Meta published 'How We Built Safety Into Muse' (Sept 8), a launch-day engineering post detailing the security architecture around Muse Spark 1.3 agents: per-user VMs with the agent harness ('Hatch') in a systemd-nspawn container; 'Sentinel', a separate agent that is the sole permission authority for connector actions and network egress; 'Authd' credential surrogation so agents never see real tokens; eBPF kernel-level taint tracking that forces user approval for tainted egress; an accessibility-tree-only browser view with no raw DOM or JS execution; and single-use, merchant- and amount-bound wallet cards for purchases. The previously private bug bounty is now public, up to $300,000 per report ($130,000 for single-user prompt injection). A 'Confidential VM' planned for later this year is designed to cryptographically prevent Meta from accessing VM data, with design and source already shared with external auditors and a commitment to continuous public audit once launched.
This is the most detailed public reference architecture yet for consumer agent security, with each layer answering a concrete attack class: prompt injection (ensemble classifiers plus eBPF taint tracking), credential theft (surrogate tokens), egress abuse (Sentinel plus kernel taints), and payment fraud (scoped single-use instruments). Teams building agent products can lift the patterns directly. The continuous-audit commitment for the Confidential VM is also a third data point that frontier labs are institutionalizing externally verifiable safety disclosure (trend #4), and the Confidential VM itself extends the execution-plane privacy axis of trend #5.
| Isolation | per-user VM + systemd-nspawn harness container ('two isolated security domains on one box'); harness codename Hatch |
|---|---|
| Sentinel | separate agent as sole permission authority for connector actions and network egress; layer-4/7 inspection, SSRF protections, just-in-time surrogate credential injection |
| Authd | credential surrogation inside the VM; agents never see real tokens |
| Tainted Egress | eBPF kernel-level data-flow tracking; tainted processes lose auto-allow and require user approval |
| Browser | accessibility-tree-only view via CDP broker, no raw DOM, no JS execution; classifiers block data egress, injected DOM/images/downloads, risky form submissions |
| Payments | wallet issuing single-use, merchant- and amount-bound card numbers (Stripe Link at launch; Shop Pay planned) |
| Training | prompt-injection awareness built into agent-critical skill training (zero-shot CLI tool calling, long context, long-trajectory instruction following); sanitized user trajectories with opt-out |
| Bug Bounty | public; up to $300,000 per valid report; up to $130,000 for single-user prompt injection impact |
| Confidential Vm | planned later in 2026; cryptographic prevention of Meta access; external auditors already reviewing design and source; continuous public audit after launch |