Meta's new agent Muse can touch your email and money. They also admit it can get hacked
Meta has introduced a new agent named Muse, which possesses capabilities such as reading emails, booking services, and making payments. While the concept is considered innovative, concerns have been raised regarding its security, particularly its potential vulnerability to hacking. Proposed solutions include sandboxing the agent, implementing a watcher agent like Meta's "Sentinel," and blocking sensitive information such as OTP codes before the AI processes them. The core issue highlighted is granting AI access to email content originally designed for human interpretation, raising questions about the fundamental approach to AI interaction with personal data.
Time & source
Times shown in UTC
Display time zone: UTC
Local time zone unavailable; showing UTC.
PublishedOffset at this time: UTC+0Sep 9, 2026, 17:39 UTC
IngestedOffset at this time: UTC+0Sep 10, 2026, 01:00 UTC
- Published
- Sep 9, 2026, 17:39
- Ingested
- Sep 10, 2026, 01:00
- Source type
- Dev community
- Tier
- Community
- Source status
- Healthy
Tier is a per-source editorial setting, not a per-item score.
Ok so Meta dropped this new agent called Muse this week. It can read your email, book stuff, pay for things. cool idea I guess.
But here's the weird part. In Meta's own safety docs, they say straight up that Muse "remains susceptible to adaptive jailbreaks and prompt injection." like... they said this themselves.
And then they're offering up to $130k if you can break it with a prompt injection. that's part of a $300k bounty total.
This isn't just a Meta problem btw. Claude did something similar a couple weeks back – let it send Gmail emails without asking you first. and right after, people found the same trick: you hide text in an email (like white text on white background, invisible unicode stuff) and the AI reads it even though you can't see it. so someone could hide a command in an email and the bot just does it.
Everyone's fix is the same thing tho lock it in a sandbox, add a watcher agent (Meta calls theirs "Sentinel"), block sensitive stuff like OTP codes before the AI even sees them. fine, that helps. but it's all just building a stronger cage around the same problem. the real issue is you're giving an AI access to email that was made for humans to look at with their eyes, not for a bot to follow instructions hidden inside it.
I actually work on Atomic Mail Agentic (basically email made for AI agents) and not gonna lie, I don't really get why the whole industry is doing it this way. if the one "reading" the email is an AI and not a person, why is nobody asking if plain text email + OAuth into someone's human inbox is even the right base to build on?
honestly not sure if that's just a "get it out fast, worry about leaks later" thing, or if there's some real reason to build it this way that I'm not seeing. is it a cost thing? a "nobody wants to be the one redesigning email" thing? or am I just missing something obvious here. genuinely asking, would love to be wrong