What it can start, and where it hands back.
A feature list flatters an agent, because an agent can begin almost anything. The useful question is narrower: what does it finish on its own? Muse hands work back in exactly three situations, and knowing which one you have hit is the difference between a tool that helps and one that quietly stalls.
It does work. It does not decide.
Multi-step work inside your apps, bounded by access and judgement
Muse takes an outcome you describe, plans the steps and carries them out across files, forms, Messages, Calendar, Notes and Mail while you do something else. What it will not do is exceed the access you granted, or make a call you did not give it the grounds to make. Meta says it confirms before anything sensitive, such as sending an email or making a purchase, and that its work runs in a sandbox it calls the Muse Secure VM.
A useful sentence to carry around: Muse is good at work that is tedious rather than difficult. Everything below is an elaboration of that. How it differs from Meta AI.
The five areas it reaches on a Mac
Each is granted separately and can be revoked separately. Listing what each one cannot do next to what it can is more useful than a bare capability list, because the boundary is where people get surprised.
| Area | What it can do | Where it stops |
|---|---|---|
| Files | Capable Sorting, renaming to a pattern, moving into folders, extracting content, finding duplicates across a folder you name. | Bounded It works in the places you granted. It will not roam your whole disk looking for context you did not point it at. |
| Capable Reading threads, pulling out details, drafting replies, and filing or labelling according to a rule you state. | Confirms Sending is the archetypal sensitive action. Meta says it asks first, and an unconfirmed send is the one mistake with no undo. Using it for email. | |
| Calendar | Capable Creating and moving events, pulling dates out of documents or messages, checking a set of days for conflicts. | Bounded It does not know which meeting matters more than which. Priority is judgement, and judgement is yours to supply. |
| Notes | Capable Gathering scattered notes into one, reformatting, extracting action items, keeping a running list current. | Bounded Consolidating is safe; deleting the originals is not something to leave unstated. Say what happens to the source. |
| Messages and forms | Capable Reading a thread for details, and filling a form from a document you point it at. | Confirms Anything that sends or submits sits behind the same confirmation gate as mail. Messaging. |
Separately from these Mac areas, account-level integrations such as Instagram, Facebook and Google Workspace are authorised individually and they roll out region by region, so the agent can be present while a given connection is not yet enabled where you are.
Three ways a task comes back to you
When Muse stops short, it is always one of these. Telling them apart takes a moment and saves you from treating a design decision as a fault.
A gate
It has done the work and is waiting on you for the irreversible part the send, the purchase, the submission. Meta says these confirmations are deliberate, and they are the feature doing its job.
Working as intended. Answer it.
A judgement
It has hit a fork you did not resolve: which of two folders, whether “last month” includes this week, what to do with the file that fits no rule. It cannot invent your preference, so it asks.
Your task was underspecified. Answer, then reuse the better phrasing.
A wall
Something it cannot cross at all: an area you have not granted, an integration not enabled in your region, or a capability it simply does not have. No rewording gets past this one.
Not a phrasing problem. Grant, wait, or do it yourself.
Why the distinction earns its keep
People who find agents frustrating are usually mixing these up. They rephrase a task to get past a wall, which never works. They treat a gate as a failure, when it is the one safeguard standing between a draft and an unrecoverable send. And they answer the same judgement question every week rather than fixing the phrasing once.
A gate is the product working. A judgement is your instruction being thin. A wall is the end of the road. Three different responses, and only one of them is “try again”.
The judgement case is the one worth investing in, because it compounds. Every time you answer “which folder?” you have learned something your next task should state up front and a task that states it runs in fewer steps, which costs you less of the weekly allowance as well as less of your attention.
The wall case is worth recognising quickly for the opposite reason: there is nothing to learn, and the time spent rewording is wasted. Check what you have granted and what has shipped where you are, then stop.
Six things it is not good at
Not caveats buried at the bottom of a features page these are the ones that will actually shape what you get out of it.
It is not available to most people
Muse launched in the United States only, on iPhone from September 8, 2026 and the Mac from September 17. Meta has not published an expansion schedule. For most readers this is the limitation that settles all the others.
What helps: nothing on your end and a VPN does not, because eligibility is tied to your account’s region. The five gates.
It is weaker on one long document than you would expect
Independent testing of Muse Spark 1.3 found long-document accuracy slipped from 83% to 79% against the previous version, even as its tool-use scores climbed. The engine got better at doing things and slightly worse at reading at length which is an odd shape, and worth knowing.
