Meta's Muse design starts from an uncomfortable premise: an agent with files, a shell, connectors, a browser, and background execution will sometimes be mistaken or manipulated. Its answer is to keep the power to authorize consequential action outside that agent's runtime.
Two Security Domains, Not An Agent With Root
Meta published its Muse safety architecture on September 8, 2026. The main harness, tools, files, and binaries run in an isolated Linux container with an unprivileged mapping to the host, a separate root filesystem, filtered system calls, and reduced kernel capabilities.
Security-sensitive services sit outside that cell. Separate workers run built-in connectors with explicit credential allowlists. An authentication service stores real credentials. Durable application state lives outside the runtime. A Sentinel controls connector actions and every outbound network request.
Permission Is A Host-Side Capability
Muse submits a proposed connector action to Sentinel with its method, scope, and task context. Sentinel applies user policy and either allows it, denies it, or sends a pending approval directly to the client. The agent cannot approve through its own conversation.
Grants can be one-time, session-scoped, task-scoped, time-bounded, or perpetual. Meta says subsequent calls must match the approved connector, destination, and use case. That makes permission a machine-enforced capability rather than natural-language context the agent can reinterpret.
The Model Never Needs The Real Secret
Code in the runtime receives a surrogate token. After Sentinel authorizes the concrete request, it retrieves the real credential from the host-side store and substitutes it at the network boundary. Meta also says connector workers are limited to named credential sets, so changing a request parameter cannot turn calendar access into email access.
This isolates three questions that are often blurred together: where credential-capable code executes, which secret that code may obtain, and whether this particular action is permitted now.
What Operators Can Reuse
- Treat the agent runtime as a workload that processes untrusted data.
- Keep approval state and credential custody outside the model's writable boundary.
- Authorize concrete destinations, methods, scopes, and time windows.
- Insert secrets only after authorization and as close as possible to egress.
- Give each connector an explicit credential allowlist.
- Send consequential approvals over a channel the agent cannot impersonate.
Claims, Limits, And Open Work
The detailed architecture is valuable, but it remains Meta's account of its own system. The post does not publish independent penetration-test results or enough implementation detail to reproduce the complete boundary. Meta explicitly says prompt injection remains open and Muse will make mistakes.
Meta opened a public bug bounty with awards up to $300,000. Its planned Confidential VM, intended to prevent even Meta from accessing VM data, is still under external review and scheduled for later this year. At launch, operational policy restricts Meta access; it does not cryptographically eliminate it.