Notis vs Meta Muse: A Personal AI Agent From an Ad Company, or One You Pay For?

Meta built a personal AI agent, and it's genuinely good engineering. Muse lives in its own cloud computer, can't see your passwords, and asks before it spends your money. It's also made by a company that earned 97.6% of its 2025 revenue from advertising. So "Notis vs Meta Muse" comes down to one question: how much of your life do you want to route through one of the world's biggest ad businesses, however well it's sandboxed?

This comparison draws on Meta's launch announcement, its technical security write-up and help pages, independent reporting, and Notis's public documentation. Muse launched in the US only and we're not using it day to day, so every Muse claim links to its source.

The short version

1. Meta Muse is best for US users who live in Meta's apps and want an agent that shops, books, negotiates and even phones businesses, for free up to a usage limit.
2. Notis is best for founders and operators anywhere who want an assistant in WhatsApp, Telegram, iMessage, Slack or email that runs their work tools and never trains on their data.
3. Neither yet if you haven't decided which actions an agent may take without asking you. Muse lets you set that per connector. Do it before you connect your inbox.

What Meta Muse is

Muse is Meta's "personal AI agent", introduced on September 8, 2026. You chat with it in the Muse app on mobile and Mac, on muse.ai, or directly in WhatsApp. It runs on Muse Spark, Meta's own model, and it can "open a browser, fill out forms, and negotiate on their behalf". It keeps working after you close the app and comes back "when it needs approval, like before it sends an email or makes a purchase."

Adoption was instant: 2.8 million installs worldwide in its first 12 days, and it replaced ChatGPT as the top free app on the US App Store, according to Fortune. It connects to email, calendar and "other Meta apps like Instagram and Facebook" (Meta). Muse is free with a usage limit, with paid subscriptions for more (Muse FAQ), and TechCrunch reports it asks for a payment card at signup.

What Notis is

Notis is a messaging-native assistant for people who run their work from their phone. You talk to it on WhatsApp, Telegram, iMessage, Slack, email or the desktop app, and it acts in the tools you connect: Notion, Gmail, Google Calendar, CRMs and 1,000+ integrations. It's available worldwide, and if you already pay for ChatGPT or Claude, Notis can run on that subscription instead of its own usage.

Notis is made by Mind The Flo S.à r.l. in Morlon, Switzerland (privacy policy). A small team, no venture capital, no ads. You pay per task, and that's how we make money.

Notis vs Meta Muse at a glance

Where Muse is genuinely ahead

Credit where it's due: Meta's security design is the most serious we've seen from a consumer agent, and it's documented in unusual detail.

• Isolation. Each user gets a dedicated cloud VM, and the agent runs in a locked-down container inside it. Credentials live in a separate service, so "the agent never sees real tokens" (Meta).
• A Sentinel the agent can't override. A separate process approves every connector action and every outgoing network request, and asks you when needed.
• Prompt-injection defence in depth. Meta explicitly designs around Simon Willison's lethal trifecta, and its email connector filters out one-time codes and password-reset links.
• Payments. Purchases use a single-use card through Link, tied to one merchant and one amount.
• A public bug bounty paying up to $300,000, including for prompt injection.

If your only question is "will a malicious email trick it into leaking my password?", Muse has thought harder about that than most. Notis isn't immune to prompt injection either. No vendor is.

The question security engineering can't answer

The harder question isn't technical. It's incentive.

Meta says plainly that Muse "doesn't share a person's conversations or the data in their VM with Meta's ad systems" (Meta). Good. The same technical post adds that "there are some legitimate scenarios where how you use Muse can influence the ads you see": when Muse browses a shop or books a restaurant, it shows up as your activity (Meta). That's honest, and it's also the point. An agent that runs your errands across the web, built by a company paid to know what you're about to buy, will always generate signal for the ad machine, even without a direct pipe.

It's also worth separating Muse from Meta AI, the chatbot. In 2025 Meta announced it would use interactions with Meta AI to personalize the content and ads you see from December 16, 2025. Muse is promised a different deal. Policies like that can change, and Meta has history here. TechCrunch's launch coverage recalls the 2019 $5 billion FTC settlement over privacy violations, among others.

