In January, Nat Friedman started using OpenClaw, the open-source agent gateway, and then bought hundreds of Mac minis so his team at Meta could run it too. He said so himself on X, after people noticed how much Meta's new agent resembled it (The Next Web, September 22, 2026). "We built Muse from scratch, but it is definitely heavily inspired as a product by OpenClaw," he wrote.
Eight months after those Mac minis, the same team shipped the idea to the public, and no user needs a Mac mini. Muse, which Meta launched on September 8, "runs on its own dedicated computer in the cloud, contained so no one else's agent can reach it." Every user gets one.
Put plainly, the always-on personal agents of September run on one cloud machine per person, with memory, an approval check that sits outside the model, and a record of everything the agent did. Consumers got dedicated agent computers first. A company whose agents still run on a developer's laptop is now behind a free phone app.
What Meta actually shipped
Meta's announcement is unusually specific about the machine, so I will quote it. Muse runs on Meta's Muse Spark model. It "keeps working after people close the app, and comes back when something changes." It can send an email, book travel, "open a browser, fill out forms, and negotiate on their behalf," and check out with Stripe's Link.
Four details describe the computer underneath:
- One machine per person. The agent and the person's connected data live on a dedicated cloud computer that no other user's agent can reach.
- A check outside the model. "A separate Sentinel agent runs on that same machine, kept apart from Muse at the system level. Nothing Muse does reaches the internet unless the Sentinel approves it, and it asks the person for permission when needed." Muse also "checks with the person before sensitive actions like sending an email or making a purchase."
- Credentials the agent never sees. "Any credentials a person shares with Muse go into secure storage, so Muse can use them without seeing them."
- A record. "Muse shows people a complete audit trail of everything it has done and plans to do." It remembers what matters to a person, who can tell it to forget specific things.
A consumer product now treats all four parts as the default, for everyone, at no charge for "most of what people need."
Then it reached millions
Sensor Tower estimated that Muse passed 5 million US downloads by September 30, 22 days after launch. ChatGPT took 56 days to reach the same mark, Grok 103 and Claude 492 (TechStartups, October 1, 2026, citing Sensor Tower).
The number deserves its caveats. Downloads measure installs. Meta pushed the app hard: Sensor Tower found that Meta promoted Muse through its own house ads shortly after launch, and Meta bought ads on Reddit, TikTok and YouTube as well. Grok and Claude were limited to iOS for their first five days, while Muse launched on iOS and Android at once. Read the number as a measure of reach.
Even with every caveat applied, 5 million US downloads put dedicated agent computers at consumer scale (TechStartups, October 1, 2026). That changes what counts as normal.
A second company, one part of the shape
Instinct, from a San Francisco company called Spear Street Technology, shares one part of the shape: the agent works on a computer the person does not operate. Its own site says: "You can text or call it. It can use a phone and computer in the same way that humans do" (instinct.com). It is invite-only, and investors priced the bet at $10 billion in a $1 billion round announced September 28 (Fortune, September 30, 2026).
Its site does not describe memory, an approval check or an audit trail, so the comparison stops there. On that one part, two very different companies point the same way: the person talks to the agent, and the agent does the work on a computer the person never has to touch.
Where most companies' agents still run
Now compare that with how a lot of agent work at companies runs today. I'll include us. Our own writing agent spent the summer on OpenClaw on a spare Mac. Meta's team started the same way, with a desk of Mac minis.
A laptop or a spare Mac is a fine place to learn what an agent can do. It is a poor place to run one that other people depend on, and the gaps line up exactly with the four parts Meta built:
| Muse, a free consumer app | An agent on a developer's laptop | |
|---|---|---|
| Whose machine | One cloud computer per person, unreachable by other agents | The developer's own, shared with their browser, SSH keys and email |
| When it runs | Keeps working after the app closes | Stops when the lid closes or the Mac sleeps |
| What can leave | A separate agent approves every request to the internet | Whatever the agent's process can reach |
| Credentials | In storage the agent uses without seeing | Usually in an environment file the agent can read |
| The record | A full audit trail, done and planned | A terminal scrollback, if anyone kept it |
The right column describes most agent setups I have seen this year, including several of ours. It worked because a person was always watching. An always-on agent means nobody is watching, which is why Meta put a second agent on the machine to do the watching.
The demo problem I wrote about in Every Agent Demo Hides the Same Number shows up here too. A laptop setup looks fine for the same reason a demo does: the cost of a bad action is set to zero because a human is in the loop. Take the human out and every row of that table becomes a production question. And once you run more than a few agents, each one also needs an address you can find it at, the problem in An Agent You Can't Find Is an Agent You Don't Have.
What this means for companies
The consumer version sets the expectation. When the person who files your expense reports has an agent on its own cloud computer that asks before it spends money, they will ask why the agent touching your production repository runs on someone's laptop with a copy of every key.
Companies need the same four parts, with company-shaped answers: the machine belongs to one run inside a project, the record has to be readable by everyone on the team, and the result has to come back with proof that someone else can check.
That is what we build Rush to do. A caller sends a request; the agent does the work in its own cloud sandbox, one microVM per run, with a computer and a browser. By default a run is resumable: when it goes idle the sandbox pauses with its memory and disk intact and wakes on the next follow-up, so the agent keeps its computer between turns. The full trajectory of what the agent did is captured and readable through the API, a person can watch the agent's screen live and take control under an expiring, exclusive lease, and a run whose proof is missing ends as needs_review.
Honest limits. Rush has nothing like Sentinel yet. Approvals that reach a person from inside the sandbox are still being built. Meta shipped that part to consumers first, and we are catching up to it.
The bar moved in September
For two years, "an agent on its own computer" sounded like infrastructure only a large company would bother with. In September, Meta gave one to anyone with a phone in the US, and a startup reached a $10 billion price for a version you text. The person on your team with the most careful agent setup may now be the one using a free consumer app. Every company running agents on laptops should take that as the new floor.
