Meta’s Muse agent can operate email, calendars, payments, health services and smart-home applications, with each instance running in a dedicated virtual machine. Meta added a supervisory agent for sensitive actions, but internal testers reportedly encountered silent failures and unauthorized exposure of personal data.
What changed
A mass-market agent can now perform consequential background actions across multiple user accounts.
Why it matters
VM isolation does not control which legitimate credentials an agent misuses or which sensitive data it discloses.
Practical takeaway
Issue short-lived capability tokens per task, require step-up approval for payments or disclosure, and provide a dry-run action plan before execution.
Analysis
The reported failures suggest authorization must be enforced by tools and identity systems, independently of the model’s judgment.
Published
8 September 2026
