What Is the Muse Secure VM, and Why Does It Matter?

The Muse Secure VM is a dedicated cloud computer that Meta gives every Muse user. The agent lives there, with its own Linux filesystem, browser and tools, and a separate process called Sentinel decides whether anything it does can reach the internet or a connected service. It matters because it lets Muse run for hours in the background without touching your phone or laptop, while keeping your real passwords and card numbers out of the model's reach.

Everything below comes from Meta's engineering post, How Meta built safety into Muse, plus what users have found poking at their own VMs.

What runs inside the Muse Secure VM

Meta describes two isolated security domains on one machine.

The runtime cell holds "the Hatch daemon (the core agentic harness)", your workspace and files, and "all the binaries and tools Muse executes on your behalf." It's a systemd-nspawn container with its own full Debian root filesystem, a virtual network interface, filtered system calls (no io_uring) and limited kernel capabilities (no CAP_SYS_PTRACE, no CAP_NET_ADMIN). Root inside the cell maps to an unprivileged user on the host. In Meta's words, it's "two isolated security domains on one box, not an LLM powered agent with root."

Host-side services sit outside the cell:

Service	Job
hatch-safety	Monitors inference
privsep	Manages connector code
hatch-authd	Stores credentials and mints surrogate tokens
Sentinel	The permission authority for connector actions and network egress

Users have measured the box from the inside. Greg Ceccarelli, who got Claude Code running in his Muse VM, reports 2 vCPUs, about 8GB of RAM and 100GB of disk, and no inbound ports. Peter James had Muse zip its filesystem and send it to Google Drive, showing a home directory at /home/hatch with soul.md, identity.md, memory and tools. A Reddit user mapped nightly "dreams" jobs, crystallized skills and per-goal crons.

How Sentinel controls what Muse can do

Meta calls Sentinel "the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network. Muse proposes actions, but only Sentinel can grant permission."

For each network request, Sentinel looks at the hostname, the resolved and final destination IP, port, protocol, HTTP method, path and the decoded request body. Meta also tracks data flow at the kernel level, which it calls "tainted egress": a process that reads your data becomes tainted, and its outbound requests get more scrutiny. Clean requests that match auto-allow policies go through without asking you. This runs on eBPF programs attached to cgroups and Linux Security Module hooks.

When a decision resolves to "ask," you get the prompt. Meta says approvals are "strict capabilities, not conversational suggestions," bound to a specific connector or destination. You can grant them one-time, for a session, for a task, for a time window or permanently.

Credential surrogation: why the model never sees your passwords

Code in the runtime cell "only ever sees a 'surrogate' token, minted by authd." Sentinel swaps in the real credential at the network boundary. So if a prompt injection convinces the agent to print its API keys, it prints tokens that are useless outside Meta's boundary.

This is what makes custom connectors workable. When Muse writes client code for your Linear or Tailscale account, the code runs in the VM with a surrogate. The Tailscale connector skill in our catalog describes exactly this pattern.

Payments follow the same logic. At checkout Muse prompts you with the exact purchase details, and for new merchants it uses a single-use card from Stripe Link, tied to one merchant, one amount and a short validity window. See how Muse pays for things.

How Muse handles prompt injection

Meta lists four layers:

1. The model is "trained to recognize and resist prompt injection."
2. The harness labels external data as untrusted input.
3. An ensemble of prompt-injection classifiers trained on real-world data sets.
4. Human approval for requests that move data out of the VM.

Meta backs this with a bug bounty of up to $300,000, including up to $130,000 for a prompt injection that affects one user.

Why a cloud VM instead of your phone

Three practical reasons show up in the catalog.

It keeps working when you don't. Meta says Muse "keeps working after people close the app." Jobs like a daily AI-news podcast or a 77k-story archive census need a machine that stays on.

It has a real computer. Muse can install software. One agent downloaded a Genesis emulator and played Sonic. Another listed books on eBay with its own computer.

It can join your infrastructure, carefully. One user joined the VM to a Tailscale network with SSH to a restricted user on a home server. TerMuse shows the VM's live terminal and browser side by side so you can watch and take over.

Limits and open questions

The VM is Meta's machine. Meta says Muse data isn't shared with its ad systems and you can opt out of training, but its own roadmap implies it can't yet rule out access to the VM. It plans a Muse Confidential VM "later this year" to "cryptographically and verifiably prevent Meta from accessing data in your VM," with a publicly inspectable audit. Until it ships, the trust question TechCrunch raised at launch stands.

The VM also doesn't protect your other devices. The Mac zero-day Patrick Wardle reported was in the Mac app's local settings, not the VM, and it could expose voice prompts and auth tokens. A Reddit user's self-scan of Muse's tool schemas also reported HomeKit control, geofences and BLE scanning that aren't in public docs.

Finally, saved logins widen the blast radius. Amazon's reason for blocking Muse included that it "appeared to store credentials." For the wider picture, read Muse security and privacy.

Frequently asked questions

What is the Muse Secure VM?

It's a dedicated cloud virtual machine Meta runs for each Muse user. The agent, its files, memory and tools live inside an isolated container on that machine, and a separate Sentinel service controls its network access and connector actions.

Can Meta see what's in my Muse VM?

Meta says Muse conversations and VM data aren't shared with its ad systems, and you can opt out of training. A Confidential VM mode meant to cryptographically prevent Meta from accessing VM data is planned but not yet available.

Does Muse see my passwords and API keys?

Meta says no. Code in the VM only sees surrogate tokens, and Sentinel substitutes the real credentials at the network boundary. Card payments use Stripe Link, so Muse doesn't see card numbers either.

How big is the Muse VM?

Meta hasn't published specs. One user reports 2 vCPUs, about 8GB of RAM and 100GB of disk, with no inbound ports.