Meta explains Muse safety model with Sentinel for approvals/blocks and cloud compute
Meta AI Research ● Covered by 25 sources
Meta launched Muse, a personal agent with a safety layer called Sentinel. The big twist: Muse can work in your cloud VM, but Sentinel alone can approve or block outside actions.
Based on reporting by Meta AI Research — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Meta has launched Muse, a personal agent it says was built with safety as a core feature, not a patch. The company says it had been using Muse itself since early 2026, and that real-world dogfooding shaped much of the system’s design. The pitch is ambitious: an agent that can work in the background, spin up subagents, build tools, and even edit itself. But Meta is equally blunt about the risk. An agent that handles inboxes, calendars, shell access, and connected services unattended can make mistakes, and it can be attacked through the data it reads.
So Muse lives inside a dedicated cloud computer, with data and credentials stored there rather than scattered around the system. Meta says the VM is isolated, with a browser and enough compute to do real work, and that the agent’s runtime is separated from more sensitive services. The model itself was trained for zero-shot tool use, long context, long-trajectory instruction following, prompt-injection awareness, and multi-agent coordination. Still, the company does not trust the model to police itself. It built the system around a host-side Sentinel that acts as the sole permission authority for connector actions and all network egress.
That Sentinel is the interesting bit. Muse can propose an action, but Sentinel decides whether it happens, gets denied, or needs the user to step in. Meta says approvals are handled in the client UI, not inside the chat with Muse, and that they are strict capabilities tied to a specific connector, destination, and use case. The company says it can grant one-time, session-scoped, task-scoped, time-bounded, or perpetual permission. It also says the system uses tainted egress, so processes that read user data can lose auto-allow status and fall back to normal approval flow.
Meta is also leaning hard on least privilege. Built-in connector logic runs outside the runtime cell, credentials are kept out of the model’s reach, and the agent sees surrogates instead of real tokens. For email, Muse strips out one-time codes, password reset links, and login magic links. The company is trying to make the obvious promise here: even if the agent gets tricked, the blast radius should be smaller. Whether that’s enough for something this connected is the real test, and Meta is inviting outside researchers to help answer it through a bug bounty program with awards of up to $300,000.
My take — AI-written commentary, not fact-checked reporting
This is the right way to do an agent: assume it will get tricked and build a wall around the damage. Sentinel sounds less sexy than “personal superintelligence,” which is exactly why it matters. The industry has spent too long pretending permission prompts are safety; Meta is at least treating them like actual security boundaries instead of friendly suggestions.
Read more about this at: Meta AI Research
