Meta's Muse: the agent that breaks Meta's own security rule

On 31 October 2025, Meta's security team published a framework called the Agents Rule of Two.^[2] The argument was simple and, at the time, widely praised: until somebody solves prompt injection, an AI agent should satisfy no more than two of these three properties in a single session — process untrusted input, touch sensitive data, or change state and act on the outside world. All three together is what Simon Willison had already christened the lethal trifecta.^[10]

On 8 September 2026, Meta shipped Muse.

Muse reads your email. It browses the open web. It holds your calendar, your bank connections via Plaid, and your health data from Withings and Function Health. And it buys things with a card on file.^[1][6] That is untrusted input, sensitive data, and outbound action — the complete set, in one product, for anyone in the US who downloads it.

This isn't a gotcha. It's the most interesting thing about the launch, because Meta clearly knows it. Muse is an argument that you can break the Rule of Two if you replace it with enough architecture. Whether that argument holds is the only question about this product that actually matters.

What Muse is, in sixty seconds

Muse is a chat thread that does things. You name it, give it an avatar, tell it how to talk to you, and then hand it tasks rather than questions.^[1] It runs on Muse Spark, which Meta calls its most capable model to date and which — in its 1.3 release from 2 September — leads Claude Opus 5 and GPT-5.6 Sol on coding and long-context evals while trailing Opus 5 on broader agent-workflow benchmarks.^[12]

The distinguishing behaviours, as Meta describes them:

• It keeps working after you close the app. Tasks are long-running and asynchronous, with scheduled and event-driven background work.^[1][8]
• It's proactive. It remembers preferences and volunteers suggestions you didn't ask for.
• It negotiates. Selling something for a better price, arguing a bill down.^[1]
• It converts what you've saved into what you'll do. The recipe you bookmarked on Instagram becomes a shopping list.
• It pays. Through Stripe's Link, which issues one-time-use card numbers, with coverage for damaged items, price drops and no-fee returns. Shop Pay and 1Password are promised.^[1]

The connector list Alexandr Wang highlighted at launch is broad and mostly non-Meta: Gmail, Google Calendar, Outlook, Google Docs, Plaid, OpenTable, Spotify, Peloton, Withings, Function Health, Tailscale — plus Instagram, Messenger, Threads, Facebook and Marketplace.^[6] It's live in the US on iOS, Android and the web, with AI glasses to follow. Free for most use, with paid tiers reported at $20 and $100 a month.^[7]

Meta's answer to its own rule

Meta's response to the trifecta problem is to refuse to let the three properties meet inside the same trust boundary. Four moving parts:

A dedicated VM per user. Each person's agent and data live in an isolated Linux virtual machine in Meta's cloud, with its own filesystem, terminal and a restricted Chromium browser you can watch working.^[1][8] The security value is blast radius: a compromised session gets thrown away without touching anyone else's.^[9]

Credentials the agent never sees. Passwords and payment details are handled host-side, outside the agent's reach. Stripe Link means even a successful purchase doesn't expose a real card number.

Sentinel. This is the load-bearing piece. A separate agent watches everything leaving the VM, checks it against policy, and interrupts you for approval when an action doesn't match an authorised pattern. Meta's VP of engineering David Singleton put it plainly: "The harness runs in its own isolated cell, it doesn't see real credentials, and every interaction with the outside world runs through a Sentinel which the agent can't override."^[5] His colleague Tarek Sheasha framed the goal as keeping "trusted data away from the internet and the part of the agent that can actually take action."^[5]

A Confidential VM, later. Encrypted end to end with keys the user holds, so that — Meta's phrasing — not even Meta can look inside. Due later in 2026.^[1]

Read structurally, that's a serious attempt to satisfy the Rule of Two at the level of each component rather than the product. The agent handling untrusted web content can't act. The thing that acts can't be talked into it by a webpage. It's the same instinct behind Chromium's site isolation, which is exactly where Meta says the framework came from.^[2]

Where the argument gets thin

Three honest problems.

The hard part is the approval gate, and the approval gate is you. Sentinel's protection depends on a human noticing that something is off. That works on day one, when every confirmation is novel. It works much less well in week six, when you've approved 200 of these and the prompt-injected one looks like the other 199. Every agent vendor has the same dependency and none of them has solved it. OWASP's 2026 report has prompt injection up 340% year on year and calls it the fastest-growing attack category; Google measured malicious indirect injections on the pages it crawls rising 32% in relative terms in four months.^[11] Recent work on browser agents found no attack scenario that was consistently blocked across leading systems.^[11] Meta's architecture reduces what an injection can reach. It does not stop one landing.

