Claude making a film about Muse

You've heard what Meta tells you about Muse. Here's what Bear and Claude think — their read on it, not Meta's.

Six terms first: agent, a program that works for you on its own; connector, a plug-in to an outside service; token, a word-sized chunk of text.

What Muse is: Meta's own pitch is "personal superintelligence," "AI that hustles for you" — unlike a chatbot, it's meant to act, not just answer. Meta reports it launched in the US on September 8th, 2026, built on Muse Spark, with 2.5 million downloads in two weeks.

What it does: every user reportedly gets a persistent Linux computer in Meta's cloud — browser, files, the works. For consumers, that means errands: travel, restaurants, appointments, shopping, forms, negotiating, subscriptions, tickets. Reachable on web, iPhone, Android, and WhatsApp, with glasses announced. Connectors skew commerce — Shopify, OpenTable, and others. For small business, as of September 29th, it drafts posts and campaigns, reads QuickBooks, and works with Klaviyo and Shopify.

What it costs: three tiers per the available documentation — Free, $0, 100 million Muse tokens a week; Power, $20/month, 500 million; a higher tier above that. The API is priced separately: $1.25 per million input tokens, $4.25 per million output — Bear and Claude's read is that the free tier's gap from API pricing isn't a discount, it's a bid: over 90% off, in exchange for something Meta wants back.

How Meta makes money, by their reading: primary revenue is transaction fees — a merchant-paid cut of purchases Muse completes. Secondary streams: subscriptions, API sales, and two quieter ones around ads and data. Meta says no ads inside Muse itself. Their read of the underlying goal: own the intent layer, shoppers on one side, merchants on the other, Meta in the middle.

What 100 million tokens means in real work: Nik reports using about 18% of a week's free allowance on this analysis alone — at that pace, the full allowance is roughly 72 film packages a week, nearly six hours of finished film. Priced the way Meta prices its own API, 100 million tokens would run $125 to $425. Their read: the free tier is a subsidy — Meta is buying a user base, and your data along with it.

Nine security concerns get walked through: full disk access instead of folder-level permission; a deny-list model instead of an allow-list; a language model's own promise to respect boundaries, which isn't a guarantee, since models hallucinate; a reported Malwarebytes zero-day involving a dictation redirect; policy-based rather than cryptographic separation of training data and ad systems; prompt injection and approval fatigue; the mascot and persona as trust shortcuts; business conflicts (affordability advice from the company selling the ads); and mobile permissions exposing the most personal data of all.

How Bear actually uses it: nothing runs locally — the Mac app is gone, signed out, deleted, revoked, verified. Muse runs only in the cloud, working on a fenced-off Google Drive folder and sandbox GitHub repos under a dedicated bot account, never touching his own computer. General rule: assume breach, bound the blast radius, and enforce caps (like a card limit) outside the agent itself, not by trusting it to self-police.

This is opinion and analysis. Product facts and prices are as reported by Meta and third parties (sources below) and were not independently verified by this production; statements about Nik's own experience are his own.

Your Turn: Open System Settings → Privacy & Security → Full Disk Access, and list every AI app you see. For each one, write down whether it uses an allow-list or a deny-list. Then check two things yourself: did you find every AI app with disk access, and can you say which list model each one uses?

Sources: Meta (about.fb.com); Meta Help Center; Axios; TechCrunch; CNBC; Malwarebytes; Pivot to AI — full links in video description on the channel.

0:00 What Bear and Claude think about Muse 0:25 What Muse is 0:51 What it does: the machine, errands, connectors 1:48 What it costs: tiers and API prices 2:26 How Meta makes money 3:07 What 100 million tokens means in real work 4:08 Security concerns 6:26 How Bear uses it: nothing runs locally 7:23 Open questions 7:36 Recap 8:11 Your turn

Part of the Muse series. @NikBearBrown

SEO Keyword Tags

Meta Muse security, Muse AI agent risks, Muse full disk access, Muse zero-day vulnerability, Meta Muse business model, Muse AI token pricing, Muse AI data privacy, AI agent security concerns, Meta Muse review, prompt injection AI agent, Muse sandbox setup, AI agent trust design, Meta Muse API pricing, personal AI agent risks, Muse cloud computer security

What this video covers

• 0:00 — What Bear and Claude think about Muse 0:25 What Muse is 0:51 What it does: the machine, errands, connectors 1:48 What it costs: tiers and API prices 2:26 How Meta makes money 3:07 What 100 million tokens means in real work 4:08 Security concerns 6:26 How Bear uses it: nothing runs locally 7:23 Open questions 7:36 Recap 8:11 Your turn

Transcript

A lightly formatted transcript of the video, with timestamps so you can jump to any section on YouTube.

