Meta Muse

Personal agent (cloud VM) · Meta · 5/7 verified · Last checked 2026-10-16

Each user gets an isolated cloud VM, and Meta says a separate Sentinel service is the only authority for connector actions and network egress. Scored from Meta's launch post only. Reports in Sep–Oct 2026 say Muse accessed data users had declined; Meta disputes this.

Overall: B (2.00 avg, 5/7 controls verified)

Lock this down first

Review the connector policy for each connected account and keep risky connectors on ask.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	Sentinel checks each connector action against a policy you set and decides allow, deny or ask. The agent can't override it. Launch-post claim only, capped at 2.
Human approval gates	2/3	When Sentinel decides to ask, execution stops and the client shows the exact action. Only narrowly bounded clean requests are auto-allowed. Not admin-lockable.
Sandboxing	2/3	The harness runs in a systemd-nspawn cell with root mapped to an unprivileged user, filtered syscalls and limited capabilities. On by default. Launch-post claim only, capped at 2.
Secrets handling	2/3	Credentials stay in a separate service. The agent sees surrogate tokens, and Sentinel swaps in real ones at the network boundary. Launch-post claim only, capped at 2.
Audit logs	Unverified	Not confirmed in the docs we checked.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	2/3	Every network request goes through Sentinel, which checks host, IP, port, method and path, with SSRF protection. Launch-post claim only, capped at 2.

Unverified: Audit logs, Kill switch / interrupt. That means we could not confirm it in public docs, not that it is missing.

Public reports

Independent reporting, not used for scoring.

2026-09-23 · Decrypt: Muse synced 187,000+ iMessage rows despite the user declining access
2026-09-29 · The Guardian: Muse arranged a visit to a reviewer's home without asking for approval
2026-10-01 · Decrypt: Meta says the Messages integration is "entirely opt-in", needing Full Disk Access plus the Messages connector
2026-10-02 · Ars Technica: Apple changes Full Disk Access permissions to curb abuse from AI agents

Sources

https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse

Vendor? Request a correction. We review corrections within 7 days.