Also in日本語简体中文한국어

Three differences

InstinctMuse

What it is

Instinct Lives in your messaging apps rather than in a new interface.

Muse Meta's personal agent, with a Linux machine of your own behind it.

Tools

Instinct ships a command line and refuses to run an action until its manual has been read.

Muse separates permissions from definitions and loads schemas only when needed.

When you approve

Instinct puts the question on a card. Approval binds to the exact text shown.

Muse routes the question through one gatekeeper, with an approvals tab beside the activity feed.

What it remembers

Instinct splits memory into stores that do different jobs, including a fill-only vault for secrets.

Muse keeps memory as plain markdown in a home directory, embedded straight into the request.

Instinct AI vs Muse, or Meta Muse vs Instinct, is usually written as a feature list, because a feature list is what both companies publish. That comparison tells you almost nothing, since most personal agents claim email, calendar, browsing and memory. We took both apart at the runtime level instead, and the differences that turned up are structural: they run in different places, they are reached in different ways, they expose their capabilities using opposite philosophies, and they keep what they know in stores built to different rules. Those differences decide what each one can do for you and what each one can do to you.

• The short answer, set out by errand further down: Instinct AI for errands handed over by text, Meta Muse for an agent on a machine of its own, neither yet for an errand that needs a phone call.
• They are not the same shape of product. One lives on the web with a Linux machine of its own behind it. The other lives in the messaging apps you already have.
• The tool surfaces are opposite by design. One separates permissions from definitions and loads schemas only when needed. The other ships a command line and refuses to run an action until its manual has been read.
• Both keep memory as markdown files. They differ in where those files sit, what happens to a corrected fact, and how secrets are kept apart.
• The September main-table rates use different task sets. A separate older 114-task batch and the October 20-task batch each give both the same tasks; they sit side by side below, never merged.

The basics first, since every other write-up leads with them. Muse is Meta's. Meta's launch post of 8 September says it is rolling out in the US on iOS, Android and the web (Meta's Japanese newsroom adds Japan from 23 October, and its Singapore announcement adds Singapore from 27 October), and is free for most of what people need, with subscription plans for people who want to do more. Instinct is made by Spear Street Technology, Inc., founded by Noah Shinn. TechCrunch reported that it launched invite-only in August 2026, and in The Verge's hands-on you needed an invitation from a current user or approval from a waitlist. Instinct publishes no price. What each one says about money is on the teardown pages, Muse and Instinct, so it is kept in one place.

On privacy, Meta says conversations and VM data stay out of its ad systems, while Sentinel gates network access. Our Instinct teardown found a separate credential vault designed to fill secrets without revealing them. These describe different controls; neither statement is a general guarantee against data exposure.

Instinct AI and Meta Muse runtimes, side by side

Show the scorecard rows

Axis	Muse	Instinct
Where it runs	One Linux VM per user. The request is assembled on that machine rather than fetched as a finished blob. Browser work spawns a second, separate machine.	Server orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk.
How tools are exposed	Two layers kept deliberately apart: a permission sheet of 246 methods carrying no parameters at all, and the real definitions loaded a namespace at a time when needed.	A command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt.
Where memory lives	Plain markdown in a home directory, embedded straight into the request. Changing one of those files inserts a short note rather than rebuilding the whole package.	Three stores that do different jobs: a git-tracked set of markdown memory files, an indexed layer of connector data it can query, and a fill-only vault for secrets.
What you get to approve	Permissions and approvals are not scattered through the runtime. A single gatekeeper is the only path to them, along with anything leaving the machine, and the interface carries an approvals tab beside the activity feed. Credentials are held outside the agent's reach by the same arrangement. The examined runtime includes file removal and a forget capability. Whether users can directly open or remove their memory files was not verified.	An approval card with three answers rather than two: approve, deny, or dismiss. It carries the plan and names which device will run it. Approval binds to the exact text shown, not to the request that produced it, so a rewrite needs a new approval. Its own rules forbid an unseen assumption from riding along with an irreversible send, and it will produce a receipt on request: what it read, what it sent, what it did not touch. Deletion has a documented surface covering storage, training, location and desktop indexing.
How you reach it	Launched on iOS, Android and the web, and reachable in WhatsApp. A Mac app since 17 September can act in apps on your computer. We tested the web surface only.	Messaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel.
What we could not establish	The raw traffic between the runtime and the model: structure known, contents never seen. Also credentials, live third-party sign-in, and an interactive terminal the owners chose not to open.	The body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for.
Completed, scored subset	19%13 to 25 · 90 tasks	43%36 to 50 · 159 tasks

Where it runs

MuseOne Linux VM per user. The request is assembled on that machine rather than fetched as a finished blob. Browser work spawns a second, separate machine.