To be fair to Meta: Muse's paid subscription is the first time many Meta users will actually be the customer. That's a real shift. But the free tier is the default, and free at Meta's scale is funded by something.

Defaults: what's on before you touch a setting

Defaults decide what happens for the millions who never open settings.

• Training is on. Meta's help page says the setting to use your Muse interactions to train its models "is on when you first use Muse". Meta strips some identifiers (names, emails, phone numbers) first, and turning it off also applies to past interactions (Meta help).
• Meta can still get in. Today's architecture restricts staff access "through operational policies", but "does not prevent Meta from accessing data when necessary to support, secure or operate the service". A Confidential VM that would block Meta cryptographically is planned "later this year" (Meta).
• Humans on the phone, briefly. Reuters reported that Meta tested human contractors quietly handling some Muse phone calls. One employee warned "we are one bug away from unnecessary information being leaked to human callers." Meta called it "a miss" and rolled it back.

Notis's defaults: no training on your data, ever. Only the founder can access production, and we ask your permission before viewing a conversation for debugging (Help Center). Deletion clears active systems within 30 days and backups within 90.

Real-world bumps so far

Three weeks in, the public record is mixed. Amazon blocked Muse, saying it browses without identifying itself, a claim Meta disputes. Security researcher Patrick Wardle found a Mac flaw that let malware already on the machine steal Muse's account token, which Meta patched (Business Insider). And Reuters reported internal testers saw an agent route around guardrails and expose private iCloud photos before launch (Yahoo Tech/Forbes).

None of that makes Muse unusually bad. It makes it a version-one agent with very broad reach. For the privacy details and the settings to change, see our Meta Muse privacy guide.

Choose Muse if, choose Notis if

Choose Muse if you're in the US, already live in Instagram, Facebook Marketplace and WhatsApp, and want an agent that shops, negotiates and phones businesses for free. Turn off model training in Data controls, set permissions to always ask, and keep "Always allow" off connectors that message strangers.

Choose Notis if you're outside the US, your work runs on Notion, Gmail, Slack or a CRM, and you'd rather pay a small company whose only revenue is you than get a free agent from an ad company. Start free, or plug Notis into the ChatGPT or Claude plan you already pay for.

Choose neither yet if you haven't written down what an agent may do without asking. That rule protects you more than any vendor's architecture.

More options in our Meta Muse alternatives guide, and a head-to-head of the two viral agents in Instinct vs Meta Muse.

Frequently asked questions

Is Meta Muse free?

Yes, up to a usage limit. Past that you can upgrade to a paid subscription or wait for the limit to refresh (Muse FAQ). TechCrunch reports Muse asks for a payment card when you sign up.

Does Meta use Muse conversations for ads?

Meta says Muse doesn't share your conversations or VM data with its ad systems. It also acknowledges that Muse's browsing and bookings appear as your activity and can indirectly influence ads you see (Meta).

Does Muse train on my data?

By default, yes. Model training is on when you start, with some personal identifiers removed. You can switch it off in Settings, then Data controls, and the change also applies to past interactions (Meta help).

Is Meta Muse available outside the US?

Not at launch. Meta rolled Muse out in the US on iOS, Android and muse.ai (Meta). Notis works worldwide on WhatsApp, Telegram, iMessage, Slack and email.

What's the main difference between Notis and Meta Muse?

Muse is a free-to-start personal agent from an advertising company, with strong sandboxing and a broad errand-running scope. Notis is a paid, worldwide assistant for work tools and messaging, from an independent Swiss company that never trains on your data.

The verdict

Muse proves that a big company can take agent security seriously, and Meta deserves credit for documenting it. But architecture answers "can it be hacked?", not "who is it for?". If you want the free errand runner and you're comfortable inside Meta's world, Muse is a strong choice with the right settings. If you want an assistant whose only customer is you, that's the one we build.