Meta's Muse Agent Books Travel and Negotiates Bills With Your Accounts

Meta just launched Muse, a personal AI agent that can autonomously send emails, book travel, sell a car, and negotiate bills by connecting directly to your email, calendar, payment methods, smart home, and shopping accounts. Alongside it, Meta published an unusually detailed security deep dive explaining how the system tries to contain damage when something goes wrong.

Handing an LLM your inbox, a shell, and a browser asks for a category of trust no consumer product has requested before, and the security architecture is where the real substance lies.

What Muse Does

A user shares a goal, Muse builds a personalized plan, then carries out the work independently. It opens a browser, fills forms, and negotiates on your behalf. Use cases Meta cited include online shopping, booking movie tickets, scheduling appointments, and filling out school permission slips. It ships as iOS, Android, and web apps, currently US-only, with a free tier or monthly plans at $20 or $100. The underlying model is Meta's in-house Muse Spark 1.3, developed under chief AI officer Alexandr Wang, who joined as part of the roughly $14 billion Scale AI acquisition last year.

One VM Per User

Each user gets an isolated Linux VM in Meta's cloud. Files, connected credentials, and Muse's memory of you all live inside that VM rather than in centralized Meta infrastructure, letting the agent continue work in the background when you step away. Inside the VM, the agent process itself, called Hatch internally, runs in a systemd-nspawn container cell with:

• Root inside the cell mapped to an unprivileged host user
• A separate root filesystem from the host
• Filtered syscalls (no io_uring) and stripped kernel capabilities (no CAP_SYS_PTRACE, no CAP_NET_ADMIN)
• A virtual network interface it cannot escape

Credentials, safety classifiers, and the connector code that actually touches Gmail or Stripe live outside that container as separate systemd units, communicating with the agent over Unix domain sockets with peer credential checks. A jailbroken model stays trapped in a sandbox with no keys.

Sentinel: the Approval Broker

Sentinel is a separate host-side process with sole authority over two things: executing any connector action, and permitting any network egress from the agent. The agent proposes; Sentinel decides.

Sentinel inspects every outbound request at layers 4 and 7, checking hostname, resolved IP, port, HTTP method, path, and decoded body. It blocks the classic SSRF trick where an apparently public hostname resolves to private infrastructure after DNS lookup. The agent never sees real credentials at all: it operates on surrogate tokens, and Sentinel swaps in the real OAuth token or API key only at the network boundary. Prompt-injecting the model to leak a Gmail token is pointless because the model has never held one.

To avoid flooding users with approval popups, Meta built a kernel-level data-flow tracker called tainted egress. A process starts clean and becomes tainted the moment it reads user data. Clean requests to known-safe destinations are auto-approved; tainted ones require a human-in-the-loop prompt. The implementation uses eBPF cgroup programs and custom Linux Security Module hooks for taint propagation, a genuinely novel piece of systems engineering for a consumer product.

The Lethal Trifecta

Meta explicitly frames its defenses around Simon Willison's "lethal trifecta": private data access, exposure to untrusted content, and ability to exfiltrate. The defense-in-depth stack against prompt injection runs four layers deep:

1. Model-level training to resist injection, where Meta claims Muse Spark 1.3 is near state of the art
2. Harness-level tagging of any external data as untrusted input in context
3. An ensemble of independent classifiers, trained separately from the main model, scanning tool outputs and file contents for injection attempts
4. Human-in-the-loop approvals for anything that moves data out of the VM

The browser subagent gets extra hardening: it receives only the accessibility tree of a page rather than the raw DOM, cannot execute JavaScript in the page context, and pauses entirely when the user takes over or when credentials are being auto-filled. For purchases, Meta partnered with Stripe Link to mint single-use card numbers scoped to a specific merchant, dollar amount, and time window, with a mandatory approval prompt on every checkout. Shop Pay support is coming soon.

A $300,000 Bug Bounty

Meta opened a public bug bounty offering up to $300,000 for valid reports, including up to $130,000 for prompt injection attacks affecting a single user. That sits among the largest single-user prompt injection bounties any AI vendor has publicly posted. The writeup itself concedes prompt injection remains an open industry problem, so the bounty functions as both incentive and acknowledgment that attacks will come. Meta also previewed a Muse Confidential VM, due later this year, designed to cryptographically block even Meta employees from accessing a user's VM data, with source code shared with external auditors for continuous inspection.

The Broader Context

The timing carries weight. Less than two weeks after Meta settled an $18 billion multistate lawsuit over social media's consumer harms, the company announced its largest consumer AI bet to date. On the July earnings call, Zuckerberg described personal agents as the foundation for the next wave of products and revenue, and Muse is the first concrete product behind that claim.

The competitive field is dense: ChatGPT's agent mode, Anthropic's computer use, Google's Project Mariner, and Apple's rumored Siri overhaul all target the same territory. What separates Muse is the deployment shape: per-user cloud VMs, a hardened permission broker, kernel-level taint tracking, and a published architecture document. For anyone building agents, this is probably the most detailed reference design a major lab has released for deploying an untrusted LLM against real user credentials.

Practical Considerations Before You Connect Your Accounts

A few things worth knowing if you're evaluating Muse as a user:

• Data footprint: Everything lives in your VM, but Meta retains operational access until Confidential VM ships. Inference trajectories are used for training by default, sanitized for PII, with an opt-out available in settings.
• Ads: Meta says conversations are not shared with ad systems, but Muse browsing on your behalf looks like your activity to third-party sites and can indirectly influence ad targeting.
• Blast radius: The architecture genuinely limits damage from a compromised agent. Credentials are never exposed to the model, purchases require approval, and payment tokens are single-use and merchant-scoped.

Muse signals that frontier labs are treating agent safety as a production engineering problem rather than a research footnote, with sandboxes, brokers, ACLs, and bounties to match. Whether users will trust Meta specifically to hold this much context about their lives is probably the question that decides the product's fate.