InstinctServer orchestration with work running in a sandbox. Browser tasks use a leased cloud browser, not the Chrome on your desk.

How tools are exposed

MuseTwo layers kept deliberately apart: a permission sheet of 246 methods carrying no parameters at all, and the real definitions loaded a namespace at a time when needed.

InstinctA command-line surface rather than a function list: 43 families and 571 actions by the product's own count, and three different totals depending on who is counting. An action refuses to run until its own help text has been read, which makes the manual part of the prompt.

Where memory lives

MusePlain markdown in a home directory, embedded straight into the request. Changing one of those files inserts a short note rather than rebuilding the whole package.

InstinctThree stores that do different jobs: a git-tracked set of markdown memory files, an indexed layer of connector data it can query, and a fill-only vault for secrets.

What you get to approve

MusePermissions and approvals are not scattered through the runtime. A single gatekeeper is the only path to them, along with anything leaving the machine, and the interface carries an approvals tab beside the activity feed. Credentials are held outside the agent's reach by the same arrangement. The examined runtime includes file removal and a forget capability. Whether users can directly open or remove their memory files was not verified.

InstinctAn approval card with three answers rather than two: approve, deny, or dismiss. It carries the plan and names which device will run it. Approval binds to the exact text shown, not to the request that produced it, so a rewrite needs a new approval. Its own rules forbid an unseen assumption from riding along with an irreversible send, and it will produce a receipt on request: what it read, what it sent, what it did not touch. Deletion has a documented surface covering storage, training, location and desktop indexing.

How you reach it

MuseLaunched on iOS, Android and the web, and reachable in WhatsApp. A Mac app since 17 September can act in apps on your computer. We tested the web surface only.

InstinctMessaging first. WhatsApp, SMS and iMessage are the default surface, plus an address on its own mail domain. The web app is mostly an admin panel.

What we could not establish

MuseThe raw traffic between the runtime and the model: structure known, contents never seen. Also credentials, live third-party sign-in, and an interactive terminal the owners chose not to open.

InstinctThe body of the main instruction set (only its section headings surfaced), which host the main agent runs on, the production model id, and four named policy sections we found pointers to but never text for.

Completed, scored subset

Muse19% · 95% interval 13–25% · 90 scored tasks

Instinct43% · 95% interval 36–50% · 159 scored tasks

The completion row covers differing September scored subsets of adapted product runtimes using the substituted exam model, not shipping consumer products. Underlying first-batch records are unpublished; Muse's rate follows an adapter repair. Result provenance and limitations. Neither figure is a ranking and we never combine them. As of 2026-09-22.

Every cell above comes from our own teardown of that product, and each one links to the full write-up. The rows are the same six questions we ask of everything on this bench, in the same order, which is the only reason the columns can be read across at all.

Where Instinct and Muse actually run

Muse gives each user a Linux VM. The request that goes to the model is assembled on that machine rather than arriving from a server as a finished package, and browser work spawns a second, separate machine. That is an unusual amount of dedicated infrastructure per person, and much of what we found about Muse sits on that machine.

Instinct orchestrates from a server, with delegated work running in a sandbox. Browser tasks use a leased cloud browser rather than the Chrome on your desk.

The practical difference is where working state can sit between tasks. Muse's VM keeps a home directory. Instinct's delegated work runs in a sandbox, and what carries over is what it writes to its memory stores; we did not establish how long a sandbox lives. Neither is better in the abstract, and they may lead to different answers when something goes wrong halfway through a task.

How you reach Instinct and Muse

This is the most visible difference and the one most people notice first.

Muse launched on iOS, Android and the web, and Meta's launch post says you can also talk to it directly in WhatsApp. A Mac app followed on 17 September. The surface we took apart was the web one, and that is the surface the rest of this page describes.

