Agent applications
Meta AI Connects to Gmail and Google Calendar as Muse Spark 1.1 Begins Running Cross-App Personal Workflows
Meta has deployed Muse Spark 1.1’s planning and tool-use capabilities to Meta AI, enabling the assistant to read email and calendars and create persistent outputs such as presentations. The update expands the private context accessible to the model, but the company has not disclosed tool permissions, revocation mechanisms, or end-to-end task success rates.
Meta expanded Meta AI’s agentic capabilities on July 24, enabling Muse Spark 1.1 to do more than answer questions: it can connect to Gmail and Google Calendar, develop plans, compile daily updates, conduct multi-step research, and create presentations. Outputs such as training plans, slide decks, and mood boards are saved in one place so users can continue editing or share them later, rather than losing their work state when a single chat ends.
The key change in this release is at the tool and state layers, rather than the introduction of a new foundation model. Muse Spark 1.1 launched in early July, when Meta emphasized its capabilities for longer-running tasks, coding, and agentic workflows, while also offering a developer API for the first time. The latest update connects those capabilities to real-world personal data sources. For a daily briefing, for example, the agent can check email and schedules simultaneously, then assemble a to-do list based on the user’s goals. Compared with simply inserting retrieval results into a prompt, these workflows require managing OAuth authorization, cross-service identity, tool-call sequencing, persistent state, and recovery from failures.
For developers, Meta’s direction shows that large-scale consumer assistants are shifting from chat interfaces toward execution environments equipped with memory and external tools. Email and calendars also contain large amounts of unstructured content, giving models access to richer personal context. That same feature, however, increases prompt-injection risks: a malicious email, for example, could introduce textual instructions into the agent’s planning process. If the agent does not clearly distinguish data from instructions, read access could be indirectly converted into unintended actions.
Meta has not explained which granular permissions its connectors use, whether sensitive actions require step-by-step confirmation, how long data is retained, or whether email content will be used for model improvement. The company has also not published multi-step task completion rates, tool-call error rates, or independent third-party evaluations; Axios noted that its level of autonomy still trails some competing products. Engineering teams should therefore focus on whether authorization scopes can be audited and revoked, whether every step leaves an inspectable trace, and whether reliable prompt-injection isolation is applied before external content reaches the planner.