Meta's Muse Never Sees Your Passwords. That Is the Most Interesting Thing About It.

Meta shipped Muse on September 8 and every write-up since has been about the same thing: can it book your travel, can it fill in your forms, how fast is it. I spent a week giving it real work, and the part that actually impressed me was not the agent at all. It was what happens to your passwords.

They never reach the model.

How it actually works

Meta's own documentation is specific about this. Credentials go into a Secure Credentials Store. Muse completes an authorized action without the model ever seeing the password, including passwords you type into the browser yourself. The real credentials get injected at the network boundary by a separate agent called Sentinel, which lives outside Muse's main runtime and acts as the permission authority for connector actions and network traffic.

The model can propose an action. It cannot authorize one.

Sit with what that means. If the model is ever prompt-injected, tricked by a malicious page, or simply confused into attempting something it should not, there is nothing useful for it to leak. It never held the secret in the first place.

Permissions are scoped rather than blanket: one time, session-limited, task-limited, time-bound or ongoing, and later actions have to match the scope that was granted. Every user gets an isolated virtual machine that no other agent can reach. There is a full audit trail of what it has done and what it plans to do next.

I watched it work in the least glamorous way possible

Early in the week, Muse surfaced a message that a stored sign-in had expired and a fresh one was needed. It did not fail silently. It did not ask me to paste a password into the chat window, which is what almost every other tool would have done.

A credential timed out, and the system declined to route around it.

In the moment that reads as friction. It is the architecture working exactly as designed, and it is the single best piece of security thinking I have seen in this category.

Why this matters more than the demo

Every agent product is impressive on its good day. The question that decides whether you can put one near your business accounts is what it does on the bad day, and specifically: when something goes wrong, what can it give away?

Most tools answer that badly, because the model holds the keys. Muse answers it well, because it does not.

If you are evaluating any agent that wants browser access to your accounts, this is the standard to measure it against. Ask where the credentials live, ask whether the model can see them, and ask who authorizes an action. If the answer is "the model does," you are one clever prompt away from a bad afternoon.

My verdict

It is great, and I would use it for real client work like outreach and social media management. Use it at your own risk, though. In my experience it needs a lot of oversight. Over the same week the browser layer went down across every session, and it was fixed that night, a few hours after I reported it through the app's own Report an issue form. The independent leaderboards still put it behind Claude on agent work. I wrote all of that up with the screenshots and the benchmark numbers here:

Meta Muse review: the fastest AI agent I have used, when it is working

But the security model is the part that will outlast this version, and it is the part worth copying.

Jessica Wells is the founder of Mining Wells Marketing Agency.

Sources: Meta newsroom · Meta Help Center, Muse privacy and security · Meta AI Research, How We Built Safety Into Muse