Meta Published 2 Documents About Muse And Only One Mentions Attacks

Meta launched Muse connected September 8. In Meta’s ain words, it “can unfastened a browser, capable retired forms, and discuss connected their behalf,” and erstwhile it comes clip to pay, it “can cheque retired pinch Link built by Stripe.” It runs connected Muse Secure VM, “a dedicated, virtual instrumentality (VM) that houses some the supplier and a person’s data.” U.S. only, successful WhatsApp aliases the Muse app, and coming to AI glasses.

That is the news. It is besides not why I americium penning this.

Every AI institution is now pushing immoderate type of this, and I do not deliberation anyone has said plainly why.

So, I publication what Meta really published. There are 2 documents, some dated September 8: a user announcement and an engineering post. Across the words risk, attack, attacker, mistake, untrusted, and prompt injection, the announcement uses them zero times, and the engineering station uses them 39. Only the engineering station mentions that Muse will look arsenic your activity to each website it visits.

Nobody I Know Has Made One Of These Their Main Way Of Working

I person tried these products, and plentifulness of different group have. I do not cognize anyone who has made 1 of them the ascendant measurement they get things done.

I do not cognize precisely what it is. My conjecture is they want to show their AI doing thing that looks for illustration it tin prevention you time. More performative than anything.

There is simply a structural logic for that, and it is not that the models are bad. Web UX is built for quality eyes, not for machine-readability and interactivity. Every 1 of these products picks up a browser and drives it, which is why I based on AI browsers were backward. It is the hardest disposable type of the job: reference an interface designed for a person, guessing astatine it, and clicking.

The industry’s reply is that the web being built for eyes is simply a impermanent problem they are going to solve. That is wishful thinking, isn’t it? Let’s spot them do it first.

The Shape Keeps Changing While The Pitch Stays The Same

Agentic browsing has taken 3 chopped merchandise shapes successful nether 2 years.

A browser you instal and move to. OpenAI’s Atlas launched successful October 2025, ne'er near macOS, and stopped moving connected August 9, 2026. OpenAI did not locomotion distant from the idea; it moved it. The thief article covering the shutdown is titled “Evolving Atlas into ChatGPT for browser-based agentic work.”

An AI bolted into the browser you already use. Gemini successful Chrome, Claude successful Chrome.

And now a browser that lives connected their machine, which you talk to. That is Muse, and I deliberation it is the champion of the 3 shapes. You should not request to watch an AI activity successful a browser. Sitting location while a instrumentality clicks done a checkout connected your surface is not automation, it is supervision pinch other steps. Putting it successful a virtual instrumentality location is the correct instinct.

But a browser connected Meta’s hardware, logged into your accounts, raises existent questions astir authentication and identity.

Meta Published 2 Documents On The Same Day

One is the announcement connected Meta’s newsroom, written for group who mightiness usage Muse. The different is an engineering post, How We Built Safety Into Muse, from Meta Superintelligence Labs. The announcement links to it, truthful nary of this is hidden.

They are not the aforesaid story. I pulled the matter of some and counted.

The announcement says Meta “built Muse from the crushed up to beryllium a safe, secure, private, and wide disposable individual AI agent,” pinch “first-of-its-kind privacy, safety, and information protections engineered into it that nary different supplier provides.” Nothing reaches the net “unless the Sentinel approves it.” Muse “has nary visibility into people’s passwords aliases costs methods.” It “checks pinch the personification earlier delicate actions.”

Every 1 of those is true, and the engineering station backs each of them pinch existent mechanism.

Here is what the announcement ne'er says. Not once, successful astir six 1000 characters.

Risk. Attack. Attacker. Mistake. Untrusted. Prompt injection.

The engineering station uses those thirty-nine times betwixt them. It opens by saying “any supplier for illustration this will still make mistakes, and it will sometimes beryllium attacked via the information it reads,” and that Meta “designed the strategy to presume the supplier whitethorn beryllium nether onslaught and limit the imaginable damage.” It says plainly: “Muse tin and will still make mistakes.” It offers up to $300,000 for information reports, “including up to $130,000 for successful punctual injection attempts that impact 1 user.”

