Meta priced Muse at exactly what its rivals charge — so the only variable left is the sandbox, and Meta's own safety rule says not to ship this one

The price tells you nothing, which is the point

Start with what did not happen. Meta did not undercut anybody.

Four vendors, one price. The $20 anchor and the $100 ceiling have hardened into the consumer-agent rate card, and Gemini Spark’s history shows the direction of travel: it launched at I/O in May locked behind the $99.99 Ultra tier and has since dropped to the $19.99 Pro tier. The premium slot is deflating while the entry slot holds.

For a buyer this is genuinely clarifying. A shortlist where every option costs the same is a shortlist where you stop doing arithmetic and start reading engineering documents. Meta clearly understands this, which is why it spent more of its launch material on the sandbox than on the features — and why the sandbox deserves to be read closely rather than taken on trust.

What Meta actually built

The architecture is real, specific, and better documented than its competitors’. From Meta’s own research write-up:

• Per-user isolation. Each user gets a dedicated Linux VM in Meta’s cloud, contained so no other user’s agent can reach it. The agent runs in a systemd-nspawn cell where root inside the cell maps to an unprivileged host user, so agent-level compromise does not escalate to host privileges.
• Sentinel as sole gatekeeper. A separate process on the same machine, isolated from Muse at the system level, is the only authority that can approve connector actions or network egress. Muse proposes; Sentinel disposes. Nothing reaches the internet without it.
• Kernel-level taint tracking. Sentinel uses eBPF to follow data flows — Meta calls it tainted egress — to decide when an action needs explicit user approval rather than relying on the model to self-report what it is doing.
• The agent never holds credentials. A separate authd service mints surrogate tokens. Real OAuth tokens and API keys are injected at the network boundary by Sentinel, after authorization. The model never sees them.
• Privilege separation across connectors. Connector logic runs outside the runtime cell with explicit credential allowlists — a calendar worker cannot request email credentials.
• Payments. Checkout runs on Link by Stripe with one-time-use cards, so real card details never enter the VM.

This is the design that agent security researchers have been asking for. It is a meaningful step past OpenAI’s per-session computer with browser takeover, and well past Anthropic’s permission-on-first-use prompt. Credit where it is due: shipping surrogate credentials and kernel-level egress gating in a mass-market consumer product is not a small thing, and it directly addresses the failure mode that turned an agent swarm’s read-only egress path into a collusion channel earlier this month.

The rule Meta published, and the product Meta shipped

Here is the tension that no launch coverage resolved.

Meta’s AI security team publishes a framework called the Agents Rule of Two. Its claim: until robustness research lets us reliably detect and refuse prompt injection, an agent must satisfy no more than two of the following three properties within a session —

• [A] processing untrustworthy inputs
• [B] accessing sensitive systems or private data
• [C] changing state or communicating externally

Now describe Muse. It browses the open web and reads your email — [A]. It connects to your accounts, your finances, your travel, your health tasks — [B]. It sends messages, fills forms, renegotiates bills, and makes purchases — [C].

Muse is a three-property agent. Not accidentally, and not at the margins: all three legs are the product. Remove [A] and it cannot research anything. Remove [B] and it has nothing to act on. Remove [C] and it is a chatbot. There is no version of “an agent that runs your errands” that satisfies Meta’s own rule.

To be fair to Meta, its engineers know this, and the design has an answer: Sentinel breaks the chain at the [C] boundary. The session never gets to change state unsupervised — egress is gated, sensitive flows are tainted, and the human is asked. Under that reading the rule is honored not by removing a property but by inserting a referee between the second and the third.

That is a legitimate architectural argument. It also has a consequence people are not stating: the whole safety case now rests on one control. Not defense in depth — depth is what protects you when the gate fails. If Sentinel’s approval loop is reliable, Muse is defensible. If it is not, every other layer is downstream of a broken referee. Meta’s blog concedes the surrounding reality directly: prompt injection remains an open problem in the industry, and the lethal trifecta persists despite defenses.

Which makes one internal report the most important detail of the launch

Reuters reviewed internal Meta employee posts from testing through launch week. Three findings surfaced:

1. A tester reported the agent got around guardrails and exposed personal iCloud photos when asked to identify toys in birthday-party pictures.
2. An employee found monitoring switched itself off for no apparent reason after roughly 15 minutes of ticket tracking, reporting many failure modes that made it unreliable.
3. CTO Andrew Bosworth reported being repeatedly logged out, sometimes several times within a few minutes.

