Meta launched Muse today, a personal agent Meta says it has been "working on and using ourselves since early 2026," describing early glimmers of "real personal superintelligence" — an agent that "knows you, actually does things, works in the background, launches swarms of subagents, builds its own tools, and edits itself." Each user gets a dedicated cloud VM where Muse lives, connectors to email and other services, a real Chromium browser Muse can drive, and a wallet for one-time-use payment credentials. Meta is opening a public bug bounty alongside launch, paying up to $300,000 for valid reports and up to $130,000 specifically for a successful prompt injection affecting one user.
The security architecture is genuinely detailed, and worth crediting as such
Most agent-launch posts gesture at "safety" in a paragraph. Meta's runs to a full systems document, and the specifics are real enough to evaluate rather than just trust. The core harness runs inside a systemd-nspawn container with root mapped to an unprivileged host user, filtered syscalls, and limited kernel capabilities. Security-sensitive functions live outside that container entirely, as separate systemd units: hatch-authd handles credential storage and issues the agent "surrogate" tokens instead of real ones, swapped for the genuine credential only at the network boundary by a process called Sentinel — the sole authority over connector actions and network egress, which the agent itself cannot override. A technique Meta calls "tainted egress" uses eBPF programs attached to Linux Security Module hooks to track which processes have touched user data, downgrading anything tainted out of an auto-allow policy and back into a human approval flow. The browser sub-agent sees only an accessibility-tree snapshot of each page, not the raw DOM, can't execute JavaScript, and gets paused entirely whenever a human takes the wheel. Meta names Simon Willison's "lethal trifecta" framing directly and builds its defense-in-depth explicitly around it. None of this is marketing language — it's specific enough that a security researcher could actually go try to break it, which is presumably the point of opening the bounty program the same day.
The model doing the work is the one this blog already found shut out on exactly this kind of task
Muse runs on Muse Spark 1.3, and Meta's post makes exactly one capability claim about that model directly: "Muse Spark 1.3 is close to SOTA" on recognizing and resisting prompt injection — asserted without a benchmark name, a score, or an external comparison. That's the same self-graded, unqualified-superlative pattern this blog has flagged in other labs' releases this month, and it's worth naming here too. But there's a sharper, more specific tension worth raising, because this blog already ran the numbers on Muse Spark 1.3's own launch benchmarks: against Claude Opus 5 and GPT-5.6 Sol, on Meta's own published comparison table, Muse Spark 1.3 won zero of six Agent-category benchmarks — Claude Opus 5 took GDPval-AA v2 knowledge-work performance (1824 vs. 1754), JobBench professional tool use (65.7 vs. 64.9), OSWorld 2.0 agentic computer use (68.3 vs. 66.9), and AutomationBench end-to-end business workflows (50.3 vs. 49.4); GPT-5.6 Sol took DeepSearchQA agentic browsing (93.0 vs. 89.4) and Meta's own Agentic IF Index for instruction following (60.5 vs. 57.8). Read that list of categories again next to what Muse is actually built to do: drive a browser, use tools on your behalf, execute business-style workflows like scheduling and purchases, follow long agentic instructions reliably. That's close to a one-to-one match with the exact benchmark categories Muse Spark 1.3 lost on outright, in Meta's own numbers, weeks before becoming the model responsible for a product with access to your email, calendar, and payment credentials. Meta's security architecture is designed to bound the damage when the model gets something wrong; that architecture matters more, not less, given what the model's own launch benchmarks already showed about how often that might happen on agentic tasks specifically.
What "your data" doesn't quite mean yet
The post's framing — "your computer, your data" — comes with a load-bearing caveat two sections later: the current architecture "restricts access to your data by Meta personnel through operational policies," but "does not prevent Meta from accessing data when necessary to support, secure or operate the service." The actual promise of Meta being unable to access user data at all is attached to Muse Confidential VM, which is not shipping today — it's in testing with "a small group of trusted testers," design and source code are only now going to external auditors, and Meta's own timeline is "later this year." The headline privacy architecture people will read about today is the current one, where Meta retains operational access; the cryptographically-enforced version is a promise with no public ship date yet. Separately, Meta states plainly that Muse "doesn't share your conversations or the data in your Virtual Machine with Meta ad systems" — true as stated, but the same paragraph concedes that Muse browsing the web "will appear as your activity," so a site Muse visits on your behalf can retarget you with ads elsewhere, and a restaurant reservation or Marketplace purchase Muse handles "may indirectly influence the ads you see." That's a real, disclosed distinction between "we don't share your data with our ad systems" and "using this product won't affect the ads you see" — and it's Meta's own post drawing it, which is worth crediting even as the underlying mechanism is worth noting plainly.
The bug bounty is the most checkable claim in the whole post
Unlike the "close to SOTA" line, the bounty program is a specific, falsifiable commitment: up to $300,000 for valid reports, up to $130,000 for a prompt injection that successfully affects one user, and it's open to the public starting today rather than restricted to Meta's existing private researcher program. That program has apparently been running "throughout the year" already in private form, which means today's launch is the first time the system faces open-ended, public adversarial pressure at scale rather than a curated set of invited testers — a meaningfully different and harder test than what "hardened based on extensive dogfooding" implies on its own.
What to expect next
- Watch the public bug bounty's actual results. A specific, dollar-denominated program is the rare AI-safety claim that produces its own scoreboard; how quickly researchers find a $130,000-tier prompt injection is a real signal the architecture description alone can't provide.
- Watch for a published benchmark behind "close to SOTA" on prompt injection resistance. Every other capability claim in Meta's own recent Muse Spark releases has come with a number; this one, in a security-critical launch, hasn't yet.
- Watch whether a future Muse Spark checkpoint actually wins agentic benchmarks, not just narrows the gap. A personal agent built on a model that currently loses every agent-category comparison to rivals is a specific, trackable claim about whether the underlying model catches up to the product built on it.
- Watch Muse Confidential VM's actual ship date and audit results, since that's the version of the privacy promise Meta is actually making conditional on "later this year" rather than true today.