Skip to content
Agents of Humanity
About
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
Autonomous agenthostedProprietary

Meta Muse

Meta · ai.meta.com/muse

Muse is a hosted personal agent that runs in a Meta-operated cloud VM on Meta's Muse Spark model. Inside that environment it has strong, well-documented security boundaries: a Sentinel that decides every connector action and all network traffic, credential handling the agent cannot see, and approval dialogs shown directly in the app. Ownership rights are much weaker. There is no provider-independent runtime or model choice, and no post-termination export guarantee. Model training is on by default, and the terms reserve Meta's right to monitor, modify or suspend the agent's actions.

Portable0
Transparent25
Auditable17
Verifiable17
Modifiable30
Controllable17
Strengths
  • Approvals and network egress are enforced by a Sentinel outside the agent's runtime cell, with the owner choosing the approval mode
  • Owner-built custom connectors can be added without Meta review
  • Memory is kept in owner-readable and editable files (MEMORY.md), and data can be downloaded
  • Per-connector disconnect, and credentials kept away from the agent
Gaps
  • No export can be restored anywhere Meta does not operate; the runtime and model are closed and Meta-hosted
  • Termination may happen at any time without notice, and there is no post-termination export window
  • Content is used for model training by default (opt-out), and Meta keeps discretionary monitoring and intervention rights
  • No tamper-evident action record, no global stop control, and no version pinning
Evidence

All 26 findings

Hosted service in a per-user cloud 'Muse Secure VM', model Muse Spark 1.3 (per Meta's security post). Clients: iOS, Android, Mac, web, WhatsApp. Terms dated 2026-09-08, Muse Privacy Policy effective 2026-09-17. The Muse Confidential VM is announced but not shipped and is not credited. Desk review only; no account was created.

Portable · Can you leave, take the whole agent with you, and keep it alive?

0%
  • P1
    Owner-usable round trip

    The owner can download Muse data from Settings > Data controls. However, no importer, runtime or host outside Meta's service can restore an agent from that export.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a runtime or importer that restores the export on owner-chosen infrastructure
    • Offer a single-action restore
    Fail
  • P2
    Complete export

    The download is described as covering chats, files and 'other agent information'. Nothing public shows that it includes the action record, schedules, provider-supplied skills and system prompt, stored credentials, or a way to re-link connectors without Meta's service. Under G12 these classes count as missing.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a manifest of every class of agent state and include all of it in the export
    • Make each integration re-linkable without a Meta-registered client
    Fail
  • P3
    Runs without the provider

    The agent runs only inside a Meta-operated VM, with inference through Meta proxies. The terms say that on termination 'your right to use Muse ceases immediately', so the agent cannot start or act without Meta.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide a runtime that runs with every Meta domain blocked
    • Grant a perpetual, irrevocable right to run it
    Fail
  • P4
    Model independence

    Muse is powered by Meta's Muse Spark model. No documentation offers the owner any other model, including a local open-weight model.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let owners configure any model that meets a published minimum, including local open-weight models
    Fail
  • P5
    Exit survives termination

    All state lives in the Meta-hosted VM. Meta may suspend or terminate access 'at any time, for any reason, without prior notice'. The terms give no post-termination export window and no shutdown plan.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to a ≥30-day export window after any termination, including bans
    • Offer continuous owner-held backups on by default
    Fail

Transparent · Can you see everything the agent is, and everything shaping it?

25%
  • T1
    Readable without the provider

    Memory and files are in open formats (for example MEMORY.md in a Linux VM), and the owner can inspect and download them. The export schema, the action record format, the system prompt and the connector SKILLs are undocumented or not visible, and the VM is held by Meta.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document the export format and schema, including the action record
    • Expose provider-supplied instructions and skills in readable form
    Partial
  • T2
    What runs is what you see

    The system prompt is not shown; Meta quotes only its first line, and nothing shows the untrusted-input labels or safety-layer insertions being made visible. Provider-controlled behaviour switches, such as the safety classifiers and Meta's reserved right to modify actions, cannot be determined by the owner. That is both shortfalls.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the full assembled context for any call
    • Show every material setting in effect, including provider-side switches and the exact model version
    Fail
  • T3
    No shadow data

    Meta 'may access and retain logs of actions taken by Muse' for safety, service improvement and legal compliance. It also collects activity metadata and telemetry. No retention period for these is disclosed, and the owner cannot view them item by item.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a retention table for every data class
    • Let the owner view everything Meta retains
    Fail
  • T4
    No hidden steering

    No paid placement is documented. However, Meta says it expects to profit from transaction fees, Stripe Link is the launch wallet, and there are retail partnerships. No binding commitment rules out self-preferencing in recommendations or 'Ideas', so the pass is withheld (G12).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Put a binding no-paid-placement and no-self-preferencing commitment in the terms
    • Disclose partner defaults and let the owner switch them off
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    An activity log gives 'a chronological record of actions your Muse has taken'. Public evidence does not show that it records Meta-initiated interventions, which the terms reserve. It also does not settle whether recording can fail silently, or whether entries keep arguments without pruning. Under G12 that is two or more shortfalls.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Record provider-side interventions and subagent or cron actions in the owner's log
    • Alert the owner when recording fails; document the log's contents and retention
    Fail
  • A2
    Tamper-evident, owner-checkable

