Meta Muse vs Pally (2026)

Connectors reach email, calendars, the car and the home, Instagram, Facebook and Meta ads, each built with the service provider's API and paired with a skill that tells Muse how to use it well. Muse for Small Business adds Asana, Box, Canva, Dropbox, Figma, Granola, HighLevel, QuickBooks, Klaviyo, Lovable, Notion, Shopify, Slack, Stripe and Zoom. For anything else, Muse can write a custom connector of its own, and it calls tools through command line programs and skills it can build in its VM.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Pally connects to Gmail, Outlook and iCloud mail, Google and iCloud calendars, WhatsApp through Linked Devices, iMessage through its Mac app, Slack, Google Drive, Docs and Sheets, Notion, Linear, GitHub, Jira, Todoist, Granola and X, with app authorization handled by Composio and room for custom integrations.

It acts in them, sending WhatsApp and iMessage messages and email, forwarding mail, creating calendar invites and editing a Google Doc in place once the user approves. Sites without an integration are reached through browser errands that sign in with saved logins, and a bank account can be linked read only for recurring charges.

Sourcepally.com/airead 2026-10-12

Muse breaks a goal into an actionable plan and runs several long tasks at once, launching swarms of subagents and handling concurrent subagents and cron jobs inside its VM. The model behind it was trained for long trajectories and multi agent coordination. A Goals tab tracks every goal it is pursuing and the plan to reach it, and a user can interrupt or pile on new tasks without waiting for the last one to finish.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Background tasks carry an errand across messages, email, the browser and calls, retry after a brief model error and pick up new choices from the chat while they run. Automations are written in a sentence and can carry conditions, such as nudging a friend who still owes money once three days pass. Through the trusted network, a user's Pally hands parts of a job to the Pallys of a partner, friends or colleagues, each acting under its own owner's sharing choices, and in a group chat each member's request runs on that member's own Pally and accounts.

Sourcepally.com/trusted-networkread 2026-10-12

Once a goal or task is set, Muse keeps working on a schedule and in response to relevant events, takes the next step and follows up while the app is closed. It messages first when background work turns up something new or needing a decision, holding proactive messages to a high bar by default, and the user can switch that off or dial it up or down. Requests come in through the iOS and Android apps and the web, all connecting straight to the user's own VM.

Sourceintroducing.muse.airead 2026-10-12

Automations fire the moment something happens, such as an email from a landlord, or on a schedule, and email triggered rules read new Outlook and Gmail messages as they arrive. Morning briefs, alerts on important messages across every connected account, flight day changes and price drop or restock watches arrive unprompted. People reach Pally by text, voice note or a call to its number, and in an iMessage or Telegram group it answers when someone names it or replies to one of its messages.

Sourcepally.com/airead 2026-10-12

Every file a user puts into Muse and everything it generates is stored on the user's own VM, the system of record for the account, and connectors bring in mail, calendars and business tools as tasks need them. For a business, connecting Facebook, Instagram and Meta ads means Muse starts out understanding the business and picks up its voice. Answers come from those files and live connections, with no separately managed knowledge base for a team to curate.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Connected mail, calendars, chats, Drive files and Notion pages are read when a question needs them, and web research runs through Exa. From each connected inbox Pally also keeps structured records of receipts, order confirmations and renewal notices from about the past 12 months, with merchant, items, amount, date and repeat cycle, alongside recurring charges from a linked bank account. Outside those purchase records, documents are read at request time instead of being indexed into a lasting knowledge store.

Sourcepally.com/privacyread 2026-10-12

Muse's memory persists across conversations and lives in files on the user's own VM, where the user can inspect, edit and download it alongside everything else Muse keeps. Durable application state sits in a separate database on the same machine. How long memory is kept, and whether a single memory can be removed without wiping the rest, is left unsaid.

Sourceintroducing.muse.airead 2026-10-12

Memory is built around people, not files, covering who the user talks to, what they last discussed and what was promised, such as a friend's dietary needs or a deck owed to an investor. Pally tidies it every night, and the user can ask what it remembers, edit it, tell it to forget something, which then stays out after the nightly update, download it or delete the account. Memory is held per user, a group chat's history and memory belong to the group, and both are kept while the account is active.

Sourcepally.com/privacyread 2026-10-12

Every connector action passes through Sentinel, which checks it against the user's connector policy and allows it, denies it or stops for approval. Approval cards appear in the app's own interface, outside the conversation, with clear accept and reject actions, and grants are scoped to one connector and use, lasting once, for a session, for a task, for a set time or permanently. By default Muse browses freely and stops for anything hard to undo, such as writing an email or making a purchase, and the user can change that balance.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Pally checks with the user before it spends or sends anything not already asked for or approved, and sends on its own only within limits the user sets, such as messages to a named group. A purchase lays out the exact items, seats, fees and total for a single approval, stops if any of them change, and follows the wallet's own approval settings.

Drafts appear before they go and expire after seven days unapproved, approvals can be given by voice during a call, approvals in group chats happen privately in each person's own thread, and the user can take over a live browser session and hand it back.

Sourcepally.com/airead 2026-10-12

Each user's VM splits the agent's runtime cell, mapped to an unprivileged host user, from security services that run outside it.

Privilege separated workers hold connector credentials, an authentication service mints surrogate tokens so the agent never sees real ones, and Sentinel is the sole permission authority for connector actions and network egress, with least privilege enforced between processes.

