Is Meta Muse Safe? How Its Security Works and Where the Risks Are

Meta Muse is reasonably safe for low-stakes errands if you keep approvals on. Each user's agent runs in an isolated cloud VM, Sentinel, a separate authority, approves actions and traffic, and the model never sees your real passwords. But prompt injection is unsolved, two serious bugs surfaced in its first three weeks, and trust in Meta is the open question.

That's a stronger published design than most consumer agents. It's still an agent with access to your email and payment methods, so treat it like one.

Is Meta Muse safe? The short version

Question	Answer	Source
Does each user get an isolated environment?	Yes, a dedicated Muse Secure VM	Meta
Can the model see my passwords?	No, it gets surrogate tokens	Meta, same post
Does it buy things without asking?	No, payments need your approval	Meta, same post
Is my data used for ads?	No, Muse data is excluded from ad systems	Meta help
Is it used for training?	By default yes, and you can turn it off	Meta help, same page
Is prompt injection solved?	No, Meta calls it "an open problem"	Meta, same post
Have there been security bugs?	Yes, a Mac zero-day (fixed Sep 22) and a VM flaw reported Sep 25	See below

How Meta Muse isolates your data

Meta's engineering post, Security and safety for AI agents, describes the setup:

• Muse Secure VM. Each user gets a dedicated Linux VM. The agent runs in a systemd-nspawn container where root inside the cell maps to an unprivileged host user.
• Security services outside the cell. Untrusted data is processed by services that run outside the agent's container.
• Confidential VM mode (planned). Meta says a later mode will "cryptographically and verifiably prevent Meta from accessing data in your VM." It isn't shipped yet.

People have looked from the inside. Peter James got the iOS app to zip the whole filesystem to Google Drive, showing a home directory with soul.md, identity.md and memory files. Greg Ceccarelli reports 2 vCPUs, about 8GB RAM and no inbound ports. No inbound ports is a good sign: nothing on the internet can connect to your agent directly. For more, see what the Muse Secure VM is.

What Sentinel does

Sentinel is the only permission authority for two things: connector actions and every network request leaving the VM. The agent proposes, and Sentinel allows, denies or asks you. For network traffic, Meta says it checks the hostname, resolved and final IP, port, protocol, HTTP method, path and the decoded request. Meta's help page adds that many approval checks run "outside the AI model," so a tricked model can't wave its own actions through.

Human approval is required for:

• all purchases requiring payment
• checkout pages with saved payment credentials
• attempts to send data outside the VM
• form submissions that browser classifiers flag as high-risk

Can Meta Muse see my passwords and card numbers?

Not directly. Muse uses credential surrogation: a service mints stand-in tokens for the agent, and Sentinel swaps in the real credentials at the network boundary. Meta's help page calls this the Secure Credentials Store, which lets Muse complete an authorized action "without the AI model seeing your password." If the model is tricked into printing a password, it only has a surrogate to print.

Payments go through Stripe Link. At more than 1M Link merchants, Muse uses your saved method; elsewhere, Link issues a single-use virtual card scoped to the purchase (Stripe). Meta also announced a 1Password partnership for existing logins.

What does Meta do with your Muse data?

From Meta's privacy help page:

• Muse doesn't share your conversations or VM data with Meta ad systems.
• The setting that lets your interactions improve Meta's models is on when you first use Muse. You can turn it off in Settings. When it's on, Meta says it strips names, emails, phone numbers and social security numbers and disassociates the data from your account.
• You can delete messages, side chats and files in your VM, ask Muse to forget a topic, or reset Muse to delete all your Muse data.

Facebook, Instagram and Threads connect automatically through Accounts Center (Meta help). Check which ones are on. Alex Volkov walks through the training opt-out and data handling on video.

For developers, the tier matters. The Meta Model API's standard tier doesn't use prompts for training. The contributor tier ($0.10 per million input tokens) lets Meta train on your data (pricing), and Muse Code uses the contributor model by default, per DataCamp. Don't send client code or secrets through it without switching.

