How to Install Claude Code Inside Meta Muse — and Is It Allowed?

Short answer: yes, you can, and as far as either company's rules go, you're allowed to. Muse — Meta's personal AI agent, still the #1 free app on both US app stores today — runs each user on a dedicated Linux VM, and Meta's David Singleton said this week that 'you can install software in it, write and compile code… it is your own Linux box.' On Saturday MacStories' Federico Viticci showed Muse installing Claude Code, Anthropic's terminal coding agent, and signing into his Claude account through Muse's own browser. There is no terminal. You ask Muse to do it in chat, hand it your Claude login in a browser window it can't see, and from then on Muse can delegate work to Claude Code — including Claude's own connectors. Here's exactly how it went, what it costs, and where the lines are.

First, what Muse's 'computer' actually is

Meta's security paper describes it: 'You and your Muse share your own dedicated computer in the cloud… an isolated linux box with a browser and enough storage, CPU, and memory to do real work,' running in a container with 'its own root filesystem.' Singleton's post on September 24 put it in plain terms: 'Today, every Muse user gets a free computer in the cloud. It's a real computer… Activity in the runtime cell, which you share with your Muse, is unfettered, but sensitive actions are all overseen by the Sentinel… Poking around in this computer doesn't give you any privileged access to Meta infrastructure, or to other people's data.'

The specs are user-reported, not Meta-published: people who asked their Muse got back Ubuntu 24.04 on 2 vCPUs of an AMD EPYC, about 8 GB of RAM, a 100 GB persistent home volume, and no GPU (Stark Insider, Tom's Hardware). Meta's paper calls the image Debian; Muse itself reports Ubuntu; either way it's a Debian-family box where anything in your home directory survives restarts. No inbound ports, no sudo (a kernel query failed on permissions in one test), and all outbound traffic passes through Sentinel, which is 'the sole permission authority… for all egress over the network.'

The steps, as they actually happened

• 1. Ask. In chat: 'Install Claude Code so it persists.' Viticci's Muse offered two routes first — an API key it would store 'in the Secure Vault so it never touches chat or files,' or signing in with a Claude account. He chose the account.
• 2. Muse installs it. Its report: 'Installed: Claude Code 2.1.283, in ~/.local so it survives VM restarts, with ~/.local/bin added to your PATH.' That's the standard Claude Code install location; the /workspace/tools path circulating online is where Muse put a different CLI (a Pocket Casts tool) in Viticci's second demo, alongside a skill file at ~/workspace/skills/. Neither path is Meta-documented; they're just where Muse chooses to keep things.
• 3. Sign in through Muse's browser — you take the wheel. Muse: 'I started claude auth login — it's sitting at the paste-code prompt. I've opened Anthropic's authorization page in the VM browser. Take over the live browser session and sign in with your Claude account yourself, then authorize the Claude Code app. I never see your password. Once you authorize, the page shows a one-time code — the browser will hand it to me and I'll feed it straight into the waiting CLI.' The app shows a 'Needs you · claude.ai' sheet with a 'Take control of the browser' button; you complete Anthropic's normal OAuth page.
• 4. Verify. Muse ran a test call and reported 'auth works… the CLI isn't just holding a token file; it's making authenticated calls successfully.'
• 5. Use it. Viticci's first task used Claude's Slack connector through Muse: 'Claude has Slack connected. Tell me what's the latest message from John in the writing channel.' Muse asked Claude Code, which answered.

One earlier builder went further. On September 10, Greg Ceccarelli got Claude Code running inside Muse and, because 'the VM has no inbound ports,' built 'a tiny xterm.js emulation of a terminal' bridged by a scheduled task: 'Every 5 seconds my Muse agent wakes up, checks for a pending prompt, shells out to claude -p, and posts the result back.' Clever — and, as we'll get to, the kind of setup that burns Muse tokens around the clock.

Is it allowed? Both companies' terms, read closely

Our reading: the setup Viticci demonstrated — unmodified Claude Code, his own subscription, Anthropic's own sign-in flow — is inside both companies' published rules. The gray area is automation: if you build a loop where Muse fires Claude Code every few seconds without you, you're closer to the 'automated means' and 'ordinary, individual usage' language than Anthropic probably intends, and Anthropic's support page is explicit that 'claude -p, and third-party app usage still draw from your subscription's usage limits.' Use it as a tool Muse reaches for, not a server.

What it costs — in two currencies

• Claude: every Claude Code call bills your Claude plan's limits, same as running it on your Mac. A Pro plan's five-hour window is the ceiling; Max plans raise it. Opus 5.5 is now the default Opus, which is a lot of model to hand a second agent.
• Muse tokens: Meta doesn't define a Muse token or say whether VM time counts. Claude Code's inference doesn't touch Meta's meter — but every Muse turn that wraps it does. A scheduled task waking every five seconds is a Muse-token faucet; a task you ask for once is not. Nobody has measured either.
• Reliability gotchas from people who've tried: the VM's outbound proxy rotates credentials 'every few minutes, causing 407 errors' for long-running daemons, there's 'no systemd support' so background processes don't restart themselves, and installs that need to authenticate to GitHub can fail (Viticci's Pocket Casts clone did). Claude Code's own network calls worked in both reports.

Why this matters more than a party trick

Viticci's second post is the better one: Muse is 'a fascinating case study in hiding complexity in AI tools… very simple and fast by default. But if you poke around, you can install custom CLIs in its VM… and inspect its entire log of tool calls.' That's the shift. A week ago Muse read as a chatbot that shops; this week it reads as a computer with an agent on it, where the agent is swappable. Meta's model does the errands, the browser, the permissions; Anthropic's model does the code. Nothing in the category works this way — Grok Bot has a terminal but nobody's reported another lab's agent inside it, and ChatGPT Work's cloud environment has no user-facing shell at all.

Two things to keep in proportion. The '1–4 GW to serve 100 million users' figure making the rounds is an analyst's back-of-envelope built on those user-reported VM specs and a hypothetical user count (Tom's Hardware cites over 500,000 daily actives), with her own caveat that 'there are obviously a lot of moving assumptions' — not a Meta disclosure. And Muse's #1 ranking is real but says nothing about retention: Apple's chart today shows Muse first, ChatGPT third; Google Play the same.

Should you do it?

• Yes, if you already pay for Claude, you want Muse to be able to hand off real coding or use Claude's connectors, and you're comfortable with two companies' agents sharing one box. Sign in via the browser handoff, not an API key in chat.
• Think twice if your Claude plan is your daily coding tool — a second agent draining the same five-hour window will surprise you — or if you've connected Gmail, Plaid, and Link to Muse and would rather not add another party to that VM. Our safety guide covers what lives there.
• Don't build the always-on bridge unless you understand you're paying Meta for a heartbeat and testing Anthropic's patience on 'ordinary use.'

Our read

Meta shipped a personal computer and called it an assistant, and the power users noticed first. Singleton's 'it is your own Linux box' is a bigger claim than anything in the Connect keynote, because it means Muse's moat isn't the model — it's the VM with your logins, your permissions, and your files, onto which you can install whoever's model is best this month. That's a strange and confident bet for a company that also sells the model. It's also the clearest answer yet to the question our Muse vs Instinct vs Grok Bot guide left open: what's Muse for once the novelty wears off? For a normal person, errands. For the rest of us, apparently, a free computer.