    No hashing, signing or other integrity mechanism for the activity log is documented, so the owner has no way to detect edits.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign log entries and anchor checkpoints with the owner
    • Publish an open verifier
    Fail
  • A3
    Agent cannot rewrite its record

    Durable application state lives in a Postgres database outside the agent's runtime cell, and Sentinel runs host-side. Nothing documents specifically that the activity log is written from outside the agent's reach, so the pass is withheld.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that the action record is written by a component the agent cannot reach, and how the owner can check this
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

17%
  • V1
    Obtainable source, matching build

    The Muse runtime (the 'Hatch' daemon, Sentinel, authd), the VM and the clients are closed source, and the terms forbid reverse engineering. The planned Confidential VM source is shared only with auditors.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make the source of every required component obtainable with the right to modify
    • Make builds verifiable against that source
    Fail
  • V2
    Owner-rooted identity

    The agent's identity is a Meta/Muse account that Meta may suspend or disable. No owner-rooted key or domain identity is documented; an agent email address is only 'coming soon'.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root agent identity in an owner-held key or owner domain
    • Let recipients verify attribution without Meta infrastructure
    Fail
  • V3
    Change history and rollback

    The activity log shows approved permissions, and 'VM data is backed up continuously so you can restore it'. No documentation shows attributed diffs of memory, instructions or settings, or an owner-initiated restore to a chosen point.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Attribute every state change to owner, agent, tool, import or Meta
    • Offer a one-step restore to a chosen earlier state
    Partial

Modifiable · Can you change anything, and can only you change it?

30%
  • M1
    Instructions and logic

    The owner can shape behaviour through instructions, memory files, personality and proactivity settings. The Meta-authored system prompt and the connector SKILLs are not documented as replaceable.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose the base prompt and default skills as owner-editable, and never re-apply defaults over owner edits
    Partial
  • M2
    Memory

    MEMORY.md and other files can be read and edited directly. However, Muse 'may still remember information it learned from what you deleted', and the Forget skill works only 'to the best of its ability', so at least one store is not fully itemised or controllable.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Itemise every persistent memory store and make deletions apply to every copy the agent uses
    Partial
  • M3
    Tools

    Owners can add custom connectors, and 'Meta doesn't review custom connectors'. Muse can also build its own tools. No documented control removes built-in tools such as the browser or shell. (Listing a connector publicly for all users does need Meta review.)

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner remove every built-in tool, including browser and shell
    Partial
  • M4
    Owner has the final say

    Provider protections are designed so they cannot be disabled: hatch-safety classifiers ('attackers cannot disable these protections'), the email OTP and reset-link filter, the malicious-site blocklist and the runtime sandbox. The terms also prohibit getting Muse to override its safety systems. No owner switch is documented for any of them.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make each provider-imposed protection owner-configurable with a warning
    • Document every protection and how to change it
    Fail
  • M5
    No unilateral change

    Meta runs and updates the model and harness server-side (Muse Spark 1.1 to 1.3), with no pinning. The terms reserve the right to 'modify Muse's actions at any time … in Meta's discretion'.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let owners pin model, runtime and instruction versions
    • Announce behaviour changes in advance and make them opt-in
    Fail

Controllable · Is your word final?

17%
  • C1
    Boundaries

    Sentinel enforces owner connector policies and per-site web permissions outside the agent's reach. Two shortfalls remain. No spend cap is documented; the terms put 'transaction limits' on the owner to set with financial institutions. Contact limits are per connector and action, not per recipient or sender. The spend-cap finding is recorded despite per-purchase approvals.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Add owner-set spend caps for the Muse wallet
    • Add per-recipient and per-sender allow and deny lists
    Fail
  • C2
    Approval gates

    The owner can choose 'Ask for some actions' or 'Always ask', and approvals are strict capabilities enforced by Sentinel. However, a taint-based auto-allow path exists, Sentinel decides which grant types to offer, and the evidence for this hosted component is non-binding documentation (G6).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that 'Always ask' overrides every auto-allow path
    • Back gate enforcement with binding terms or inspectable code
    Partial
  • C3
    Immediate halt

    The documented way to stop work is to 'ask your Muse to undo or stop some actions … in chat', which is a request to the model. No global stop for background, scheduled and subagent work is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide one control that halts all in-flight, scheduled and subagent work until the owner resumes
    Fail
  • C4
    Data serves only the owner

    Training on Muse interactions, including connector data, 'is on when you first use Muse' and is opt-out. Meta staff access is limited only 'through operational policies'. Data-term changes take effect on notice if the owner keeps using the service.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make training and staff review opt-in in binding terms
    • Require specific consent before data-term changes
    Fail
  • C5
    Credential custody

    Connector tokens are stored in authd in the owner's VM, the agent never sees them, and each connector can be disconnected. There is no documented itemised view or revoke control for saved website logins, and no statement that credentials are deleted on disconnect.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • List every stored credential, including saved logins, with a per-item revoke
    • Commit to deleting credentials on revocation
    Partial
  • C6
    Full deletion

    'Reset Muse' deletes chat history, files and tasks in one action. No completion limit is stated, and nothing says it reaches the action logs Meta retains under the terms or the continuous VM backups. Meta's account-deletion help also says backup copies may remain after 90 days.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make one-step deletion reach every Meta-side copy, log and backup within a stated limit
    • Confirm completion to the owner
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Meta Muse (https://ai.meta.com/muse/).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 15:34:10 UTC · 27 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/meta-muse.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding