Meta Muse separates its agent runtime from outside-world authority

The point

What the vendor published. Meta says Muse runs in a dedicated cloud VM, while the Hatch harness and its tools run in an isolated runtime cell. Meta says authd stores credentials, privsep workers execute built-in connector code with scoped access, and Sentinel is the sole permission authority for connector actions and network egress.

What the vendor published. Meta describes approvals as strict capabilities bound to a connector or destination and use case. Sentinel can allow, deny, or ask. This does not mean every request requires a new human prompt; Meta says some narrowly allowed, read-only, previously allowed, or low-risk actions can proceed without interruption.

What someone else saw. in one CNET first-person shopping test syndicated by Yahoo Tech, Muse produced useful product ideas and ran simultaneous searches. The tester took over after a TikTok capture issue and again during checkout, where a $5 total discrepancy, retries, and a missing cart item prevented accurate automatic completion.

How we would test it. test the closed product with non-secret accounts at the runtime, credential, approval, egress, browser-takeover, and tool-lifecycle boundaries. Neither the vendor report nor one shopping report establishes product effectiveness.

Meta documents a runtime cell with host-side authority

What the vendor published. Meta says each user and Muse share a dedicated cloud VM. Within that VM, the Hatch harness, workspace, files, binaries, and tools run in a systemd-nspawn runtime cell. Meta describes runtime-cell root as mapped to an unprivileged host user rather than host root.

Meta assigns different jobs to host-side services outside that runtime cell. Its safety report says authd stores credentials and issues surrogate tokens, privsep workers run built-in connector logic with scoped credential access, and Sentinel is the sole permission authority for connector actions and every concrete network request. These are vendor descriptions of a closed implementation, not independently verified security results.

Approvals are scoped capabilities in the vendor account

What the vendor published. when Sentinel decides to ask, Meta says execution stops and the client shows the user the exact requested action. Meta describes the resulting approval as a strict capability bound to the connector or destination and use case, with one-time, session, task, time-bounded, or perpetual grant types.

Meta also says every purchase receives a human approval with exact purchase details. Separately, it says clean requests under a narrow auto-allow policy and some read-only, previously allowed, or low-risk actions may proceed without interruption. The safe test invariant is therefore a recorded Sentinel decision or matching scoped grant for each concrete request, not a claim that every request has a fresh human approval.

Meta documents code and connector creation, not durable tool effectiveness

What the vendor published. Meta says the dedicated VM can compile code, develop custom skills, and handle concurrent subagents and crons. It also says Muse can write custom connectors for services that expose APIs or command-line interfaces.

Our reading, and how we would test it. generated code becomes operationally meaningful only when its source, dependencies, data access, destinations, tests, reuse, and revocation can be checked. The vendor report does not establish that a generated tool will generalize, be reused later, or remain safe after its inputs change.

The independent product evidence is one CNET shopping report

What someone else saw. CNET reporter Corinne Reichert tested Muse as a personal shopper; Yahoo Tech syndicated the complete report. She described useful product ideas, feedback-driven searches, and the ability to run searches simultaneously. She also described a TikTok capture issue and taking control of the browser so the agent would not remain stuck.

During checkout, the reporter described a $5 discrepancy in the final total, repeated attempts that did not resolve it, another browser takeover, and the selected belt missing from the cart. She wrote that Muse got her 95% of the way there but did not complete the purchase accurately and automatically. This is one first-person shopping observation, not a diagnosed stale-data cause, intentional upcharge, controlled rate, or general product-effectiveness result.

Browser freshness and takeover remain test questions

What the vendor published. Meta says its browser subagent receives accessibility-tree snapshots through a separate broker rather than the raw DOM, cannot run JavaScript in the page context, and pauses while the user takes over or secure credentials are being filled. The CNET report separately supplies one observation of browser takeover after a capture issue and during checkout.

How we would test it. assign every browser observation an increasing identifier. Change a controlled page after observation but before action, and reject any action based on an older identifier. During takeover, verify that agent actions stop. After takeover, require a fresh observation and an external-state read-back before continuing.

Source ledger and evidence boundary

VENDOR SOURCE — meta-muse-safety: the exact Meta AI Research safety report supports the dedicated VM and runtime-cell description, authd and privsep roles, Sentinel's connector and egress authority, scoped approvals, browser-broker constraints, custom connector claims, purchase approvals, and Meta's statement that prompt injection remains open and Muse will make mistakes. It is a vendor account of a closed product, not independent validation.

INDEPENDENT SOURCE — meta-muse-hands-on: the exact P19 identity is CNET's first-person report by Corinne Reichert, syndicated in full by Yahoo Tech on 2026-10-05. It supports the bounded shopping observations described above. It is not The Verge, CNN, or a combined report, and it supplies no controlled reliability or effectiveness rate.

What we published with this article. the public tool-loop probe and bundled fixture are synthetic analysis tools. Without a separate immutable execution receipt, this article makes no factual claim about a bundled probe result. In all cases, analyzer behavior is not Muse behavior.

Prepare a receipted boundary test

How we would test it. download https://sellwithniko.com/artifacts/meta-muse-tool-loop-probe.mjs and https://sellwithniko.com/artifacts/meta-muse-tool-loop-fixture.json. Pin their hashes before use. Treat the fixture as synthetic and do not present its output as a Muse result.

For a current product test, use dedicated accounts and canary credentials. Capture the product version, browser observation identifiers, takeover intervals, generated-tool identity, connector request, Sentinel decision or matching grant, destination, and external-state receipt. Preserve stdout, exit code, runtime, and check time for the analyzer separately.

A test run can bound one version and setup. It cannot convert Meta's vendor claims or one CNET shopping report into a general product-effectiveness claim.

What remains unknown

• The receipt set verifies Meta's safety-report wording but does not independently inspect or validate Hatch, authd, privsep, Sentinel, the runtime cell, or their security effectiveness.
• The verified independent report did not evaluate multi-day triggers, durable tool reuse, connector-event handling, or recovery after client downtime.
• The cause of the reported $5 discrepancy and missing cart item is unknown; the report says Meta did not immediately respond to a request for comment.
• One first-person shopping test supplies no controlled product-wide reliability or effectiveness rate.

Primary sources

• VENDOR SAFETY REPORT — Meta AI Research: How We Built Safety Into Muse
• INDEPENDENT FIRST-PERSON REPORT — CNET / Corinne Reichert, syndicated by Yahoo Tech
• ERNESTA LABS SYNTHETIC ANALYZER — Muse tool-loop probe
• ERNESTA LABS SYNTHETIC FIXTURE — Muse tool-loop fixture