Meta 发布个人 AI 智能体 Muse，运行在专属 Muse Secure VM 云端虚拟机上

今天，Meta 推出了 Muse：https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/，这是一款个人 AI 代理，它可以采取行动，而不仅仅是回答问题。Muse 可以发送电子邮件、预订旅行、协商账单，并追求长期目标。即使在你关闭应用后，它也会继续工作，只有在需要批准时才会返回。对于 AI 开发者来说，更重要的消息是其架构。每个用户都拥有一个专用的云虚拟机，称为 Muse Secure VM：https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse，代理、浏览器和所有凭证都在隔离环境中运行。它可部署吗？Muse 本身是一个面向消费者的服务，目前在美国的 iOS、Android 和 muse.ai：https://muse.ai/ 上推出，提供免费套餐和付费计划。开发者不能自行托管 Muse，但其底层模型 Muse Spark 1.3 已通过 Meta Model API 和 Muse Code 提供，并且 Meta 已在其路线图上宣布将开放权重发布。

Muse 以消息传递为核心。用户描述任务或目标，代理会进行规划并执行。它可以打开浏览器、填写表单，并代表用户进行协商。Meta 的示例包括以更高价格出售汽车、降低账单、调整训练计划。Muse 还会跨对话记住上下文。它可以将保存的 Instagram 食谱短片转化为购物清单，并记住朋友的饮食禁忌。敏感操作，如发送电子邮件或完成购买，总是会暂停以获取用户批准。完整的审计记录显示代理所做的所有操作以及计划执行的操作。

Muse 运行在 Muse Spark 1.3：https://research.meta.ai/blog/introducing-muse-spark-1-3，由 Meta 超智能实验室上周发布。该模型针对长期目标的代理任务：零样本 CLI 工具调用、多工作流程线程，以及跨混乱源的自我纠正。在 Meta 工程师的内部对比中，它比 Muse Spark 1.2 大约减少了 20% 的工具调用和 25% 的 token 使用量。Meta 表示，该模型在抵御提示注入方面已接近行业领先水平。开发者现在可以在 Muse Code 和 Meta Model API 上使用它，网址为 dev.meta.ai：https://dev.meta.ai/。

此次发布中最具技术趣味性的部分是安全设计。代理程序在一个 systemd-nspawn 运行时单元中运行，具有限制的系统调用和内核能力。安全关键的服务位于该单元之外，但仍在同一虚拟机上。一个独立的 Sentinel 代理批准每一个连接器操作和每一个网络请求，包括第 4 层和第 7 层。Muse 提出；只有 Sentinel 批准。凭证通过代用方式处理。代理程序只会看到占位符令牌，而 Sentinel 在网络边界注入真实密钥。这使得通过提示注入窃取凭证在结构上无效，因为没有真正的东西可以被窃取。内核级 eBPF 污点跟踪区分干净请求与触及用户数据的请求，从而相应地限制批准。浏览器子代理看到的是无障碍树，而不是原始 DOM，且无法执行 JavaScript。电子邮件连接器默认甚至过滤一次性验证码和密码重置链接。

下面的嵌入内容展示了 Meta 蓝色主题下的 5 个阶段审批流程。它包括 2 个场景：正常购买和被阻止的提示注入尝试。

需要与我们合作以推广您的 GitHub 仓库、Hugging Face 页面、产品发布或网络研讨会等？请与我们联系：https://forms.gle/wbash1wF6efRj8G58

Michal Sutter 是一名数据科学专业人士，拥有帕多瓦大学的数据科学硕士学位。凭借在统计分析、机器学习和数据工程方面的坚实基础，Michal 擅长将复杂的数据集转化为可操作的洞察。

实践者优先的 AI/ML 新闻与分析，每月有超过 100 万开发者和研究人员阅读。

Today, Meta has introduced Muse：https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/, a personal AI agent that takes actions rather than just answering questions. Muse can send emails, book travel, negotiate bills, and pursue long term goals. It keeps working after you close the app and returns only when it needs approval. The bigger story for AI devs is architectural. Each user gets a dedicated cloud virtual machine, called Muse Secure VM：https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse, where the agent, its browser, and all credentials live in isolation. Is it deployable? Muse itself is a consumer service, rolling out now in the US on iOS, Android, and muse.ai：https://muse.ai/, with a free tier and paid plans. Developers cannot self host Muse, but its underlying model, Muse Spark 1.3, is available today through Meta Model API and Muse Code, with an open weights release on Meta’s stated roadmap.

Muse is built around messaging. Users describe a task or a goal, and the agent plans and executes. It can open its browser, fill forms, and negotiate on a person’s behalf. Meta’s examples include selling a car for more, lowering a bill, and adapting a training plan. Muse also remembers context across conversations. It can turn a saved Instagram recipe reel into a grocery list and recall friends’ dietary restrictions. Sensitive steps, such as sending an email or completing a purchase, always pause for user approval. A full audit trail shows everything the agent has done and plans to do.

Muse runs on Muse Spark 1.3：https://research.meta.ai/blog/introducing-muse-spark-1-3, released last week by Meta Superintelligence Labs. The model targets long horizon agentic work: zero shot CLI tool calling, multi workflow threads, and self correction across messy sources. In internal comparisons by Meta engineers, it used roughly 20% fewer tool calls and 25% fewer tokens than Muse Spark 1.2. Meta says the model is close to state of the art at resisting prompt injection. Developers can use it now in Muse Code and the Meta Model API at dev.meta.ai：https://dev.meta.ai/.

The security design is the most technically interesting part of this launch. The agent harness runs inside a systemd-nspawn runtime cell with filtered syscalls and limited kernel capabilities. Security critical services sit outside that cell, on the same VM. A separate Sentinel agent approves every connector action and every network request, at both layer 4 and layer 7. Muse proposes; only Sentinel permits. Credentials are handled through surrogation. The agent only ever sees placeholder tokens, and Sentinel injects real secrets at the network boundary. That makes credential exfiltration via prompt injection structurally futile, since there is nothing real to steal. Kernel level eBPF taint tracking distinguishes clean requests from those that touched user data, gating approvals accordingly. The browser sub agent sees an accessibility tree, not the raw DOM, and cannot execute JavaScript. The email connector even filters out one time passcodes and password reset links by default.

The embed below walks through the approval pipeline in 5 stages, in Meta’s blue theme. It includes 2 scenarios: a normal purchase and a blocked prompt injection attempt.

Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us ：https://forms.gle/wbash1wF6efRj8G58

Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.

Practitioner-first AI/ML news and analysis, read by 1M+ developers and researchers every month.