ChatGPT dots vs Meta Muse (2026)

A dot uses the ChatGPT plugins a user has installed and enabled, with their connected accounts and existing permissions, for example Gmail to find email, Google Drive to work with documents and GitHub to investigate code and prepare changes. Each plugin must be connected and permitted for the action requested, and admins set app access and action restrictions in plugin controls. When a website needs a login, the dot sends a private sign in request and then works in that session.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Connectors reach email, calendars, the car and the home, Instagram, Facebook and Meta ads, each built with the service provider's API and paired with a skill that tells Muse how to use it well. Muse for Small Business adds Asana, Box, Canva, Dropbox, Figma, Granola, HighLevel, QuickBooks, Klaviyo, Lovable, Notion, Shopify, Slack, Stripe and Zoom. For anything else, Muse can write a custom connector of its own, and it calls tools through command line programs and skills it can build in its VM.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

A dot runs background agents to work on several things in parallel while the user keeps talking to it, starts new cloud threads, and creates ChatGPT Work or Codex tasks on a connected computer or in a Codex cloud environment. It checks the results of tasks it created and sends them follow up instructions, and the Activity view lists each delegated task with its progress, results and requests for input.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Muse breaks a goal into an actionable plan and runs several long tasks at once, launching swarms of subagents and handling concurrent subagents and cron jobs inside its VM. The model behind it was trained for long trajectories and multi agent coordination. A Goals tab tracks every goal it is pursuing and the plan to reach it, and a user can interrupt or pile on new tasks without waiting for the last one to finish.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Between conversations a dot decides on its own when to pause and wake up to continue work, and saved schedules cover work that repeats at fixed times. Where a connected service supports event monitoring it responds to specific events, such as new bug reports in a Slack channel, once it is told which channels to watch, what to look for and when to notify, since adding it to a channel alone sets up no monitoring. Users reach the same dot in ChatGPT on mobile, desktop and web, in Slack by direct message or mention, in Microsoft Teams, and by phone call.

Sourcelearn.chatgpt.com/docs/dots/tasks-and-memoryread 2026-10-12

Once a goal or task is set, Muse keeps working on a schedule and in response to relevant events, takes the next step and follows up while the app is closed. It messages first when background work turns up something new or needing a decision, holding proactive messages to a high bar by default, and the user can switch that off or dial it up or down. Requests come in through the iOS and Android apps and the web, all connecting straight to the user's own VM.

Sourceintroducing.muse.airead 2026-10-12

A dot works from the source material a user shares, the files on its cloud computer and a connected computer, and connected apps such as Google Drive, and it researches that connected information read only to suggest next steps. The context for any interaction is a selection of this material. No indexed knowledge base that a team maintains for its dot is part of the product.

Sourcelearn.chatgpt.com/docs/dots/tasks-and-memoryread 2026-10-12

Every file a user puts into Muse and everything it generates is stored on the user's own VM, the system of record for the account, and connectors bring in mail, calendars and business tools as tasks need them. For a business, connecting Facebook, Instagram and Meta ads means Muse starts out understanding the business and picks up its voice. Answers come from those files and live connections, with no separately managed knowledge base for a team to curate.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Each dot starts with relevant ChatGPT memory and keeps its own notes on preferences, decisions and ongoing work, separate from ChatGPT's saved memory, which it updates as priorities change and carries across ChatGPT, Slack, Teams and calls. Switching channels never resets those notes, and deleting a dot covers its conversations, memories and scheduled tasks, with the details shown at confirmation. A user gets no retention period for the notes, and changing a ChatGPT memory setting does not necessarily change notes already made.

Sourcelearn.chatgpt.com/docs/dots/tasks-and-memoryread 2026-10-12

Muse's memory persists across conversations and lives in files on the user's own VM, where the user can inspect, edit and download it alongside everything else Muse keeps. Durable application state sits in a separate database on the same machine. How long memory is kept, and whether a single memory can be removed without wiping the rest, is left unsaid.

Sourceintroducing.muse.airead 2026-10-12

Before an action affects the user's accounts or shares information, an automatic review checks it against the user's instructions, permissions, custom rules and built in safety requirements, then lets it proceed, asks for approval or hands the step to the user.

Custom rules come in four kinds, take action without asking, take action only when told, ask before taking action, and hand off to the user, so a team can require a check before messages go to customers or keep file deletions in human hands.

Workspace admins decide who may add rules, a dot checks privately before sharing anything from a private conversation in Slack, and Pause stops its current main task.

