Muse vs Instinct, compared on what each one actually runs
Muse vs Instinct is usually written as a feature list, because a feature list is what both companies publish. That comparison tells you almost nothing, since every personal agent claims email, calendar, browsing and memory. We took both apart at the runtime level instead, and the differences that turned up are structural: they run in different places, they are reached in different ways, they expose their capabilities using opposite philosophies, and they keep what they know in stores built to different rules. Those differences decide what each one can do for you and what each one can do to you.
- They are not the same shape of product. One lives on the web with a Linux machine of its own behind it. The other lives in the messaging apps you already have.
- The tool surfaces are opposite by design. One separates permissions from definitions and loads schemas only when needed. The other ships a command line and refuses to run an action until its manual has been read.
- Memory is where the gap is widest, and it is the part that decides what each one can quietly retain about you.
- Completion rates exist for both, but they rest on very different amounts of exam, and we do not rank them.
The two runtimes, side by side
| Axis | Muse | Instinct |
|---|---|---|
| Where it runs | One Linux VM per user. The request is assembled on that machine rather than fetched as a finished blob. Browser work spawns a second, separate machine. | Server orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk. |
| How tools are exposed | Two layers kept deliberately apart: a permission sheet of 246 methods carrying no parameters at all, and the real definitions loaded a namespace at a time when needed. | A command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt. |
| Where memory lives | Plain markdown in a home directory, embedded straight into the request. Changing one of those files inserts a short note rather than rebuilding the whole package. | Three stores that do different jobs: a read-only markdown set, an observation log, and a fill-only vault for secrets. |
| How you reach it | Web is the real surface. A messaging channel exists but is not where the product lives. | Messaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel. |
| What we could not establish | The raw traffic between the runtime and the model: structure known, contents never seen. Also credentials, live third-party sign-in, and an interactive terminal the owners chose not to open. | The body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for. |
| Completed, whole exam | 19%13 to 25 · 90 tasks | 43%36 to 50 · 159 tasks |
Every cell above comes from our own teardown of that product, and each one links to the full write-up. The rows are the same five questions we ask of everything on this bench, in the same order, which is the only reason the columns can be read across at all.
Where each one actually runs
Muse gives each user a Linux VM. The request that goes to the model is assembled on that machine rather than arriving from a server as a finished package, and browser work spawns a second, separate machine. That is an unusual amount of dedicated infrastructure per person, and it is the single fact that explains most of the rest of the product.
Instinct orchestrates from a server, with the work itself running in a sandbox. Browser tasks use a leased cloud browser rather than the Chrome on your desk.
The practical difference is where the state lives between tasks. A machine that is yours can keep a working directory. A sandbox that is leased for a job is designed to go away. Neither is better in the abstract, and they lead to different answers when something goes wrong halfway through a task.
How you reach each one
This is the most visible difference and the one most people notice first.
Muse is a web product. A messaging channel exists, but the web is where the product actually lives.
Instinct is the opposite. WhatsApp, SMS and iMessage are the default surface, plus an address on a mail domain the product gives you. Its web app is mostly an admin panel.
An agent on the web can show you a plan, let you change step four, and run the rest. An agent in a message thread has to decide, act, and then describe in prose what it did. When you are weighing which of these to trust with something expensive, that structural gap matters more than any feature either one lists.
What each one can see
This is the question most comparisons skip, and it is the one with real consequences.
Muse separates its permission sheet from its tool definitions. The permission layer is a list of methods carrying no parameters at all, and the real definitions load a namespace at a time when they are needed. That is a deliberate boundary: the thing that says what is allowed is not the thing that says how to do it.
Instinct exposes a command-line surface instead of a function list, and enforces a rule that an action will not run until its own help text has been read. That makes the documentation part of the prompt, and part of the bill.
Both designs are defensible and they optimise for different failures. The permission-sheet approach makes it easier to reason about what is allowed without loading everything. The mandatory-manual approach makes it harder for the model to call something it has not read about.
Why the tool counts disagree
If you compare the headline numbers in the table above, treat them as measurements of different things rather than as a score.