What helps: hand a single long document to Meta AI instead; keep Muse for many small reads across apps.
It cannot supply judgement you left out
Which folder, whether last month includes this week, what to do with the item that fits no rule. Faced with a genuine fork it stops and asks, which is correct behaviour and also the commonest reason a task takes longer than you hoped.
What helps: name the scope, the boundary and the finish condition up front. The four parts of a task.
It only reaches what you have granted
Access is per area, which is the right design and also means a task spanning four areas needs four grants. A run that stalls on a missing permission may still have consumed its attempt.
What helps: sort permissions once, before the task, rather than discovering them mid-run. How grants work.
A failed run still costs you a task
The weekly allowance counts jobs started, not jobs that went well, so an abandoned or misfired run is gone from the meter either way. Two attempts at the same thing is two tasks.
What helps: read the plan before it runs. Corrections at that point are free; restarts are not. How the meter works.
Its safety properties are Meta’s claims, not measurements
The confirmation prompts before sensitive actions, and the sandbox Meta calls the Muse Secure VM kept out of its advertising systems, are things Meta states about its own product. They are plausible and they are not independently verified here.
What helps: grant narrowly, read plans, and treat the prompts as a useful backstop rather than a guarantee. What Meta says.
Worth asking, and not worth asking
The pattern is consistent enough to be a rule: work that is tedious suits an agent, and work that is difficult does not.
| The request | Verdict |
|---|---|
| “Rename these two hundred files to a consistent pattern.” | Worth asking |
| “Pull the dates out of these emails into my calendar.” | Worth asking |
| “File last month’s receipts into folders by month.” | Worth asking |
| “Fill in this form from the details in that document.” | Worth asking |
| “Read this ninety-page contract and tell me what is risky.” | Use Meta AI |
| “Decide which of these three suppliers we should use.” | Not its job |
| “Tidy up my files.” | Too vague |
| “Send this to the team when you think it looks right.” | Not its job |
The last row is the one people most want to be wrong about. Handing over the decision to send is handing over the one step that cannot be undone, and it is the step the confirmation gate exists to keep with you.
Capability questions
What can Muse actually do on a Mac?
It carries out multi-step work inside your apps: organising and renaming files, filling in forms, and reading from and writing to Messages, Calendar, Notes and Mail. You describe an outcome rather than the steps. Area by area.
What can Muse not do?
It cannot reach an area you have not granted, cannot complete a sensitive action without your confirmation, and cannot exercise judgement you have not given it. It is also weaker on one long document than on many short reads. The six limitations.
Does Muse ask before doing something sensitive?
Meta says it does that it confirms before things like sending an email or making a purchase. That is Meta’s statement about its own product, reported here rather than independently verified, and it is not a reason to skip reading the plan before a run.
Is Muse good at reading long documents?
Less so than you might expect. Independent testing of Muse Spark 1.3 found long-document accuracy slipped from 83% to 79% against the previous version, even as tool-use scores improved. For one long document, Meta AI is often the better choice.
Which apps does Muse connect to?
Files, forms, Messages, Calendar, Notes and Mail on the Mac, plus account-level integrations such as Instagram, Facebook and Google Workspace, each authorised individually. Areas are granted one at a time and revoked the same way.
Can Muse work while I do something else?
Yes that is the point of an agent rather than a chat box. You describe an outcome, it plans the steps, and you get on with something else until it finishes or hands back. The three hand-backs.
How good is Muse at using tools?
This is where Muse Spark 1.3 improved most. Tau3-Bench Banking rose from 35% to 47% and Terminal-Bench 2.1 from 80% to 85%, and Meta reports roughly 20% fewer tool calls per task. In practice that means less flailing on multi-step work.
Does Muse replace Meta AI?
No. They run on the same model and do different jobs Meta AI answers questions about what you show it, Muse carries out work. Most people who have both keep both. The full comparison.
Where does Muse do its work?
Meta says the agent’s work happens in a sandbox it calls the Muse Secure VM, kept out of Meta’s advertising systems. Again, that is Meta’s description of its own architecture. What is claimed.
What is the single biggest limitation?
Availability. Muse launched in the United States only, so for most readers the regional gate settles what it can do before any capability does. Where it works.
Give it the boring half of the job.
The capability list is long and the finishing list is shorter but what it does finish is exactly the work you were least looking forward to.
Independent guide not affiliated with Meta. Behaviour described as of September 2026; benchmark figures are as reported for Muse Spark 1.3, and statements about confirmation prompts and sandboxing are Meta’s own.