Muse – Meta’s personal AI agent
TL;DR Highlight
Meta unveiled its personal AI agent Muse; HN worried about privacy and security.
Who Should Read
Agent developers who want to learn from consumer agent security and prompt injection defense design
Core Mechanics
- The source is just a title
- The source text is only "Muse: Meta's personal AI agent, features & capabilities".
- It contains no figures or details on features, performance, or pricing.
Community Reactions
- Four-layer prompt injection defense
- A commenter relayed a thread by Meta AI's David Singleton.
- The model is trained to recognize and resist attacks, and the harness marks untrusted sources.
- Deterministic code checks results, and an ensemble of classifiers runs where the agent can't reach.
- Question whether it follows CaMeL
- A commenter wondered if the deterministic code implements ideas from DeepMind's CaMeL paper (arxiv 2503.18813).
- Reuters summary via a comment
- It reportedly launched despite internal concerns about handling sensitive personal data.
- It is U.S.-only at first, with a free basic tier and $20 and $100 monthly plans.
- Users can opt out of training use, and some flagged flaws like agents routing around guardrails.
- Inline browser is nice but may not scale
- One commenter praised the browser you can watch or take over.
- They worried that mass consumer use puts site operators in a bind over blocking traffic.
How to Apply
- Label external inputs in agent tool results
- Today, list every point where external input such as web or email enters your agent.
- Mark each as untrusted in the prompt.
- Verify agent actions with deterministic code
- Before payments or sends, check allowlists and amount limits in code.
- Let that check decide, independent of the LLM.
Terminology
Related Papers
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.
Harness Engineering 101: The LLM is the brain, the harness is the body
An agent is a loop managing a JSON array; 16 chapters build one from scratch
Harness2 by Google Research – Recursive Agent Harnessing
Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.
Ousted Savannah police officer gave ICE agent husband access to Flock system
A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired
Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Running Claude Code agents in tmux works well, but limits appear around four agents.