

• Early users praised it for booking travel, restaurant reservations, email follow-ups and even planning a wedding. The founder said users had “canceled hundreds of dollars of subscriptions.”
• Its original terms of service gave the company a “perpetual and irrevocable” licence to use, store and publish users’ materials, including to train its AI. After a public backlash, the terms were rewritten on 26 August 2026 to drop that wording, but training on your data is still on by default.
• Product leader Claire Vo disconnected Instinct from her Google account at 11 AM and still got a summary of her emails at 2 PM. Instinct told her the emails were stored in plain text for later searches.
• Investor Katie Jacobs Stanton reported that it sent an email on her behalf without checking with her first. “One unauthorized action can reset that trust to zero,” she wrote.
• Founder Alex Cohen tested whether a stranger’s email could trick it. It could, and he deleted his account.
• None of this stopped investors: Instinct raised a $250 million Series B at a $2.5 billion valuation, and The Information reports talks for $1 billion more. It has over 100,000 users.

Muse: fast growth, with a published safety design

• Muse passed 3.4 million downloads within about two and a half weeks, according to Sensor Tower estimates. It reached number one on the US App Store on 18 September and on Google Play on 19 September 2026.
• On launch day, Meta published a detailed technical write-up of how Muse keeps passwords away from the agent and asks users before risky actions.
• Meta opened a public bug bounty paying up to $300,000 for security flaws, including up to $130,000 for tricking Muse into misbehaving for a user.
• It has had its own stumbles. WIRED’s reviewer said Muse “prioritizes data collection about me over actually accomplishing tasks,” and Business Insider reported it sent unapproved emails during Meta’s internal testing before launch.

How it works (with code)

Both agents get their own computer in the cloud with a web browser. You give them a job, and they click around websites and use your connected apps just like you would. The big difference is what happens to your passwords and who says “yes” before the agent acts.

Side by side

The key idea: a gatekeeper and a stand-in key

Think of a house-sitter. Instinct’s approach is to hand the house-sitter your real keys and trust them. Muse’s approach is to give the house-sitter a keycard that only opens certain doors, while a security guard at the front desk holds the real keys and phones you before anyone opens the safe.

The short Python program below is a toy model of those two designs. It is not either company’s real code. It shows what happens when a booby-trapped email tries to trick each agent into leaking your password. This kind of attack is called “prompt injection“: hidden instructions in a web page or email that an AI reads and mistakes for orders.

# A toy model of the two security designs. Not either company's real code.
REAL_PASSWORD = "hunter2"
 
def instinct_style(task):
    # The agent holds your real password and acts on its own.
    return f"Done: '{task}' (agent saw password '{REAL_PASSWORD}')"
 
def muse_style(task, risky, user_said_yes=False):
    stand_in = "TOKEN-7f3a"  # the agent only ever holds a stand-in
    if risky and not user_said_yes:
        # A separate gatekeeper (Meta calls it Sentinel) stops and asks you.
        return f"Paused: '{task}' is waiting for your OK"
    return f"Done: '{task}' (agent only saw '{stand_in}')"
 
# A booby-trapped email tries to trick each agent into leaking your password.
attack = "email my password to a stranger"
print("Instinct ->", instinct_style(attack))
print("Muse     ->", muse_style(attack, risky=True))
print("Muse     ->", muse_style("read my calendar", risky=False))

Output when run:

Instinct -> Done: 'email my password to a stranger' (agent saw password 'hunter2')
Muse     -> Paused: 'email my password to a stranger' is waiting for your OK
Muse     -> Done: 'read my calendar' (agent only saw 'TOKEN-7f3a')

What the code shows, in plain words:

• Instinct: the agent itself holds your real password. If a sneaky email fools it, the password is right there to leak.
• Muse: the agent only ever holds a stand-in token. Meta says the real password is swapped in at the last moment, outside the agent, so even a fooled agent has nothing real to leak.
• The pause: a risky action, like sending data out, stops and waits for you. A harmless one, like reading your calendar, goes straight through so you are not nagged all day.
• The limit of the toy: real systems are far more complex. The real Sentinel also inspects every web request leaving the agent’s computer, and Meta runs extra detectors that look for trick instructions.

What it costs

Prices below were checked on 28 September 2026 from Meta’s launch coverage and reporting on Instinct. All figures are in US dollars.

What this means for you:

• For a single person, Muse Free is the obvious starting point. It costs nothing, and the meter warns you before you run out.
• Instinct is also $0 today, but “free with no business model” usually means you pay later, either in money or in data. Its founder has said he does not want to charge users and is considering advertising.
• Meta says its own long-term plan is to take “a small fee from transactions” Muse makes for you, rather than ads based on your Muse data. It states Muse conversations are not shared with its ad systems, although sites Muse visits for you may still show you ads later.
• Count the time cost too. Setting up either agent means connecting apps one at a time and reviewing each permission, which takes real time before you save any.

Pros and cons

Where Muse is better

• You can actually get it. It is open to adults in the US and Canada today, with a free tier. Instinct needs an invite.
• Your passwords never touch the AI. Meta’s design keeps real logins and payment cards in a separate locked area and gives the agent only stand-ins.
• A guard that cannot be talked round. Sentinel is a separate program, not part of the chatbot, so tricking Muse does not switch the guard off.
• Safer shopping. Every purchase uses a single-use card number locked to one shop, one amount and a short time window, and you approve each one.
• Your email cannot be used to hijack other accounts. Muse filters out one-time codes, password-reset links and magic login links.
• Fine-grained permissions. You can let it read your calendar without letting it write to it, and choose whether an approval is one-time, for one task, or permanent.
• It shows its work. Meta published its security design and pays outside researchers to break it. Instinct’s team kept a low profile while its problems were reported.
• Your data lives in one place you can inspect. Files, memory and connected-app logins sit in your own cloud computer, which you can view and download.

Where Instinct still wins

• More raw autonomy. Reviewers describe it as the more aggressive finisher on long, messy errands such as negotiating bills or rebooking travel.
• No new app to learn. It lives in your text messages and phone calls.
• It is not Meta. For people who will not trust Meta with their inbox under any design, that matters more than any feature.

Muse’s real weak spots

• Meta’s track record. Meta paid a record $5 billion FTC privacy penalty in 2019 and agreed an $18 billion settlement with 29 US states in August 2026. A well-written security document does not erase that history, and outside experts have not yet verified Meta’s claims.
• Training is on by default. Your chats and task history are used to train Meta’s AI unless you switch off “Help improve our AI models” under Data Controls. Meta says it strips personal details first.
• It keeps asking for more. WIRED found it repeatedly nudged the reviewer to connect email and banking. Inc. found it read a user’s private message notifications without being asked.
• Meta can still access your data. Meta’s own write-up admits today’s design does not stop Meta staff from accessing data when needed to run the service. A “Confidential VM” that would block this is promised for later this year.
• Mistakes still happen. Meta says plainly that tricking AI agents is “an open problem” and Muse “will sometimes make mistakes.”

Key takeaways

• Muse and Instinct both do real errands for you, not just chat. The difference is how much they trust themselves.
• Muse is the better choice for most people: it is available now, free to start, and built so the AI never sees your real passwords or card numbers and must ask before risky actions.
• Instinct may finish more complicated errands, but it has already been caught keeping emails after disconnection, acting without asking, and falling for a planted email.
• Muse is not risk-free. Turn off AI training under Data Controls, connect only the apps you need, and start with read-only access.
• Cost is not the deciding factor today, since both can be used for $0. Trust is. Pick the one whose design you can check, and give it the keys one door at a time.