Sentinel is the bouncer Meta put between its personal agent and the internet. It is a second program on the same machine as Muse, and Muse cannot overrule it. Meta: “Muse proposes actions, but only Sentinel can grant permission to perform action.”Meta AI Research, How We Built Safety Into Muse, 8 Sep 2026, read at source 16 Sep 2026.
One agent does the work. A separate one decides what is allowed to leave the box.
- It is a separate program, not a setting. Meta: “A separate Sentinel agent runs on that same machine, kept apart from Muse at the system level.”Meta, Introducing Muse, 8 Sep 2026, read at source 16 Sep 2026.
- Nothing reaches the internet without it. Every outbound request is checked at the network boundary.
- The agent never holds your real credentials. Sentinel swaps in the real token after it has approved the request.
- Approval prompts bypass the chat. They appear in the app UI, so a hijacked conversation cannot answer them.
- Meta does not claim this is solved. It says prompt injection “remains an open problem in the industry”.
What does Sentinel actually do?
Two jobs. It decides whether a connector action — send this email, book this thing — is allowed, and it decides whether a network request is allowed. Meta: “It is the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network.” And: “Every concrete network request is governed by Sentinel at egress.”Meta AI Research, How We Built Safety Into Muse, 8 Sep 2026, read at source 16 Sep 2026.
It inspects more than the hostname, which is the level of control agent permissions usually lack. Meta lists “the hostname, the resolved and final destination IP address, the port, protocol, HTTP method, path, and the actual decoded request”.
The design assumes the agent will be fooled. It is not built to stop that happening; it is built to limit what the agent can still reach once it has.
Why the agent never sees your passwords
Muse works with fake tokens. The real one is substituted at the edge, after approval. Meta: “The agent never sees real tokens, which means any attempt to coerce the agent to reveal the actual secrets via prompt-injection or otherwise is futile.”
That is the least-privilege argument in one line: a model shown only a surrogate token cannot be talked into reading out the real one.
How the permission prompts work
When Sentinel decides to ask you, work stops. The dialog does not arrive as a message from Muse. Meta: “A dialog is presented to the user directly within the client UI — not via their conversation with Muse — and their answer is routed directly back to Sentinel, which acts on the user’s decision.”
And a yes is narrow: “Approvals granted via the human in the loop system are strict capabilities, not conversational suggestions. They’re bound to the particular connector/destination and use case.”
It is not supposed to ask about everything. Meta: “The point is not to ask the user about everything. Read-only, previously allowed, or demonstrably low-risk actions can proceed without interruption.” It tracks which processes have touched your data — “Each tool execution process starts in a clean state and becomes tainted if it reads user data” — and only the clean ones skip the prompt.
An approval you can answer inside the chat is an approval an attacker can answer. Moving the dialog out of the conversation is the whole point of it.
Does it work?
Meta does not say yes. It says: “Muse isn’t immune to attack. Prompt injection remains an open problem in the industry — and Muse will sometimes make mistakes. We’ve designed the system to bound the impact when things go wrong.”
It is paying for evidence. Meta opened its Muse bug bounty to the public on the day it launched, and it prices prompt injection explicitly.Meta AI Research, How We Built Safety Into Muse, 8 Sep 2026, read at source 16 Sep 2026: the programme “awards up to $300,000 for valid reports, including up to $130,000 for successful prompt injection attempts that affect one user”.
A bounty is a claim about intent, not about safety. It tells you Meta expects the attacks to succeed sometimes. That is the honest reading of it, and it is the same reading Meta offers.
What this page could not verify
- Whether any of it holds up. Nothing here was tested; every claim is Meta describing its own system.
- How often Sentinel asks in practice. Meta says the balance is “something we expect to tune over time”.
- Muse Confidential VM. Announced for later in 2026; not shipped at the time of reading.
- Whether Sentinel checks what the Mac app does. Muse for Mac, released 17 Sep 2026, works on your own computer. Meta’s Mac help page says the agent asks before important actions, but the pages read for this update do not say whether Sentinel reviews actions the Mac app takes.Meta Help Center, help article on Muse for Mac, read at source 22 Sep 2026: “Before your agent takes an important action like sending an email or making a purchase, it asks you to confirm first.” · Mark Zuckerberg, Threads post, 17 Sep 2026: “Muse for Mac is out today!”
Meta AI Research, How We Built Safety Into Muse, 8 September 2026 · Meta, Introducing Muse, 8 September 2026. Both read at source on 16 September 2026.
Every quoted claim is a vendor describing its own product.