Instinct is the opposite. WhatsApp, SMS and iMessage are the default surface, plus an address on a mail domain the product gives you. Its web app is mostly an admin panel.

Check the available controls in your own account before delegating a consequential action.

What Instinct and Muse can each see

This is the question most comparisons skip, and it is the one with real consequences.

Muse separates its permission sheet from its tool definitions. The permission layer is a list of methods carrying no parameters at all, and the real definitions load a namespace at a time when they are needed. That is a deliberate boundary: the thing that says what is allowed is not the thing that says how to do it.

Instinct exposes a command-line surface instead of a function list, and enforces a rule that an action will not run until its own help text has been read. That makes the documentation part of the prompt, and part of the bill.

Both designs are defensible and they optimise for different failures. The permission-sheet approach makes it easier to reason about what is allowed without loading everything. The mandatory-manual approach makes it harder for the model to call something it has not read about.

That is also why the Instinct and Muse tool counts disagree. If you compare the headline numbers in the table above, treat them as measurements of different things rather than as a score.

Instinct's surface produced three different totals depending on who was counting: the product's own count, our auditor's count, and a raw count of distinct action names, with only some of those carrying a full manual. We published all three rather than picking the flattering one, and the teardown explains where each number comes from.

Muse's number counts methods on a permission sheet, which is a different object entirely from an action on a command line. Putting the two side by side as a contest would be the most misleading thing this page could do.

Instinct vs Muse: which one asks before it acts

Both ask. They ask in different places, and that decides what an approval actually covers.

Instinct puts the question on a card. In the account we examined, the card carries the plan, names the device that will run it, and offers three answers: approve, deny or dismiss. Approval binds to the exact text shown, so if the agent rewrites the message it needs a new approval. Its own rules forbid an unseen assumption from riding along with an irreversible send, and it will give a receipt on request: what it read, what it sent, what it did not touch. The card covers actions, not reading. In one reported case it found a login code in a connected inbox and used it without asking. The approval step is laid out in detail on its own page.

Muse routes the question through one gatekeeper. In the runtime we examined, permissions, approvals and anything leaving the machine all pass through that single path, and the interface keeps an approvals tab beside the activity feed. Credentials are held outside the agent's reach by the same arrangement. Meta says a grant can be one-time, per session, per task, time-limited or perpetual; we did not test those options.

So the practical check differs. With Instinct, read the card, because what you approve is exactly that text. With Muse, look at the grants you have left standing, because a grant that is not one-time can cover later requests without asking again.

What Muse and Instinct each remember

Muse keeps memory as plain markdown in a home directory, embedded straight into the request. Editing one of those files inserts a short note rather than rebuilding the whole package. Whether you can open those files yourself remains unverified; no interactive terminal was available to us. The memory we found is a set of readable files.

Instinct splits memory into stores that do different jobs: a git-tracked set of markdown memory files, an indexed layer of connector data it can query, and a fill-only vault for secrets. That last one is the interesting piece, because a vault built to fill and never to reveal means the agent can complete a login without the password passing through its conversation.

Both keep markdown, so the difference is in the detail. Muse's files sit in a home directory; we could not verify personal access to it. Instinct's are under version control, so a corrected fact stays in its history rather than vanishing, and its secrets live in a vault that cannot be read back. Which you prefer depends on whether you want to audit what it knows or limit what it can leak.

Can Instinct AI or Meta Muse make phone calls for you?

Both are reported to be reaching past software to a telephone, and we have confirmed neither. TechCrunch reported that Instinct has rolled out a concierge feature that phones businesses for you, for things like appointments at places that do not take online bookings. For Muse, the guidance Meta ships inside the product says it can call US businesses for your own tasks once you confirm, that the feature is in early access, and that it reaches accounts gradually. The account we examined never received it.

So we have seen neither make a call. What we can say is that a call is a different kind of action from a message or a click: a person on the other end, your account, and no undo. If calling is the reason you are choosing, Pine is the product built around it, and Muse vs Pine covers that pairing.

What neither of them will tell us

Both teardowns end with a list of what we could not establish, and those lists are not symmetrical.

For Muse, the raw traffic between the runtime and the model is known in structure and never seen in contents, along with credentials, live third-party sign-in, and an interactive terminal the owners chose not to open.