What security problems has Meta Muse had?

Mac dictation zero-day (fixed). On September 21, Patrick Wardle showed that a local app could change an undocumented Muse for Mac setting to redirect dictation traffic, exposing voice prompts and auth tokens (Malwarebytes). Meta hot-fixed it on September 22 by stripping the debug setting from production builds, and Wardle confirmed the fix (Unite.AI). Meta said the attack needed malware already on the Mac; Wardle showed a hijacked agent could run 50+ sensitive commands. The lesson stands: a local agent inherits whatever the app is allowed to do.

A VM access flaw. On September 25, Reuters, citing The Information, reported that an outside researcher found a flaw through Meta's bug bounty that could have let an attacker reach a user's VM, with its emails and files. Meta initially rated it SEV-2 internally and is adding a clearer safety warning in Muse (Reuters via Yahoo).

Pre-launch testing. At launch, Reuters reported on internal Meta posts in which a tester said an agent got around guardrails and exposed personal iCloud photos, and CTO Andrew Bosworth said Muse repeatedly logged him out (Implicator summary).

Known risks that remain

Prompt injection. Meta's defenses are layered (model training, labeling of untrusted input, a classifier ensemble, human approval), and it still writes: "Muse isn't immune to attack. Prompt injection remains an open problem in the industry." The bug bounty pays up to $300,000, including up to $130,000 for a single-user prompt injection. More in prompt injection for browsing and buying agents.

Mac permissions. Muse for Mac asks for Full Disk Access, Automation and Notifications (Meta help).

Unreviewed custom connectors. Directory connectors pass Meta's "functional, security, and legal" review. Custom connectors, which Muse builds from any API, don't.

Undocumented capabilities. A static teardown of the Muse apps documents shipped tools for iMessage, WhatsApp, Mail, screen control and background sync. A Reddit user's self-scan reported HomeKit, geofence and BLE tools absent from public docs.

Merchant pushback. Amazon's reasons for blocking Muse, per GeekWire, included that it didn't identify itself and appeared to store credentials. That's Amazon's claim.

Trust in Meta. TechCrunch framed it at launch: will consumers trust it?

How to use Meta Muse safely: settings to change on day one

1. Set approvals to "Always ask" under Settings, Permissions, while you learn.
2. Turn off model training under Settings, Data controls, if you don't want it.
3. Set connectors to read-only unless a task needs writes, and review which Accounts Center apps connected automatically.
4. Consider a separate Gmail account for the agent, as Engadget suggests.
5. On Mac, set each app (iMessage, Notes, Reminders, Mail, Calendar) to Off, Read only, or Read and interact deliberately.
6. Give payment tasks an explicit ceiling in the prompt. See agent guardrails.

Builders add their own controls too: Muse Proxy issues scoped keys for calendars, muse-fileapi limits file access to whitelisted folders with an audit log, and a personal email security agent watches Gmail for unusual senders.

Frequently asked questions

Is Meta Muse safe to use?

For bounded errands with approvals on, it's reasonably safe. It has more published security design than most consumer agents: per-user VMs, Sentinel gating, surrogate credentials and approval for purchases. It isn't risk-free: prompt injection is unsolved, and two serious bugs were reported in its first three weeks.

Was the Muse Mac zero-day fixed?

Yes. Patrick Wardle reported it on September 21, and Meta hot-fixed it on September 22 by removing the debug setting from production builds. Wardle confirmed the fix.

Does Meta use my Muse data for ads?

No. Meta says Muse conversations and VM data are excluded from its ad systems. Training is a separate setting, which is on by default and can be turned off.

Can Muse see my passwords?

Not directly. The agent works with surrogate tokens that Sentinel swaps for real credentials at the network boundary, so the model never holds the real secret.

Does Meta train on my Muse Code or API data?

On the standard API tier, Meta says prompts aren't used for training. On the contributor tier, which Muse Code uses by default, Meta may train on your code.