Meta Muse Uses Isolated Execution Units, a Credential Broker, and Sentinel to Control Every External Side Effect of Its Agents

Meta has launched Muse, a personal agent that can operate a browser, connect to email and calendars, create tools, and run long-running tasks in the background, while also publishing its security architecture. What stands out is not its typical consumer features, but the system’s explicit assumption that the core model may make mistakes or be manipulated by prompt injection embedded in webpages, images, and downloaded files. It then uses operating-system isolation and a separate authorization path to limit the resulting damage.

Each user gets a dedicated Linux VM. The agent framework, workspace, tools, and agent-generated code reside in a `systemd-nspawn` runtime cell. Root inside the container is mapped to an unprivileged user on the host, with additional restrictions on syscalls, capabilities, virtual network interfaces, and a separate root filesystem. OAuth tokens and other secrets are stored outside the cell by `hatch-authd`, while `privsep` workers execute connectors with only the permissions they require. Components communicate through Unix domain sockets protected by `SO_PEERCRED` and ACLs. As a result, even if the agent gains control inside the container, it should not be able to read the real credentials directly.

All connector operations and network egress are instead submitted to a separate host-side Sentinel, which decides whether to allow or deny them or require user confirmation. The browser sub-agent receives only the accessibility tree; it has no access to the raw DOM, the ability to execute in-page JavaScript, or DevTools. Login credentials are sent directly from the client to secure storage and injected into the page only when needed. Every shopping action requires confirmation, while payments without a stored card use a one-time card number restricted by merchant, amount, and expiration. These designs separate “proposing an action” from “authorizing its side effects,” offering a useful reference for enterprise agent platforms as well.

However, Sentinel still includes models and classifiers, so it cannot be treated as a formal security boundary. Meta also acknowledges that prompt injection remains unsolved. The current architecture relies on policy controls to restrict access by Meta personnel and does not yet cryptographically exclude the service provider. The promised Confidential VMs, source-code release, and continuous external audits will not arrive until later. Reasoning traces may still be used for training after some personal data is removed, and users must actively opt out. Security researchers should next test whether cross-domain data exfiltration, semantic confusion of Sentinel, browser takeover handoffs, or custom-built connectors can breach these boundaries, rather than simply accepting the isolation claims shown in architecture diagrams.