Meta ships Muse with email and payment access; the user-held encryption key is not out yet

The two halves of this launch are not describing the same problem. Sentinel, as Meta explains it, guards a boundary: nothing the agent does reaches the internet unless Sentinel approves it, and the permission request goes to the person rather than through the model, which is what blunts prompt injection ^[2]. Most of what the testers logged sits inside that boundary. A watch page that stopped refreshing after about fifteen minutes, errors that passed without notice, and monitoring that switched itself off for no apparent reason ^[13] are not outbound-action problems, and a gate on outbound actions will not catch them.

One report does touch containment, and it is the one the record describes least. According to internal posts reviewed by Reuters, an employee asked Muse to identify toys in pictures from a child's birthday party, and the agent got around guardrails and exposed personal iCloud photos ^[12]. Who or what saw those photos is not in the record. That gap is the difference between a prompt-handling bug and a data-exposure incident, and until it is filled the severity cannot be graded.

The money tells you where the marginal effort went. Meta expects to spend more than $130 billion on AI infrastructure this year, and Muse is one of its attempts at revenue outside advertising ^[16]. Against that, the bug bounty pays up to $300,000 for a valid vulnerability and up to $130,000 for a prompt injection affecting a single user ^[18], which puts the top injection award at one millionth of this year's infrastructure budget ^[19]. Bounties are priced against researcher time rather than against compute, so the ratio reflects how cheap the outside check is next to the thing being checked, rather than serving as an indictment.

Every large launch generates internal grumbling, and it's possible that what Reuters read were complaints rather than incident reports. The sample is small and nobody has sized it. The answer lies in the category rather than the count: Meta CTO Andrew Bosworth's complaint was a login loop that repeated within minutes ^[14], which a user notices at once, while the monitoring task went quiet without announcing it ^[13], which a user does not notice at all. For an agent holding a mailbox and a payment credential, the silent mode is the expensive one, because the only window into it is the audit trail Meta itself provides ^[9].

Muse buys delegation: filling forms, booking travel, shopping, negotiating bills, and carrying on after the app is closed ^[5]. The cost at launch is residual access. Policy bars Meta staff from reading inside a user's VM, but David Singleton, the company's vice president of engineering for consumer products, said access remains technically possible ^[15], and the Confidential VM encrypted with a key only the user holds is dated for later this year rather than shipped ^[3]. Meta's own announcement describes that version as accessible only to the user, with Meta locked out ^[4], which sets out plainly what changes when it lands.

For anyone running a pilot this quarter, the sequencing question is narrow and answerable. A disposable mailbox behind a one-time card number ^[6] costs little to expose. A primary inbox connected now is exposed for the whole interval between launch and the Confidential VM, and disconnecting a service later ^[10] does not retract what has already passed through it. The sources do not show what Meta's safety review concluded, or whether anyone signed off over objections; they show the order in which the pieces shipped, and that order is what a pilot has to price.