Almost none of this is independently verified. The Secure VM, Sentinel's override-resistance, the claim that conversations stay out of the ad systems — all of it is currently Meta describing Meta.^[9] There is no published task-completion rate, no concurrency ceiling, no latency figures, and no third-party red-team report.^[8] After ChatGPT's agent mode shipped, independent findings arrived within weeks; expect the same here, and read them before you connect your bank.^[9]

"Private" is doing two different jobs. The isolation is real and the ad-system carve-out is a meaningful commitment. But the VM runs on Meta's infrastructure, and until the Confidential VM lands, what stops Meta accessing it for operations or support is policy, not cryptography.^[8] Also note the default: your interactions do feed model training unless you turn that off.^[1] Opt-out, not opt-in, on the single most sensitive data stream Meta has ever asked for.

The trust problem isn't an engineering problem

And this is the bit no amount of VM design fixes. TechCrunch's write-up simply listed the receipts: the 2011 FTC settlement over making private information public without consent; the $5 billion penalty in 2019 across eight separate privacy violations; a 2023 FTC charge that Meta had breached the resulting order; passwords found stored in readable form; Cambridge Analytica.^[3] Muse launched the same week as Meta's $18 billion settlement over social media harms.^[4]

Meta is asking the public to hand an agent its inbox, calendar, bank feed, health metrics and card. The company with the best security architecture in the category may also be the company with the least standing to ask.

The early numbers read like exactly that ambivalence. Muse hit No. 2 on the US App Store by 10 September — an unambiguous success — on 83,000-plus iOS downloads.^[4] For scale: Threads did 4.3 million on day one, the standalone Meta AI app 108,000 at debut, and ChatGPT roughly half a million in its first US week.^[4] Top of the charts, modest absolute volume. Curiosity is converting; commitment hasn't yet.

How it sits against the rest of the field

Every major lab shipped a personal agent this year, and they've split by where the agent runs rather than by what it can do:

Gemini Spark is the closest match in intent — scheduled tasks, personal context, background work — and it's ahead of Muse on one unglamorous thing: it actually documents its limits.^[8] A published concurrency ceiling is a small act of honesty that tells you what the product will do under load. Meta has published no equivalent.

Where Muse is genuinely differentiated is distribution, and this is the part I'd underrate at my peril. The rivals are things you open. Muse is aiming to be something that's already where you are: reachable from Meta's messaging surfaces, and heading for AI glasses, where the interaction model — ask out loud, get it done, no screen — is the one agents have always wanted and never had.^[1][5] Nobody else has a hardware path that direct. Tobi Lütke called it "very strong" on X; Garry Tan, who had tested the underlying model earlier, was similarly positive.^[6] Coming from the CEOs of Shopify and Y Combinator — one of whom runs the commerce rails an agent like this would transact across — that's not nothing.

The connector list is the other quiet advantage. Gmail, Outlook, Plaid, OpenTable, Spotify, Peloton, Withings, Tailscale — Meta went out and integrated its competitors' services rather than walling users into its own.^[6] For a company whose instinct has historically run the other way, that's the most surprising decision in the launch, and the one that makes Muse a plausible daily tool rather than a Meta-apps remote control.

What I'd actually hand it

Assume, reasonably, that an injection eventually gets through. Then the question is what you've given it access to. My split:

Fine now. Read-only scopes. Research a purchase, monitor a price, summarise the week's calendar, turn saved posts into lists, draft replies you send yourself. Muse lets you grant read without send on a per-app basis^[1] — use that. The cost of a bad outcome here is a wasted afternoon.

Wait. Anything with money or your name on it. Outbound email, Marketplace negotiation, bank connections, bookings against a saved card. Not because Muse is worse than its rivals — it may genuinely be better isolated — but because nobody's approval UX has been tested against a motivated attacker at consumer scale, and you'd be the test.

The feature to watch is the Confidential VM. It's the one claim that converts a policy promise into a mathematical one. Until it ships, the honest description of Muse's privacy is "well architected, self-attested."

Bottom line

Muse is the most thoughtfully constructed consumer agent anyone has shipped. The per-user VM, the credential separation, the non-overridable egress check — that's a real design, not a marketing layer, and Meta arrived at it by taking its own published threat model seriously.

It also deliberately assembles the lethal trifecta in a product aimed at billions of people, and bets that isolation plus a human approval tap is enough. That bet has never been tested at this scale, and the human tap is the weakest component in it.

Which makes the interesting question not can Meta build this — evidently yes — but whether "secure by design" survives contact with a few million users who stop reading the confirmations. Connect the read-only things. Try the negotiation feature on something you don't mind losing. Keep your card out of it until somebody who doesn't work at Meta has spent a month trying to break it.