Meta has introduced Muse, a personal AI agent built on the Muse Spark 1.3 model, designed with security features to protect against prompt-injection attacks. The system runs each agent in an isolated virtual machine divided into a sealed runtime cell and external service zones to separate untrusted data from user credentials.
- Muse connects to apps like email, browsers, and calendars, allowing users to set selectable read or write access per service.
- A credential service outside the runtime cell processes passwords while the agent uses stand-in tokens, preventing credential theft via prompt injection.
- An external agent named Sentinel inspects outbound requests against user permissions before approving actions or swapping in real credentials.
- The system includes classifiers to screen incoming data and a sub-agent that reads structured accessibility trees instead of raw page code to avoid hidden instructions.
Security is critical for agentic systems, as prompt injection remains a major vulnerability; Meta's architecture aims to ensure that even if initial defenses fail, the agent cannot override the security components holding user data.