What's this about?
Meta designs Muse as though the model can be compromised. The agent runs inside an isolated cell; separate host services hold credentials; Sentinel alone authorises connectors and all network egress; sensitive actions pause for user approval outside the model conversation.
What exactly is a “Sentinel”?
It is an independent security authority the agent cannot override. Muse proposes an action, while Sentinel checks destination, method, data flow, permission scope and user policy before allowing, denying or asking — like a bank requiring a separate signer.
Why is this worth noting?
The design addresses the “lethal trifecta” directly: untrusted content, private data and external communication. Surrogate credentials, taint tracking and least-privilege connectors limit damage even if the model follows a malicious prompt. Meta is paying up to $300,000 for bug reports, signalling that these controls are expected to be tested rather than assumed perfect.