Instinct's surface produced three different totals depending on who was counting: the product's own count, our auditor's count, and a raw count of distinct action names, with only some of those carrying a full manual. We published all three rather than picking the flattering one, and the teardown explains where each number comes from.
Muse's number counts methods on a permission sheet, which is a different object entirely from an action on a command line. Putting the two side by side and declaring a winner would be the single most misleading thing this page could do.
What each one remembers
Muse keeps memory as plain markdown in a home directory, embedded straight into the request. Editing one of those files inserts a short note rather than rebuilding the whole package. The practical consequence is that you could open it. What the product believes about you is a file, not an inference buried in a vector store.
Instinct splits memory into stores that do different jobs: a read-only markdown set, an observation log, and a fill-only vault for secrets. That last one is the interesting piece, because a vault built to fill and never to reveal means the agent can complete a login without the password passing through its conversation.
Those are genuinely different privacy stories. One is inspectable. The other is compartmentalised. Which you prefer depends on whether you want to audit what it knows or limit what it can leak.
What neither of them will tell us
Both teardowns end with a list of what we could not establish, and those lists are not symmetrical.
For Muse, the raw traffic between the runtime and the model is known in structure and never seen in contents, along with credentials, live third-party sign-in, and an interactive terminal the owners chose not to open.
For Instinct, the body of the main instruction set never surfaced, only its section headings, and the same goes for which host the main agent runs on, the production model id, and several named policy sections we found pointers to but no text for.
Publishing those gaps is the point. A comparison that presents itself as complete has either seen everything, which nobody has, or is quietly filling holes with assumption.
Where the difference shows up in practice
Runtime differences sound abstract until you point them at an errand, so here is where each one starts to matter.
On cancelling a subscription and disputing a charge, the channel difference is the whole story. A retention offer or a choice between a merchant refund and a bank chargeback is a decision about your money that should come back to you. A web product has a surface to put that decision on. A message thread has to write it as a sentence and hope you read it before the agent moves on.
On claiming for a delayed flight, the memory difference matters more. Evidence has to survive between sessions, and a home directory of markdown files you could open is a different proposition from a store you cannot inspect.
On organising work files, the execution difference dominates, because a machine that persists and a sandbox leased for one job are not the same tool for a job measured in file trees.
On coordinating a household and getting a table, both of them have to ask questions, and the surface that question arrives on decides whether you answer in time.
On filtering live alerts, the thing that decides everything is whether an agent can wake itself up, which is the capability that makes proactive help possible and unsolicited interruption possible at the same time.
What the numbers do and do not say
The completion row in the table is each product's share of every task in our exam, not a head to head on one errand.
Read it with its interval and its sample count attached, because they are not the same size. One of these columns rests on substantially more scored tasks than the other, and one of the figures moved considerably after we fixed defects in our own adapter rather than because the product changed. That correction is documented on the scorecard rather than quietly folded in.
We publish no combined score and no ranking. Deciding how many unauthorised actions equal one missed deadline is a trade you make, not one we make for you, and the reasoning is set out in how scoring works. A single blended number would hide exactly the differences this page exists to show.
FAQ
What is the main difference between Muse and Instinct? Where they run and how you reach them. Muse is a web product with a dedicated Linux machine per user behind it. Instinct lives in the messaging apps you already use, with the work running in a sandbox. Almost every other difference follows from that one.
Which is better, Muse or Instinct? We do not publish a ranking, and this page does not pick one. They have different runtimes, different tool philosophies and different memory designs, and the completion rates we do have rest on different amounts of exam. What is useful is knowing which differences matter for what you want to delegate.
Can Instinct read my passwords? Its memory includes a vault built to fill and never to reveal, which means it can complete a login without the password appearing in the conversation. That is a design choice with real consequences, and the Instinct teardown covers what we could and could not establish about it.
Does Muse really give every user their own Linux VM? That is what our teardown found: one Linux VM per user, with the model request assembled on that machine rather than fetched as a finished package, and browser work spawning a second machine. The Muse teardown sets out the evidence and the limits of it.
How current is this comparison? The date at the top is when we last verified these findings against the products. Both are shipping quickly, and a page like this goes stale faster than an ordinary review, which is why we date it rather than implying it is timeless.