Sourcelearn.chatgpt.com/docs/dots/controlsread 2026-10-12

Every connector action passes through Sentinel, which checks it against the user's connector policy and allows it, denies it or stops for approval. Approval cards appear in the app's own interface, outside the conversation, with clear accept and reject actions, and grants are scoped to one connector and use, lasting once, for a session, for a task, for a set time or permanently. By default Muse browses freely and stops for anything hard to undo, such as writing an email or making a purchase, and the user can change that balance.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Workspace owners grant dots through workspace defaults and custom roles assigned to groups, with group membership synced by SCIM, and separately allow Slack participation, custom rules, password manager use and cloud browser, network and computer use. Business and Enterprise data is encrypted in transit and at rest and is not used to train OpenAI models by default. OpenAI keeps its attestations in a separate trust portal.

Sourcelearn.chatgpt.com/docs/enterprise/dots-admin-guideread 2026-10-12

Each user's VM splits the agent's runtime cell, mapped to an unprivileged host user, from security services that run outside it.

Privilege separated workers hold connector credentials, an authentication service mints surrogate tokens so the agent never sees real ones, and Sentinel is the sole permission authority for connector actions and network egress, with least privilege enforced between processes.

Agentic red teaming and a public bug bounty back the design, paying up to $300,000 and up to $130,000 for a prompt injection that affects one user. Muse carries no SOC 2 report or other attestation, and a Confidential VM that would keep Meta itself out of user data is still with testers.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

In the desktop app, a dot's Activity view opens each task, including background work and the Work and Codex tasks it delegated, to show progress, files, results and any pending decision, sign in or approval, and the Scheduled view lists recurring work that can be disabled or deleted there. Workspace audit records cover some capabilities, depending on data category, storage location and product configuration. A per step trace of the dot's own actions for an admin to export is not part of the product.

Sourcelearn.chatgpt.com/docs/dots/controlsread 2026-10-12

A snippet under the Muse avatar shows what it is working on, and tapping the avatar opens its full activity log alongside every permission the user has approved. The Goals tab lists everything Muse is tracking and its plan to get there, and each approval card names the exact action and its purpose before it runs. The log and the permission history live inside the app, next to the settings that control them.

Sourceintroducing.muse.airead 2026-10-12

A dot's cloud computer runs on shared, OpenAI managed infrastructure in VM backed sandboxes tied to the signed in user, and it can also work with one personal computer the user connects. No region choice for the dot's computer and no private deployment come with the product.

Sourcelearn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-securityread 2026-10-12

Every user gets a dedicated, isolated VM in Meta's cloud, which holds their files, memory and credentials, and limited data leaves it for inference and telemetry. A user cannot choose where that VM runs, and there is no private or self hosted deployment.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Each user has one dot that takes on whatever responsibility it is given, from keeping a sales proposal current to drafting show notes from interviews or following up on software feedback. Those examples come as guidance on how to brief it, and there is no catalog of ready made dots or task templates to adopt.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Each connector ships with a skill Meta wrote on how to get the most out of it, and Muse for Small Business adds a named collection of skills and connectors for owners, covering content and ads, customer replies, cash flow and inventory. An Ideas tab and onboarding tips suggest what Muse could take on based on the user's goals. All of this shapes how the single agent works, and there are no separate prebuilt agents or task templates to pick from a catalog.

Sourcemuse.ai/businessread 2026-10-12

Dots run on GPT-6 Astra, OpenAI's own model. The user has no choice of another maker's model for a dot.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Meta trained the model at Muse's core itself, tuned for tool calling through command line programs and skills, long context and multi agent coordination, and a separate set of Meta safety models inspects inference. Conversations and tool trajectories are sanitized and used to train new checkpoints by default. A user cannot choose another model.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Dots are reached through ChatGPT, Slack, Microsoft Teams and calls, and they reach out through plugins and a connected computer. Outside software has no API or MCP server for creating a dot, sending it work or reading its results.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Muse is reached through its own iOS, Android and web clients, which connect straight to the user's VM. Muse can extend itself by writing connectors and skills, but outside software has no API or MCP server through which to call it.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Users start a dot on one responsibility, review its first result and correct missing details before widening the job, and because a dot can make mistakes its important results come back with their sources for checking. That checking is manual, with no test cases, quality checks or comparison of a dot's output across changes.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Meta hardened Muse through internal use, agentic red teaming and a bug bounty, and Muse judges whether a finished background result merits a notification before it pings the user. Both work on the vendor's product. A user has no way to test a goal, check the agent's output against cases or compare changes.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Each dot has its own computer and browser in the cloud for research, files and running software, with browser sessions of its own and optional saved logins. The user opens the dot's computer and selects Take over to inspect a page or do a step, then Return control. A connected personal computer lets the dot work with its local files and apps while the ChatGPT app is open, and admins switch cloud browser use and cloud computer use on per role.

Sourcelearn.chatgpt.com/docs/dotsread 2026-10-12

Each user's Muse lives on a dedicated Linux VM with a browser, storage, CPU and memory, where it browses the web, fills forms, shops and books, and compiles code it writes. Its web activity appears as the user's own, and every network request it makes passes through Sentinel. Browsing is one of the headline capabilities, with critical steps such as a purchase held for approval.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12