What Bear and Claude think about Muse 0:25 What Muse is 0:51 What it does: the machine, errands, connectors 1:48 What it costs: tiers and API prices 2:26 How Meta makes money 3:07 What 100 million tokens means in real work 4:08 Security concerns 6:26 How Bear uses it: nothing runs locally 7:23 Open questions 7:36 Recap 8:11 Your turn

[0:00] Hello, this is Liam in for Bear. You've heard what Meta tells you about Muse. Now, here's what Bear and Claw think, their read on what it does, what it costs, and where the risks are. Six terms: agent, a program that works for you on its own. Connector, a plug-in to an outside service. Token, a word-size chunk of text an AI reads or writes. Allow list, only named things get access. Prompt injection, hidden instructions steer it. Intent layer, where you say what you want. Bear and Claw start with Meta's pitch, personal superintelligence AI that hustles for you. Unlike a chatbot, it acts. You set a goal, it plans, works the steps, and checks in before anything consequential. Meta says, launched in the US September 8th, 2026 on Muse Spark, 2.5 million downloads in 2 weeks. In Nick's experience, the model is noticeably less capable than GPT-6 Astra, Claude Fable, or Claude Opus. Underneath their read of

The machinery, every user gets a persistent Linux computer in Meta's cloud, browser, file system, terminal. Same architecture as Claude Cawork and Open AI Codex. They differ in audience and default permissions. For consumers, it's errands, travel, restaurants, appointments, shopping, forms, negotiating subscriptions, tickets. Ticketmaster was a launch partner. Their point, its strength, is endurance, not intelligence. It keeps going, it isn't especially clever. You reach it on web, iPhone, Android, WhatsApp, glasses announced. Connector skew commerce, Shopify, OpenTable, Ticketmaster, Instacart, Expedia, Stripe. CNBC reported Amazon blocked Muse over its terms. Custom connectors need no Meta review. For small business, September 29th, it drafts posts and campaigns, reads QuickBooks, works Clavio and Shopify. Meta says nothing publishes, sends, or spends without approval. Developers get the Muse Spark API, not the consumer agent. Three tiers per the document. Free, $0, 100 million Muse tokens a week. Power, 20 a month, 500 million. Maximum, 100 a month, 3 billion. Same features, you pay

For volume. Card required even for free. The API is priced separately. $1.25 per million input tokens, $4.25 per million output, or 10 cents and 20 if you let them train on your data. 12 and 1/2 times cheaper on input, 21 on output. Baron Claude's read, that gap isn't a discount, it's a bid. More than 90% off, and in return Meta gets whatever you run through it. Your usage, your appointments, your purchases, the tickets you pick. The business model, their core claim, primary revenue, transaction fees. A small merchant-paid cut of every purchase Muse brokers, like an affiliate commission. The generous free tier is about those fees pay off. You never see a charge. Secondary streams, subscriptions, API sales, and two quieter ones. The ads angle. Meta says no ads inside Muse, but it funnels businesses toward Meta's ad machine, and your browsing shapes ads elsewhere. Plus training data on by default. Their read of the goal, only

Intent layer, shoppers one side, merchants the other, Meta in the middle. The skepticism. One analysis says only 11 of 47 payments are automatable. The fees may not carry it, and ads may come. Now, 100 million tokens is real work. Nick says he's 18% through this week's free allowance. What's in his folder? 13 film packages, 212 beats, about 8,000 words of narration, roughly an hour of film. At that pace, the full 100 million is about 72 film packages a week, nearly 6 hours of film. Straight-line math from one week, a different week would look different. If Muse tokens count like ordinary ones, those 8,000 words are about 11,000 tokens, under a 10th of a percent of the 18 million. Claude's read, the rest is the agent re-reading its own work. Tokens measure effort, not output. Price it the way Meta prices its API. 100 million tokens is $125 to $425. Share your data, and it's 10 to

