Muse doesn't trust its own model, and that's the whole design

Most people building an agent that can act on a person's behalf reach for the same fix when something could go wrong: write a better system prompt. Tell the model not to leak the API key, not to buy the wrong thing, not to fall for a prompt injection hidden in a web page. Meta's new personal agent, Muse, launched September 8, 2026, is built on the opposite assumption. Its own safety engineer, Tarek Sheasha, writes that the team designed the system to assume the agent may be under attack and limit the damage when it is. The model never gets the chance to leak a secret it never held.

The agent runs in a cell that can't see the keys