Gruber warns Meta's cute Muse agent is a power tool, not a toy

Writer John Gruber has published a critique of Meta's Muse agent, arguing that the product's friendly packaging hides how much power it hands to ordinary users. An extract was quoted on 25 September 2026 by developer Simon Willison, who flagged the piece under the title "Muse Looks Cute, but Looks are Deceiving".

According to Gruber, Muse is technically groundbreaking because each user gets their own entire persistent Linux virtual machine running in Meta's cloud. That is a full computer, kept alive between sessions, that the agent can operate on the user's behalf. Gruber also credits Meta with packaging the system in an easy-to-install, easy-to-use way, and describes it as "the first consumer-accessible agentic AI system". He says Meta has "truly done an amazing job with that".

His concern is about comprehension rather than engineering. Muse is "literally presented as a cute mascot", Gruber writes, and he calls it "a genuinely open question whether consumers have any understanding what this means". He draws a comparison with power tools: if you buy a power saw that can cut your fingers off, you are almost certainly aware that you are buying a power saw that can sever your fingers. The implication is that the same intuitive warning signs are missing from a cartoon character on a screen.

Gruber adds that he does not think people realise how powerful, and therefore how dangerous, Muse is, "especially if it's running on your Mac". He does not, in the quoted passage, describe any specific failure, breach or exploit.

The argument matters for anyone tracking agent security because the risk profile of an agent is shaped by what it can reach. A persistent virtual machine is a durable environment: files, credentials and installed software can accumulate in it over time, rather than disappearing when a chat window closes. An agent that also runs locally on a user's own computer touches a second environment, one that holds the user's personal data. Gruber's point is that consumer framing tends to obscure that distinction.

Willison, who writes frequently about large language models and agents, quoted the passage approvingly and noted that Muse is getting a lot of attention, including his own. He tagged the item under his ongoing coverage of general-purpose agents.

Neither the quoted commentary nor Willison's post describes safeguards Meta may have built into Muse, and no vendor response is included in the source. The critique is a warning about user expectations, not a report of harm. For security teams, the practical question it raises is a familiar one: whether the people installing an agent understand the scope of the machine they have just given it.