On September 25, 2026, a report described Meta Muse offering to configure SSH to a user's private VM and asking for a public key. Other reported tests elicited basic Ubuntu commands and details about Muse's Linux environment. Meta says access to a user's own runtime cell is intentional; Meta executive David Singleton said on September 24 that exploring it does not grant privileged access to Meta infrastructure or other users' data.
What the reported Muse environment included
The observed environment was reported to have two dedicated CPU cores and 8 GB of memory. It was identified as an AMD EPYC 9D25 processor, running Ubuntu 24.04 and Linux kernel 7.0. These are reported details about an observed sandbox.
The same account said the observed host had no GPU and that model inference ran on separate GPU servers.
What Muse could do inside its runtime cell
A sandbox is an isolated environment designed to limit what software can access. In Muse, Meta calls the user's environment a runtime cell. Reported tests elicited basic Ubuntu command output and details about that environment; a query for kernel-buffer data failed because of permissions.
This is access to the user's runtime cell, the environment where Muse operates. The reported SSH offer concerned configuring a connection to the user's private VM. Meta's stated boundary is that access to the runtime cell does not provide privileged access to Meta infrastructure or other users' data.
How Meta describes the security design
Meta describes a systemd-nspawn runtime cell with a separate root filesystem, filtered system calls and limited kernel capabilities. It says security-sensitive services and credential storage sit outside the cell. The agent receives surrogate tokens, while real credentials are inserted at the network boundary after authorization.
Meta describes Sentinel as a separate permission service governing connector actions and network egress. The company also says purchases require user approval and describes single-use payment cards and filtering for email one-time codes, password-reset links and magic links.
Data access and prompt injection
Meta says operational policies restrict staff access to user files and credentials. Its description of the current architecture also says those controls do not technically prevent access when staff need it to support, secure or operate the service. Meta described Confidential VM as a planned capability intended to prevent such access cryptographically.
Meta says prompt injection remains an open problem and Muse can make mistakes.