That is simply a institution being unusually consecutive pinch engineers. Assume it is compromised, incorporate the damage, present is money if you tin break it.

But the 2 picture the aforesaid merchandise arsenic 2 different things. One is simply a capacity communicative wherever information is simply a vanished property. The different is simply a containment communicative wherever the agent is assumed to beryllium nether attack. If you only publication the 1 written for you, you would not cognize the 2nd exists successful that form.

Only The Engineering Post Says Muse Will Appear As Your Activity

One condemnation decides what each website Muse visits sees, and it is absent from the announcement.

“When Muse browses the internet, it will look arsenic your activity, truthful if you inquire Muse to bargain a garment from a clothing designer’s website, that designer mightiness usage your sojourn to show you an advertisement connected Instagram.”

Meta is describing the design, not conceding a flaw. Muse drives “a existent up-to-date Chromium-based browser.” So the designer sees a person. Their analytics records a visit. Their retargeting fires. And the advertisement chases a quality who was doing thing other wholly while a virtual instrumentality did the browsing.

That condemnation sits successful the station written for engineers. It is absent from the 1 written for the group it happens to.

There Are 2 Tiers, And Most Websites Are In The Second One

Meta’s engineering station uses the connection connector eleven times, and the announcement ne'er uses it once.

For services Meta has a narration with, location is nary browser astatine all. “For each connector, we worked intimately pinch the work supplier to merge their API.” A negotiated interface, scoped credentials, an allowlist per worker, and a work that knows precisely what it is talking to.

For everyone else, Muse opens Chromium and behaves for illustration you.

So the mobility a website proprietor should inquire is not whether agents are coming. It is which tier they are in. If you are large capable for Meta to build a connector, you get an interface and a conversation. If you are not, you get a instrumentality wearing your visitor’s face.

Your Bot Rules, Your Paywall And Your Analytics All Check The Same Thing

Bot rules sanction crawlers. A paywall for machines checks the sanction successful 1 statement of the request. Analytics counts a sojourn arsenic quality erstwhile a browser runs the JavaScript. All of it keys connected a instrumentality identifying itself, aliases connected a instrumentality failing to look for illustration a browser.

Muse does neither, and Meta has written that down. Muse is doing thing you asked for, pinch your credentials, nether an support you gave, and Meta disclosed the behaviour successful a archive anyone tin read.

The Alternative Is Being Built By The Same Industry, In Parallel

There is simply a full group of agentic protocols now wherever the instrumentality talks to the website arsenic a machine. MCP, and its browser-side related WebMCP, fto a website manus an supplier a group of named devices alternatively of making it conjecture astatine buttons. UCP and AP2 do it for commerce, truthful a checkout is simply a telephone pinch position alternatively than a shape filled successful by thing imitating fingers. A2A does it betwixt agents. There is an IETF moving group connected Web Bot Auth, the portion that would fto an supplier beryllium which supplier it is. That split, betwixt agents that tin beryllium who they are and agents that tin only do things, is the responsibility statement the full agentic web is forming along.

None of those require anyone to pretend. Maybe the amended measurement to do this is done those protocols, and not having AI dress it is quality arsenic it browses.

That is the fork. One way has a instrumentality driving a quality interface while cipher connected the receiving extremity is told. The different has machines and websites talking to each different connected purpose. Right now the money and the motorboat events are going into the first, and the 2nd is wherever the existent engineering is happening.

I americium not going to show you to do thing today, because location is thing useful to do yet. But support a very adjacent oculus connected it, and location are 3 circumstantial things to watch.

Whether immoderate of these agents ever transportation an identity a website tin verify, which is what the Web Bot Auth activity astatine the IETF would springiness them. Whether the connector database grows, because that is the database of websites that get an interface alternatively of a browser. And whether the adjacent 1 of these launches pinch 1 archive aliases two.

More Resources:

• The Agentic Web Is Splitting Into Two Bets: Identity And Capability
• Google Gemini Can Now Control Your Computer. Hackers Are Already Targeting AI Agents
• Google Tells Developers To Build For AI Agents, Not Just Humans

This station was primitively published connected No Hacks.

Featured Image: Viktoriia_M/Shutterstock