Agentic red teaming and a public bug bounty back the design, paying up to $300,000 and up to $130,000 for a prompt injection that affects one user. Muse carries no SOC 2 report or other attestation, and a Confidential VM that would keep Meta itself out of user data is still with testers.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Each person in the trusted network picks, one capability at a time, what their Pally may share with each circle, starting from just a name and contact card, and in a group chat a personal request never runs on another member's accounts. Data is encrypted in transit and at rest with access limited inside the company, website logins sit in an encrypted vault run by Kernel that Pally itself never sees, and content arriving from outside is treated as information, never as instructions. Pally holds no SOC 2 or ISO certification and offers no team administration or single sign on.

Sourcepally.com/trusted-networkread 2026-10-12

A snippet under the Muse avatar shows what it is working on, and tapping the avatar opens its full activity log alongside every permission the user has approved. The Goals tab lists everything Muse is tracking and its plan to get there, and each approval card names the exact action and its purpose before it runs. The log and the permission history live inside the app, next to the settings that control them.

Sourceintroducing.muse.airead 2026-10-12

Browser errands run with a live view and screenshots the user can watch, paused while a card number is entered, and a stopped session comes back with an accurate account of what happened. Users can ask what changed in their automations, rules and saved preferences, group automations show their latest real results, and recalled activity appears in the user's own time zone. A log of every step and tool call behind a task, ready for export or review, is not part of the product.

Sourcepally.com/changelog.mdread 2026-10-12

Every user gets a dedicated, isolated VM in Meta's cloud, which holds their files, memory and credentials, and limited data leaves it for inference and telemetry. A user cannot choose where that VM runs, and there is no private or self hosted deployment.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Everything runs on AWS in the US, with iMessage, RCS, phone and email delivery through US providers and Telegram traffic passing through the UAE. Cloud Mac instances are dedicated macOS machines on AWS in the US. A user cannot choose a region, and there is no private deployment or self hosting.

Sourcepally.com/subprocessorsread 2026-10-12

Each connector ships with a skill Meta wrote on how to get the most out of it, and Muse for Small Business adds a named collection of skills and connectors for owners, covering content and ads, customer replies, cash flow and inventory. An Ideas tab and onboarding tips suggest what Muse could take on based on the user's goals. All of this shapes how the single agent works, and there are no separate prebuilt agents or task templates to pick from a catalog.

Sourcemuse.ai/businessread 2026-10-12

Ready made recipes start from one message and each does a whole job. They include Inbox triaged, Morning brief, The friendly nag, WhatsApp and iMessage catch up, Flight finder, Flight day, Price drop and restock watch, Buy it for me, Pre meeting briefs, A memory for your people, Receipt keeper, Your Mac from anywhere, Call Pally and Quote hunter. A machine readable catalog lists every guide and recipe entry point with its opening message.

Sourcepally.com/airead 2026-10-12

Meta trained the model at Muse's core itself, tuned for tool calling through command line programs and skills, long context and multi agent coordination, and a separate set of Meta safety models inspects inference. Conversations and tool trajectories are sanitized and used to train new checkpoints by default. A user cannot choose another model.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Pally picks the model for each turn. Most turns route through OpenRouter to hosts that do not train on user data, running Google Gemini, OpenAI and Anthropic Claude models, with open weight models served by Phala, Novita, Together AI, Modal and Baseten for some steps, and OpenAI also handles phone calls, transcription and memory search. A user cannot choose the model, and routines that pass the usage limit keep running on a lighter one.

Sourcepally.com/subprocessorsread 2026-10-12

Muse is reached through its own iOS, Android and web clients, which connect straight to the user's VM. Muse can extend itself by writing connectors and skills, but outside software has no API or MCP server through which to call it.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Pally runs its own MCP server over streamable HTTP, secured with OAuth 2.1, dynamic client registration and PKCE, and it connects from Claude, ChatGPT in developer mode and Cursor once the user sends a single use code in the Pally chat. It exposes two tools, message_pally to send a message and get the reply and check_pally to collect the result of a long job, under the same approval rules as the chat. There is no public API or SDK for managing tasks, automations, memory or connections directly.

Sourcepally.com/mcpread 2026-10-12

Meta hardened Muse through internal use, agentic red teaming and a bug bounty, and Muse judges whether a finished background result merits a notification before it pings the user. Both work on the vendor's product. A user has no way to test a goal, check the agent's output against cases or compare changes.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

An automation starts work as soon as it is written, with no test run, quality check or side by side comparison beforehand. Pally reports changes to a user's setup once and explains them on request, which keeps configuration visible without measuring how well the assistant performed.

Sourcepally.com/changelog.mdread 2026-10-12

Each user's Muse lives on a dedicated Linux VM with a browser, storage, CPU and memory, where it browses the web, fills forms, shops and books, and compiles code it writes. Its web activity appears as the user's own, and every network request it makes passes through Sentinel. Browsing is one of the headline capabilities, with critical steps such as a purchase held for approval.

Sourceresearch.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-museread 2026-10-12

Browser errands run in a hosted browser on Kernel that signs in with saved logins or Google, reads one time codes from email or messages, fills checkout forms, takes seat holds and completes orders on sites such as Amazon and Instacart, stopping to tell the user what a site needs when it gets stuck. The user can watch the live view, take control and hand the session back. The Pally Mac app lets Pally see the user's own Mac screen, find a file and run the next step, and Cloud Mac, sold separately, gives it a dedicated macOS machine in the cloud.

Sourcepally.com/airead 2026-10-12