Meta Muse Runs Each User's Agent in a Dedicated Secure Cloud VM

Meta has shipped Muse, a personal AI agent built to execute tasks autonomously rather than generate text responses. Muse sends emails, negotiates bills, books travel, and pursues multi-step goals while the user's app is closed, pausing only when a sensitive action requires explicit approval. The more consequential detail for engineers is the infrastructure underneath: every user gets a dedicated cloud virtual machine — the Muse Secure VM — where the agent runtime, browser, and credentials are fully isolated per account. That architectural decision drives nearly every security property the system claims.

This launch sits at the intersection of long-horizon agentic workflows and the security exposure that comes with giving agents real credentials and network access. As covered in our analysis of infrastructure governance as the unlock for safe agent deployment, the bottleneck on agentic systems has never been pure model capability — it has been whether the surrounding control plane can constrain what a misbehaving or manipulated agent can actually do.

The Muse Secure VM and the Sentinel Control Plane

The agent harness runs inside a systemd-nspawn runtime cell with filtered syscalls and restricted kernel capabilities. Security-critical services live outside that cell but inside the same per-user VM. A separate component, the Sentinel agent, is the sole authority over every connector action and every network request, enforcing policy at both Layer 4 and Layer 7. Muse proposes actions; Sentinel permits or blocks them.

Credential handling uses a surrogation model: the agent process only ever holds placeholder tokens, and Sentinel injects the real secret at the network boundary immediately before execution. The practical consequence is that a successful prompt injection attack against the agent yields nothing extractable — there are no real credentials inside the context the model can read. Meta reinforces this with kernel-level eBPF taint tracking that marks any data touching external sources as untrusted, allowing Sentinel to gate approvals based on whether a request originated from clean internal state or potentially adversarial external content.

The browser sub-agent receives an accessibility tree view rather than raw DOM access and is blocked from executing JavaScript. The email connector strips one-time passcodes and password reset links by default. Meta states that Muse Spark 1.3 is close to state-of-the-art at resisting prompt injection, and backs that claim with a bug bounty that pays up to $130,000 for injection attacks that defeat the credential surrogation boundary.

Muse Spark 1.3: The Underlying Model

Muse runs on Muse Spark 1.3, released last week by Meta Superintelligence Labs. The model is tuned for long-horizon agentic work — specifically zero-shot CLI tool calling, parallel multi-workflow threads, and self-correction when operating over inconsistent or messy data sources. In internal comparisons conducted by Meta engineers, Muse Spark 1.3 used roughly 20% fewer tool calls and 25% fewer tokens than its predecessor, Muse Spark 1.2. Fewer tool calls reduce latency and lower the surface area for injection at each step.

Developers can access Muse Spark 1.3 today through the Meta Model API and Muse Code at dev.meta.ai. An open weights release is on Meta's stated roadmap but has not shipped. Muse itself is a consumer service and is not self-hostable.

Capabilities, Availability, and Access Tiers

The consumer tier ships with a free plan and paid plans, though Meta has not disclosed specific pricing in available documentation. Task memory persists across sessions: Muse can recall a saved Instagram recipe reel, convert it to a grocery list, and apply stored dietary preferences. Every sensitive action — outgoing email, purchases, form submissions — requires explicit user approval through a UI element rendered outside the chat context, making approval-spoofing via injected text structurally difficult. A full audit trail shows everything the agent has done and plans to do.

What the Architecture Signals

The per-user VM model is an expensive deployment posture, and Meta has absorbed that cost to eliminate the multi-tenant credential exposure that would otherwise make a breach catastrophic at scale. The design reflects a broader recognition — consistent with the autonomy-by-default safety problem — that agents operating with real-world actuators require hardware-level isolation, not just model-level guardrails. Muse Spark 1.3's efficiency gains over 1.2 suggest Meta is actively working to make that isolation economically viable as usage scales. The open weights commitment, once fulfilled, will give the research community direct access to examine whether the injection resistance holds outside Meta's controlled infrastructure.