Meta's new agent Muse can touch your email and money. They also admit it can get hacked
Meta 推出了一款名为 Muse 的新代理，该代理具备读取电子邮件、预订服务和支付等功能。尽管这一概念被认为是创新之举，但其安全性，特别是潜在的被黑客攻击的风险，引发了广泛担忧。目前提出的解决方案包括对代理进行沙盒隔离、部署类似 Meta 自己的“Sentinel”这样的监视代理，以及在 AI 处理敏感信息（如 OTP 验证码）之前进行拦截。核心问题在于，AI 被授予了访问原本为人类阅读设计的电子邮件内容的权限，这引发了关于 AI 与个人数据交互基本方式的质疑。
时间与来源
时间显示为 UTC
显示时区：UTC
本地时区尚不可用，暂时显示 UTC。
发布当时偏移：UTC+02026年9月9日 17:39 UTC
收录当时偏移：UTC+02026年9月10日 01:00 UTC
- 发布
- 2026年9月9日 17:39
- 收录
- 2026年9月10日 01:00
- 来源类型
- 开发者社区
- 档位
- 社区
- 信源状态
- 正常
档位是按信源手工设定的编辑判断，不是逐条打分。
Ok so Meta dropped this new agent called Muse this week. It can read your email, book stuff, pay for things. cool idea I guess.
But here's the weird part. In Meta's own safety docs, they say straight up that Muse "remains susceptible to adaptive jailbreaks and prompt injection." like... they said this themselves.
And then they're offering up to $130k if you can break it with a prompt injection. that's part of a $300k bounty total.
This isn't just a Meta problem btw. Claude did something similar a couple weeks back – let it send Gmail emails without asking you first. and right after, people found the same trick: you hide text in an email (like white text on white background, invisible unicode stuff) and the AI reads it even though you can't see it. so someone could hide a command in an email and the bot just does it.
Everyone's fix is the same thing tho lock it in a sandbox, add a watcher agent (Meta calls theirs "Sentinel"), block sensitive stuff like OTP codes before the AI even sees them. fine, that helps. but it's all just building a stronger cage around the same problem. the real issue is you're giving an AI access to email that was made for humans to look at with their eyes, not for a bot to follow instructions hidden inside it.
I actually work on Atomic Mail Agentic (basically email made for AI agents) and not gonna lie, I don't really get why the whole industry is doing it this way. if the one "reading" the email is an AI and not a person, why is nobody asking if plain text email + OAuth into someone's human inbox is even the right base to build on?
honestly not sure if that's just a "get it out fast, worry about leaks later" thing, or if there's some real reason to build it this way that I'm not seeing. is it a cost thing? a "nobody wants to be the one redesigning email" thing? or am I just missing something obvious here. genuinely asking, would love to be wrong