What Muse's own files say about it.

What Meta promised, and what surfaced

Meta launched Muse on 8 September 2026 as a personal AI agent: each user gets a dedicated cloud computer, the Muse Secure VM, where the agent can read email, manage a calendar, use connected apps, and make purchases. Meta's own materials describe it running in a container "so no one else's agent can reach it," gated by a separate Sentinel process that approves anything reaching the network, and promise that conversations and VM data are not shared with Meta's ad systems.

Within five days of launch, three separate problems surfaced. A bug‑bounty researcher reported a flaw Meta initially rated SEV‑2 (its third‑highest severity) that could expose a user's VM to an attacker. Security researcher Patrick Wardle disclosed an unpatched macOS zero‑day in the desktop client. And on 24 September, developers Peter James and Jonny L. Saunders found that, with what Saunders called "extremely easy" prompting, Muse could be talked into zipping up and handing over its own root filesystem — the same export this report is built from. Meta called this "intended behavior," not a breach, since each VM is isolated to its own user.

Every quote checked against its file

Every quotation below was verified by a script against the exact file and line range cited, after the ordinary variation from wrapped text and quotation‑mark style is normalised away — the build fails and refuses to publish if a single quote doesn't match. Three kinds of source appear:

• file  a document shipped in the virtual machine, cited by path and line range.
• transcript  a line from a recorded agent session (one JSON record per physical line); the line number was found automatically by searching the decoded record text for the quoted phrase, not taken from a hand‑copied rendering.
• derived  a value decoded from a binary or compressed artifact in the VM (an FST‑encoded domain list, or strings extracted from a compiled binary with strings -n 6) and saved as a plain‑text file so the citation is checkable without re‑running the decoder.

Where a finding draws a conclusion beyond what a file states outright, that reasoning is separated into its own "why it matters" line, and marked as such.

Public sources used for context

Used only for the launch‑promise and incident‑timeline framing above; every finding itself is sourced to the VM files, not to these articles.