Muse security and privacy: how it's built and where the risks are

Muse runs each user's agent in a dedicated, isolated cloud VM. A separate authority called Sentinel decides which connector actions and network requests are allowed, and the model never sees your real passwords. Muse data is kept out of Meta's ad systems, and you can opt out of training. The open risks are prompt injection, which Meta says is unsolved, a reported Mac zero-day, and custom connectors that Meta doesn't review.

That's a stronger design than most consumer agents publish. It's still an agent with access to your email and payment methods, so treat it that way.

How Muse isolates your data

Meta's engineering post, Security and safety for AI agents, describes the setup:

• Muse Secure VM. Each user gets a dedicated Linux VM. The agent runs in a systemd-nspawn container where root inside the cell maps to an unprivileged host user.
• Security services outside the cell. Untrusted data is processed by services that run outside the agent's container.
• Confidential VM mode (planned). Meta says a later mode will "cryptographically and verifiably prevent Meta from accessing data in your VM." It isn't shipped yet.

People have poked at the VM from inside. Peter James got the iOS app to zip the whole filesystem to Google Drive, showing a home at /home/hatch with soul.md, identity.md and memory files. Greg Ceccarelli reports 2 vCPUs, about 8GB RAM and no inbound ports. No inbound ports is a good sign: nothing on the internet can connect to your agent directly.

What Sentinel does

Sentinel is the only permission authority for two things: connector actions to third-party services, and every network request leaving the VM. The agent proposes, and Sentinel allows, denies or asks you. For network traffic, Meta says it checks the hostname, resolved and final IP, port, protocol, HTTP method, path and the decoded request.

Human approval is required for:

• all purchases requiring payment
• checkout pages with saved payment credentials
• attempts to send data outside the VM
• form submissions that browser classifiers flag as high-risk

How credentials are protected

Muse uses credential surrogation. A service mints stand-in tokens for the agent, and Sentinel swaps them for real credentials at the network boundary. If the model is tricked into printing a password, it only has a surrogate to print.

Payments go through Stripe Link. At more than 1M Link merchants, Muse uses your saved method; elsewhere, Link issues a single-use virtual card scoped to the purchase (Stripe).

What Meta does with your Muse data

• Muse data is excluded from Meta's ad systems, and you can opt out of training (Meta newsroom).
• Alex Volkov walks through the training opt-out and data handling on video.
• Facebook, Instagram and Threads connect automatically through Accounts Center (Meta help). Check which ones are on.

For developers on the Meta Model API, the tier matters. Standard pricing says prompts aren't used for training. The much cheaper contributor tier ($0.10/M input) lets Meta train on your data (pricing). Muse Code uses the contributor model by default, per DataCamp. Don't send client code or secrets through it without checking.

Known risks

Prompt injection. Meta's defenses are layered (model training, labeling of untrusted input, a classifier ensemble, human approval), and it still writes: "Muse isn't immune to attack. Prompt injection remains an open problem in the industry." The bug bounty pays up to $300,000, including up to $130,000 for a single-user prompt injection. More in prompt injection for browsing and buying agents.

Mac zero-day. Patrick Wardle found that a local app can change an undocumented Muse setting to redirect dictation traffic, exposing voice prompts and auth tokens. Malwarebytes mentioned no patch as of September 22. Muse for Mac also asks for Full Disk Access, Automation and Notifications.

Unreviewed custom connectors. Directory connectors pass Meta's "functional, security, and legal" review. Custom connectors, which Muse builds from any API, don't.

Undocumented capabilities. A static teardown of the Muse apps documents shipped tools for iMessage, WhatsApp, Mail, screen control, background sync and a bundled Chrome extension. A Reddit user's self-scan reported HomeKit, geofence and BLE tools absent from public docs.

Merchant pushback. Amazon's reasons for blocking Muse, per GeekWire, included that it didn't identify itself and appeared to store credentials. That's Amazon's claim, but it's worth knowing.

Trust in Meta. TechCrunch's launch coverage framed the question directly: will consumers trust it?

Settings to change on day one

1. Set connectors to read-only unless a task needs writes.
2. On Mac, set each app (iMessage, Notes, Reminders, Mail, Calendar) to Off, Read only, or Read and interact deliberately.
3. Turn off training if you don't want it.
4. Review which Accounts Center apps connected automatically.
5. Give payment tasks an explicit ceiling in the prompt. See guardrails.

Tools builders use to add their own controls

• Muse Proxy stores CalDAV/CardDAV credentials once and issues scoped keys.
• muse-fileapi limits file access to whitelisted directories with two-phase writes and an audit log.
• Muse connector starter on Cloudflare Workers keeps upstream keys server-side behind one bearer token.
• Muse Code Docker sandbox kit restricts Muse Code's network to Meta's own services.

For the deeper architecture, see Muse engineering.

Frequently asked questions

Is Muse safe to use?

It has more published security design than most consumer agents: per-user VMs, Sentinel gating, surrogate credentials and human approval for purchases. It isn't risk-free. Meta says prompt injection is unsolved, and a Mac zero-day was reported without a patch as of September 22.

Does Meta use my Muse data for ads?

No. Meta says Muse data is excluded from its ad systems. You can also opt out of your data being used for training.

Can Muse see my passwords?

Not directly. The agent works with surrogate tokens that Sentinel swaps for real credentials at the network boundary, so the model never holds the real secret.

Is the Muse Mac app safe?

It needs Full Disk Access, Automation and Notifications, and per-app permissions can be set to Off, Read only, or Read and interact. Patrick Wardle's reported dictation-redirect zero-day is a reason to watch for an update before granting broad access.

Does Meta train on my Muse Code or API data?

On the standard API tier, Meta says prompts aren't used for training. On the contributor tier, which Muse Code uses by default, Meta may train on your data.