On September 8, 2026, Meta launched Muse, a personal AI agent that asks for access to a working adult’s email, calendars, payments, health and fitness apps, smart home, dining, shopping, music, and events. To use it you must hand over a payment card at signup. The free tier has a usage meter; the paid tiers are $20 per month (“Power”) and $100 per month (“Maximum”). That is the privacy bargain: you give Meta’s agent continuous, opt-in access to the most sensitive surfaces of your digital life, and in return Meta gives you a personal assistant that can buy a shirt, fill out a form, or convert a recipe reel into a grocery list.
Two things set Muse apart. The first is the technical architecture: every user gets a dedicated “Muse Secure VM” running a separate “Sentinel agent” that gates every outbound action. The second is the company that built it. Meta’s $5 billion 2019 FTC penalty, the later FTC finding that Meta had violated that order, and its August 2026 multistate youth settlement of up to $17.1 billion are all in the room when Meta says “your data is isolated.” The architecture is also Meta’s second attempt at a flagship consumer AI agent this year, and the Sev 1 incident from March 2026 - in which a Meta in-house agent acted without authorization and exposed data to engineers who should not have seen it - is the prior track record Sentinel is meant to defend against.
What the architecture actually promises
Per Meta’s own technical writeup, Muse gives every user a dedicated cloud-based Linux virtual machine: an isolated browser, storage, CPU, and memory. The runtime cell is a systemd-nspawn container with root mapped to an unprivileged host user, no io_uring, no CAP_SYS_PTRACE, and no CAP_NET_ADMIN. Host-side processes - hatch-safety, privsep workers, hatch-authd, Sentinel, the Postgres database, and proxies - run as separate systemd units. Inter-component communication happens over Unix domain sockets with SO_PEERCRED peer credentials.
The interesting process is Sentinel. Meta describes it as “the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network.” For each connector call, Sentinel returns allowed, denied, or ask-the-user. For network traffic it inspects the hostname, the resolved and final destination IP, the port, protocol, HTTP method, path, and decoded request. SSRF (server-side request forgery) restrictions apply after the DNS lookup. The agent inside the VM never sees real API tokens; Sentinel performs just-in-time credential insertion at the network boundary, swapping surrogate tokens minted by hatch-authd for the real ones.
Taint tracking is kernel-level. eBPF cgroup programs intercept network traffic and attribute it to processes; eBPF programs attached to Linux Security Module hooks mark anything that touches untrusted input as “tainted.” Clean processes get auto-allow on outbound calls; tainted processes fall back to a user prompt. The browser the agent drives exposes the accessibility tree, not the raw DOM, and disables in-page JavaScript and Chrome DevTools. Checkout pages trigger an explicit approval screen with exact purchase details. Stripe Link issues single-use card numbers “tied to that particular merchant, a particular dollar amount, and only valid for a limited period of time,” per Meta’s research writeup.
That is a real architecture, and it is the floor of what Muse promises, not the ceiling.
What the architecture does not promise
The Muse Secure VM today is not the “Muse Confidential VM” Meta plans to roll out “later this year.” The distinction is load-bearing. Per the same Meta research post, the current Secure VM isolates users from each other but explicitly “does not prevent Meta from accessing data when necessary to support, secure or operate the service.” The agent never sees the API keys, but Meta can. The planned Confidential VM is intended to “cryptographically and verifiably prevent Meta from accessing data in your VM,” running in a trusted execution environment where the user holds the key. Meta says it is taking auditor feedback, plans a continuous audit once it ships, and is sharing source code with external auditors in the meantime.
Until Confidential VM is in production, the technical claims worth verifying are the ones above the VM boundary. The Muse agent does not share conversations or VM data with Meta’s ad systems; Meta says so plainly in both the technical writeup and the newsroom announcement. Inference trajectories are sanitized to remove personally identifiable information before being used to train Meta AI models, and there is an opt-out in settings. Meta publishes a bug bounty of up to $300,000 per valid report and up to $130,000 for prompt-injection chains that affect one user. None of those claims is independently audited. The technical post is signed by Tarek Sheasha, “Software Engineer & VP, Meta Superintelligence Labs,” and is hosted on Meta’s own research domain.
Meta also flags the limit itself: the company writes that “Muse isn’t immune to attack. Prompt injection remains an open problem in the industry” and that “Muse can and will still make mistakes.” The defenses are layered (model-level training, harness-level untrusted-input labeling, an ensemble of detection classifiers trained independently from the model, and human-in-the-loop approval for data egress), but the defenses are not a guarantee, and Meta is not pretending they are.
The company that built it
TechCrunch’s launch coverage is direct about why a privacy-focused reader should pause. Muse arrives less than two weeks after Meta agreed to the multistate youth settlement of up to $17.1 billion led by New York Attorney General Letitia James and 50 other attorneys general over youth exploitation and addictive platform design. Meta’s recorded FTC history, per the 2019 press release, includes deceiving users about how friends’ data was shared with third-party apps, misleading privacy tools, delayed shutdown of friend-data sharing, and a deceptive facial-recognition default. A subsequent FTC action charged Meta with violating that order; Cambridge Analytica still sits in the corporate memory.
That history is not mentioned in Muse’s launch materials. It is the context any reader should weigh when Meta’s privacy team says “isolated from ad systems.”
What This Means
The architecture is stronger than the consumer AI agent default. A dedicated VM per user, a separate Sentinel process with kernel-level taint tracking, surrogate-token credential handling, and a stated ad-system isolation rule are all testable engineering commitments. The bug-bounty structure (with a prompt-injection track that pays six figures) signals Meta expects to be probed and is paying for the privilege. None of that makes Muse private in the same sense a local model is private, and none of it is currently under external audit.
Until Confidential VM ships, the practical reading is that Muse is closer to a hosted browser with strong guardrails than to a true confidential-computing platform. Readers who would not let a browser extension see their email should not assume Muse’s current isolation is meaningfully stronger than the existing perimeter - and the same caveat applies to other agentic browsing ships, like Chrome’s Auto Browse, which streams every page you visit to Google’s servers. Readers who already trust Meta’s existing apps with similar data should treat Muse as the same trust boundary extended to agentic action, with a Sentinel process as the new middle layer. Readers who do not want Meta in that loop at all have a private alternative: running their own agent locally with Ollama and OpenClaw keeps email, calendars, and payments on hardware that Meta never sees.
The Bottom Line
Meta Muse ships the most thoroughly engineered consumer AI agent in market, and it ships it from a company with the largest US consumer-privacy fines on the books. The architecture is worth taking seriously, and the company is the reason you should not take its word.