For Instinct, the body of the main instruction set never surfaced, only its section headings, and the same goes for which host the main agent runs on, the production model id, and four named policy sections we found pointers to but no text for.

Publishing those gaps is the point. A comparison that presents itself as complete has either seen everything, which nobody has, or is quietly filling holes with assumption.

Instinct vs Muse in practice: where the difference shows up

Runtime differences sound abstract until you point them at an errand, so here is where each one starts to matter.

On cancelling a subscription and disputing a charge, the channel difference decides how the money decision reaches you. Instinct is reported to have a calling concierge and Muse's business calling is in early access, but we have seen neither place a call, so do not count on either to phone the company. A retention offer or a choice between a merchant refund and a bank chargeback is a decision about your money that should come back to you. A web product has a surface to put that decision on. Instinct's observed approval card requires approve, deny or dismiss against exact plan text. Presentation in a message thread does not remove that gate.

On claiming for a delayed flight, the memory difference matters more. Evidence has to survive between sessions, and both keep markdown that persists. The difference is that Muse's sits in a home directory, though we could not verify user access, while Instinct's is version-controlled and the product decides what goes into it.

On organising work files, the execution difference is the one to check first, because a machine that keeps a home directory and a sandbox for delegated work are not the same tool for a job measured in file trees.

On coordinating a household and getting a table, both of them have to ask questions, and the surface that question arrives on decides whether you answer in time.

On filtering live alerts, the first thing to check is whether an agent can wake itself up, which is the capability that makes proactive help possible and unsolicited interruption possible at the same time.

If you want the short version as fit rather than as a ranking:

• Pick Instinct if you want to hand over errands from WhatsApp, SMS or iMessage without opening another app, and you want an approval card that shows the exact text of what it is about to do. We saw that card on the account we examined, though one user reported an August send that went out without checking first.
• Pick Muse if you want the agent working on a machine of its own, with its memory kept as files on that machine and its approvals collected in one tab.
• Pick neither yet if the errand needs a phone call. We have seen neither place one, and Pine is the product built around calling.

What the numbers do and do not say

The completion row in the table is each product's share of its own scored tasks, not a head to head on one errand.

Read it with its interval and its sample count attached, because they are not the same size. One of these columns rests on substantially more scored tasks than the other, and one of the figures moved considerably after we fixed defects in our own adapter rather than because the product changed. That correction is documented on the scorecard rather than quietly folded in.

We publish no combined score and no ranking. Deciding how many unauthorised actions equal one missed deadline is a trade you make, not one we make for you, and the reasoning is set out in how scoring works. A single blended number would hide exactly the differences this page exists to show.

On the separate 114-task batch, measured on 22 September 2026, Muse completed 40% (95% interval 33 to 46%; 637 attempts) and Instinct completed 52% (95% interval 45 to 61%; 380 attempts). Both answered the same 114 tasks. These are replicas of older runtimes with the same GLM 5.3 flash model substituted, under older rules, filtered from roughly 5,600 attempts using eight rules, not fresh product results. Excluding attempts that never reached the exam removes over 400 each for Pine and Muse; if those were refusals rather than broken entry, the supplied alternative estimates are about 22% for Pine and 24% for Muse. Transcripts were supplied but have not been republished here; some files were overwritten or shared between attempts, so the underlying record is incomplete. Keep this measurement separate from the main table and do not treat interval overlap or a point estimate as a significance test.

The October batch, run on 11 October 2026, gave every product the same 20 tasks once each, under the exam rules that took effect at the end of September. Muse completed 11 of 19 scored attempts, 58% (95% interval 36 to 77%), and Instinct 6 of 15, 40% (20 to 64%). The two intervals overlap widely. The order of the point estimates is the reverse of the September common-task batch, and that is not either product changing: the tasks, the rules and our replicas all changed in between, and one result more or less moves a rate by five to seven points. The batches are printed side by side and never added together. The other October batches, each with its own tasks and builds, are listed separately on the results page, and individual recorded attempts are on the run pages, as counts rather than rates.

The VM description is not the whole shipping product: Muse also has a Mac app, available since 17 September, that can act in apps including Messages and Notes. We examined the web runtime, not that Mac route, so this comparison does not establish how its local app access performs.

