Browser agents with Muse: what people actually automate

Muse can act as a browser agent out of the box: every user gets a dedicated cloud machine with its own browser, and Muse opens pages, fills forms and checks out on your behalf. The builds that work best are narrow errands with a clear finish line, like paying a bill or claiming a refund. Open-ended shopping and anything behind a sign-in wall are where it stalls.

This post collects the browser work people have reported, the tools builders made around it, and the limits you should plan for.

How does Muse browse the web?

Meta's launch post describes Muse running inside a dedicated Muse Secure VM. The security write-up adds the details that matter for browsing:

• Each user gets an isolated VM built from systemd-nspawn runtime cells.
• A separate authority called Sentinel gates connector actions and network egress.
• Credential surrogation keeps secrets away from the model.
• Web content is labeled as untrusted input, and prompt injection is handled by training, classifiers and human approval layered together.

That last point is the one to remember. A browser agent reads text written by strangers, and Meta's answer is several defenses stacked, plus a bug bounty that pays up to $300,000.

The model underneath is Muse Spark 1.3. Meta reports 66.9 on OSWorld 2.0 in max mode (via MarkTechPost). That is Meta's number, measured on a benchmark, and it says nothing about your utility company's login page.

What errands are people running in the Muse browser?

The catalog has a clear pattern. The wins are bill and account chores with one goal and one website.

Build	What Muse did in the browser
Verizon gift card applied to a bill	Confirmed a gift card could pay down the balance, then paid it on Verizon.com
Xfinity bill negotiation via chat	Chatted with Comcast's own support bot to try for a lower rate
eBay listings and price watches	Priced books from photos and listed them on eBay using its own computer
Flight delay compensation in 5 minutes	Claimed a $250 credit for a 7-hour Delta delay and rebooked the flight, as reported by the author
Personal website and live train tracking	Built a site, then used the browser to report the next train at the user's station
Marketplace listing from a phone video	Meta's demo: pull photos from a video and drive a browser to list the item on Facebook Marketplace

Two things stand out. First, the tasks are ones a person finds tedious but not hard. Second, the authors report outcomes, not reliability rates. Nobody in the catalog has published "it worked 9 times out of 10", so treat each as a single good run.

Where do Muse browser tasks break?

Sign-ins and verification. The Muse VM is not your laptop, so sites see a new device. Anything that sends a one-time code to your phone or inbox can stall. In the Xfinity phone negotiation, Muse reached a human but hit a verification text it could not read and had to patch the owner into the call.

Sites that block agents. Amazon blocked Muse purchases from September 20, saying the agent accessed its store without permission and did not identify itself (GeekWire). One user responded with a self-hosted Amazon cart API that Muse reaches over SSH. That is a workaround against a retailer's stated wishes, so weigh the account risk before copying it.

Big, fuzzy jobs. The Spotify playlist re-sort worked across 18 playlists, but the same author reports a similar attempt on 40,000 Google Photos failed. Scale changes the odds.

Can you watch or control what the Muse browser is doing?

Muse shows its browser in the app, and a few builders went further:

• TerMuse puts the live terminal and an interactive browser of the agent's machine side by side, so you can type or click in the same session.
• Muse as a homelab control plane joins the Muse VM to a Tailscale network so it runs commands and browser automation on hardware the user owns.
• Claude Code inside a Muse agent VM reports the VM has 2 vCPUs, about 8GB of RAM and 100GB of disk, with no inbound ports, so the author built a bridge to reach it.

If you plan to hand Muse anything with money attached, a view into the session is worth more than any benchmark.

Does Muse do computer use outside the browser?

Yes, on the Mac. Muse for Mac works with Mail, Messages, Notes, Reminders and Calendar, each set to Off, Read only, or Read and interact. Meta's help page says it asks before sending email or buying anything, and warns that "your agent may be inaccurate or take unexpected actions." At Connect 2026 Meta announced computer use for "any app on your Mac" (Meta).

Note the open security issue: Patrick Wardle reported a Mac zero-day that redirects dictation traffic and exposes auth tokens, unpatched as of September 22 (Malwarebytes).

On Windows there is no official app, but windows-cua is a native C++ port of Meta's macOS computer-use agent that drives Muse Spark 1.1 through the Responses API.

Can I build my own browser agent on Muse models?

You can, with either model family:

• Muse Spark via the Meta Model API. Drop-in compatible with OpenAI and Anthropic SDKs at https://api.meta.ai/v1, with image input and parallel tool calls (docs). Standard pricing is $1.25 per million input tokens and $4.25 per million output tokens.
• Muse Glimmer locally. The zero-backend Glimmer agent console runs every tool inside a browser tab against a local model server.
• Open-source Muse-style agents. nanoMuse runs on Android with a shell and browser, and OpenMuse is a self-hostable assistant with browser, terminal and file access.

For more on the agent side, see the agents and browsers category, and for the model side read Muse Spark as a coding agent.

A short checklist before you hand Muse a browser task

1. Pick a task with one site and one clear end state.
2. Expect a verification step and be reachable when it arrives.
3. Set a spending or offer limit in the prompt, the way the AT&T fiber negotiation capped acceptable offers at $70 a month.
4. Watch the first few runs.
5. Check whether the site allows agents at all.

Built something with the Muse browser? Submit it.

Frequently asked questions

Does Muse have its own browser?

Yes. Each user gets a dedicated Muse Secure VM with its own browser, which Muse uses to open sites, fill forms and make purchases. You can watch it in the app.

Can Muse shop on Amazon?

Not directly. Amazon blocked Muse purchases effective September 20, 2026. Muse can still buy from the 1M+ merchants that accept Stripe Link, and Meta has announced checkout partners including Shop Pay and PayPal.

Is it safe to let Muse log into websites?

Meta keeps credentials away from the model through surrogation and gates actions through a separate Sentinel authority. That lowers risk but does not remove it, and prompt injection from web pages is still an open problem for every browser agent.

Can Muse control apps on my computer?

On a Mac, yes, through Muse for Mac with per-app permissions. Meta announced broader "any app" Mac computer use at Connect 2026. There is no official Windows app.