20. If the tokens compare, nobody can confirm that. There I read the free tier as a subsidy. Meta is buying a user base and your data, what you do, what you book, what you buy. So, be careful what goes through it. When it's cheap, ask what the discount buys. Concern one, full disk access, the whole disk, not folder level. Meta says it only touches files you ask about. Bear and Claude call that a behavioral promise, not a technical boundary. The machine can't tell the difference. Concern two, a deny list, not an allow list. Nick can't grant one folder, he'd have to block every other disk by name, and any forgotten one is exposed. Fail-safe defaults violated. Folder pickers could have worked, but messages, notes, and mail need full disk access. Muse told Nick it would only touch one folder. That's a language model's promise, and language models hallucinate. Nick can't set a one folder limit, it's

The whole disk or nothing. A promise isn't a permission system. In Nick's experience, Muse ignores clear rules. Specify the typeface for a film plainly, and it often drifts. Codex and Claude code rarely do. Minor for a film, but for a company whose security answer is a promise, what does a broken typeface promise say about the rest? Concern three, known vulnerabilities. Malwarebytes reported a zero-day where a dictation redirect could steal an auth token. Needs local code execution first. One researcher exported 6.8 GB of runtime data, SSH keys included, plus early prompt extraction reports. Concern four, policy not cryptography, training on by default. The ad system separation is a policy claim, no independent audit. Every file you ask about is processed in Meta's cloud, and tokens pasted into chat live in the cloud past expiry. Concern five, prompt injection and approval fatigue. Any untrusted text, a webpage, an email, a PR, a code comment can steer the agent,

And the failure is adversarial, not random. Approvals only work if you read them. Fatigue turns them into reflex. Concern six, trust by design. The mascot, the persona, Bear and Claude call them trust shortcuts. A cute character reads as safe before it's earned it. In super intelligence branding, they say over promises for what's really an errand agent. Concerns seven and eight, business conflicts, affordability advice from the company selling the ads, self-graded attribution, advice that only ever points at meta inventory, and platform dependence, lock-in, a shopper optimized roadmap where developer features can vanish. Concern nine, the phone. Contacts, messages, health, the mobile permissions expose the most personal data of all. Nick won't use it there. How did Bear resolve it? First, nothing runs locally. The Mac app is gone, signed out, deleted, revoked, verified. Muse is web only through Muse AI, ideally in its own browser profile, not on the phone. That's the rule that matters most. Muse

Never runs on Nick's computer. It runs in the cloud, and it only sees what he puts there, a Google Drive folder, a sandbox repo. The wall is where the files live, not what Muse promises. Second, the film setup. Muse works only in its cloud VM on public sandbox repos. GitHub is a dedicated bot account, sandbox repos only, no pasted tokens. PRs only, branch protection, Claude code review, deterministic CI, rendering on a burner MacBook with no Muse. Third, the general rules, assume breach, bound the blast radius, enforce caps outside the agent, a card limit, not an instruction. Irreversible actions get a human, and protect the short list, email, money, credentials, public voice with real walls, not policies. Six questions stay open, VM disk and compute limits, GitHub connector OAuth scopes, what does a Muse token map to, will confidential mode ship with what guarantees, how long does the free tier stay generous, and do ads come to

Muse? Let's recap with Claude. Muse is Meta's consumer agent. It acts on errands with endurance more than intelligence. It costs nothing to start, but the cheapest tokens are paid for with your data. $20 or $100 a month buys volume, not features. Meta's bet is transaction fees on every purchase it brokers, plus the intent layer itself. The critique, full disk access, a deny list, real vulnerabilities, and policy where crypto should be. Bear's answer, nothing runs locally, web and cloud only, files in drive and sandbox repos, reviewed PRs. Open questions, token limits, scopes, confidential mode, and whether the free ride lasts. Your turn, list every AI app on your computer with disk access. For each one, write down whether it uses an allow list or a deny list. Then, check two things yourself. Did you find every app? And can you say which list model each one uses? Claude making a film about Muse at Nick Bear Brown.