FAQ

What is the main difference between Muse and Instinct? Where they run and how you reach them. Muse is reached through Meta's apps, the web and WhatsApp, and a Mac app since 17 September that we have not examined, with a dedicated Linux machine per user behind them. Instinct lives in the messaging apps you already use, with delegated work running in a sandbox. Tools and memory differ too, and the sections above take each in turn.

Which is better, Muse or Instinct? We do not publish a ranking, and this page does not pick one. They have different runtimes, different tool philosophies and different memory designs, and the completion rates we do have come from separate batches that point in different directions and are never combined. What is useful is knowing which differences matter for what you want to delegate, and the short fit list above sets that out by errand.

Can Instinct read my passwords? Its memory includes a vault built to fill and never to reveal, which means it can complete a login without the password appearing in the conversation. That is a design choice with real consequences, and the Instinct teardown covers what we could and could not establish about it.

Does Muse really give every user their own Linux VM? That is what our teardown found: one Linux VM per user, with the model request assembled on that machine rather than fetched as a finished package, and browser work spawning a second machine. The Muse teardown sets out the evidence and the limits of it.

Who makes Muse and Instinct, and how do you get them? Muse is Meta's, launched on 8 September in the US, on 23 October in Japan and on 27 October in Singapore, and free for most use with paid plans. Instinct is made by Spear Street Technology, founded by Noah Shinn, and launched invite-only in August 2026, according to TechCrunch, and has no published price.

Can Muse or Instinct make phone calls for me? Possibly, but we have not seen either do it. Instinct has a concierge feature that calls businesses, according to TechCrunch. Muse's business calling was in early access according to the guidance inside the product, and the account we examined never received it. If you need an agent that phones a company for you today, Pine places calls from its servers and keeps a summary of each one.

How current is this comparison? The date at the top includes editorial and source checks; it does not mean every runtime observation was repeated that day. Both are shipping quickly, and a page like this goes stale faster than an ordinary review, which is why we date it rather than implying it is timeless.

Other comparisons

• Pine vs TownA borrowed browser or a Mac footholdPine AI vs Town AI: Pine thinks on its servers and borrows a browser; Town's Mac app reaches your messages, contacts, screen and audio. From our teardowns.
• Instinct vs TownInvite, and who asks firstInstinct AI vs Town AI: Instinct is invite-only and publishes no price; Town publishes prices, starting with a free plan. Instinct asks on a card; Town asks in the routine's settings.
• Muse vs PineAnd what a machine of your own is actually forMeta Muse vs Pine AI: Muse gives every user a Linux VM in Meta's cloud; Pine runs its model on its servers and borrows a browser. From our own teardowns.
• Muse vs TownAnd two things people call a machineMeta Muse vs Town AI: Muse gives each user a Linux VM in Meta's cloud; Town's native Mac app reaches your messages and screen. From our own teardowns.
• Pine vs InstinctTwo products that look identical from one step backPine AI vs Instinct AI: both think on a server. Pine is built around calls and borrows your browser; Instinct lives in your messages and leases one.

All six pairs, and why there are only six, are on the comparisons page.

More on Muse

• Meta Muse teardown
• Meta Muse reviewMeta Muse review roundup: what reporters who used it found, every reported incident, and how each one compares with our own teardown of Muse.
• Is Meta Muse open source?Is Meta Muse open source? The agent, app and cloud VM are closed. Muse Spark Open has open weights under a restrictive licence; Wonder and Ember have none.
• OpenMuse, open sourceOpenMuse is an open personal agent we can read rather than probe. What its source says about where it runs and what it stores, and the one part that is not.
• nanoMuse, public recordnanoMuse is an open-source personal agent in the shape of Meta Muse, on your own phone and computer. We have not tested it: what is public, and who said it.

More on Instinct

• Instinct teardown
• How Instinct AI worksHow does Instinct AI work? One errand traced from trigger to reply: what wakes it, how it picks tools, where it runs, what it remembers and when it asks.
• Instinct AI reviewInstinct AI review roundup: what reporters who used it got done and got wrong, how that maps onto our teardown, and our exam figures with intervals.
• Is Instinct safe?Is Instinct AI safe? Every incident users and reporters have described, from unchecked emails to login codes read from Gmail, checked against our teardown.