nanoMuse: An Open-Source Personal Agent That Runs on All My Devices

Problem

Starting with Meta Muse in September 2026, a series of 'personal agent' products appeared that take long-term charge of one person's accounts, devices and memories. However, all of them are closed systems that run in vendor clouds with one VM per person. The authors argue that an agent handling a person's life should be inspectable by that person and should run on hardware they already own. Yet no complete open-source alternative met these conditions.

Method

First, the authors define a personal agent through five questions (what it knows, where it acts, whom it is accountable to, how it learns, and cost and governance) and three time horizons. Next, they analyze Muse's architecture based on Meta's public documents and a copy of Muse's production system prompt. Each statement is labeled with its source (documented/prompt/observed/inferred). Finally, they present nanoMuse. It consists of Android, iOS, desktop and web apps plus a relay that anyone can run, and all devices share a single conversation. On Android and desktop, it directly operates the device screen. Every action goes through a per-device Sentinel approval, and memory is stored as human-readable files. The user chooses the model.

Results

• From their analysis of Muse, the authors report that its technical core is a standard tool-calling agent (including sub-agents and scheduled tasks). They conclude that what sets it apart is a design that places all safety mechanisms outside the agent (Sentinel, delegated tokens, kernel-level taint tracking) and a UI that is easy for users to understand.
• nanoMuse 0.1.40 was released under GPL-3.0 with Android, iOS (TestFlight), macOS/Windows/Linux desktop and web apps, and a relay (nanoMuse Cloud).
• According to the comparison table, nanoMuse is the only system that operates both phone screens and computer screens. However, iOS does not allow apps to control other apps, so screen control is missing there.
• There are no quantitative benchmark results. System scale and costs are given only as estimates.

Limitations

This is a technical report without performance evaluation. Scale and costs are also estimates. As the authors state, nanoMuse lacks its own model, per-person VMs and kernel-level taint tracking, delegated credentials and a wallet feature. Source-labeled memory, an evaluation set for screen control and an open model for screen control are still on the roadmap. Parts of the Muse analysis are the authors' inferences (inferred) or rest on a copy of the prompt. Screen control is limited to Android and desktop.

Why it matters

As closed cloud-based personal agents multiply, this work offers a blueprint for an open-source alternative that runs directly on devices and whose internals can be inspected. It can serve as a reference point for comparing personal agents' safety architecture (approval scope, file-based memory) and the scope of their screen control.

Key terms

Personal agent

Software that handles a person's accounts, devices and files on their behalf, keeps memory over weeks, sometimes starts conversations on its own, and is accountable for what it has done through records.

Sentinel

A separate permission layer that decides whether to allow actions the agent proposes. It limits what the agent can do even if the agent is persuaded to misbehave.

Relay

A relay server that connects a user's devices so they share a single conversation. In nanoMuse, it is open source and optional.

Computer Use (screen control)

A capability in which an agent looks at screenshots or the accessibility tree and directly operates other apps by clicking and typing.

Original

• arXiv abstract
• PDF
• HTML full text
• Code
• Project
• Hugging Face

Authors: Guangyi Liu, Yong Liu, Jiangning Zhang · Posted 2026-10-06 · License CC BY 4.0 · Based on the full text

This review is an AI-written summary of the paper. Please treat the original paper as the reference.