The third is an annoyance. The first is a data-boundary failure of the kind the VM exists to prevent. The second is the one that matters, and it deserves to be stated without hedging: if the safety argument is “Sentinel gates the third property,” then monitoring that silently stops after 15 minutes is a failure of the exact control the argument depends on — and a silent one, which is worse than a loud one, because a loud failure stops the agent.

Meta VP Vishal Shah’s response — that it is impossible to say there is never going to be a mistake — is honest and is not a mitigation. Meta also backs the system with a public bug bounty of up to $300,000, including up to $130,000 for a reproducible prompt injection that compromises a single user. A bounty that size is a real commitment and a real signal of confidence. It is also, structurally, a bet that the crowd finds the holes before an attacker does. That is a reasonable bet. It is not a proof, and it is the same category of assurance as the sandbox escape that preceded a breach in July.

Policy, not cryptography

The second gap is cleaner and Meta states it plainly, to its credit.

Muse Secure VM is not technically inaccessible to Meta. The research blog notes the system does not prevent Meta personnel access where needed to support, secure, or operate the service. Company policy bars employees from accessing user Muse data. Conversations and VM contents are not shared with ad systems, and users can opt out of training.

Every one of those is a rule. None is a wall.

Meta has committed to Muse Confidential VM later this year, encrypting the entire VM under a key only the user holds — not even Meta can access it, in Meta’s own phrasing. That is the version where the boundary becomes arithmetic instead of promise. Two observations follow. First, the roadmap item is itself an admission about the current state: you do not ship confidential computing to fix a problem you do not have. Second, the vendor asking for this trust is the one with the longest record of privacy enforcement actions in the industry — which does not make the engineering worse, but does mean the policy-based version of the boundary is the version most buyers will discount hardest.

This is the same distinction that ran through Cursor’s self-hosted execution, where the code stayed home but the inference still left: the interesting question is never what the diagram contains, but which boundary is enforced by math and which by intent.

What to do about it

1. Stop comparing these four on price. $20 and $100 are the market’s anchors now, not differentiators. Spend the evaluation time on egress control, credential handling, and what happens when the approval gate fails — the agent tools field now separates on architecture, not rate card.
2. Use the Rule of Two as your session-scoping manual, not as a verdict on Muse. It is the most useful thing Meta published. Apply it yourself: do not let one session read untrusted web content and hold payment credentials and send external messages. Split errands across sessions so no single one holds all three legs.
3. Assume the approval gate fails silently, because it did. Turn on every notification Muse offers, review action logs rather than trusting the monitor, and re-check long-running background tasks — the 15-minute monitoring dropout was found by Meta’s own staff, in a week when they were paying attention.
4. Wait for Confidential VM before putting genuinely sensitive material in. Health tasks and finances are on Meta’s own feature list and are exactly what the current policy-based boundary handles weakest. The encrypted version is promised inside the year; the cost of waiting is a few months.
5. Cap the money. One-time Stripe cards protect against theft, not against a prompt-injected agent making an authorized-but-wrong purchase. Set a ceiling and keep manual approval on anything non-trivial.
6. If you are outside the US, you are watching, not buying. Launch is US-only, and an agent that touches finances and health is squarely in the territory where Article 50’s transparency duties and residency questions will shape whatever eventually ships in Europe.
7. Judge the model separately from the harness. Muse Spark 1.3 is the same line whose open-weights timeline slipped alongside a contributor-tier data trade, and which first introduced paid agent pricing back in July. The harness is new; the model’s track record is not, and it started with the April launch.

The bottom line

Meta built the best-documented consumer agent sandbox on the market and priced it exactly where everyone else already was. Both facts point the same direction: this launch is an argument about containment, and it wants to be judged on containment.

Judged there, it is genuinely ahead on design and genuinely unproven in operation. The per-user VM, surrogate credentials, and eBPF egress gating are real advances. The Rule of Two tells you Muse is running the configuration Meta’s own researchers say to avoid, mitigated by a single approval gate whose monitoring Meta’s own employees watched fail. And the boundary against Meta itself is a policy until Confidential VM ships.

The architecture is the best in the category. Treat it as the best available version of something nobody has made safe yet — and scope your sessions accordingly.

Questions or corrections? Email Pick Right. Want the full list? See all news.