Vídeo em Inglês, publicado pelo canal Pivot to AI.
Video transcript
Transcript from available captions; it may contain errors.
Hi, I'm David Gerard and this is Pivot toAI coming to you Monday to Friday. Today, Facebook's agentic privacy and security disaster. Earlier this month, Meta released Muse, its new AI agent as a service. You can download the app front end free. At first, it's very popular. What you get is an agent running on your own small virtual computer at Meta. It's like having an open claw agent, but Facebook sets it all up for you. Muse does everything. It'll go through your email. It'll book appointments. It'll even make phone calls for you using AGI. A guy instead calls are made by humans in a call center. The trouble with sending realworld tasks to a chatbot is that hallucinations are how a chatbot works. So an agent will routinely do completely wrong things that you don't want. That's tolerable when it's open claw users because every open claw user is a completely fried AI gambling addict. With Muse, ordinary people get to share this particular joy. Quote, "So Muse handled my Facebook Marketplace today. Just found out it told people my address and agreed a low ball price and then they showed up without it even telling me until late tonight that it messed up." That is Muse will happily give out your home address to strangers without checking with you. No doubt Meta will put in a prompt about that. The Muse chatbot is also an insufferable sickopant. You're absolutely right. Wow. But some people love Muse. Eli Tan at the New York Times was blown away by Muse. He was particularly impressed how it helped him cancel forgotten subscriptions. He was very big on that one. You can dump a copy of the entire Muse virtual machine for yourself. Just prompt it. Meta says this is actually intentional. The estimable Johnny from Neuromatch has of course gone digging. Every task that our New York Times guy was amazed by is hardcoded. The subscription thing is the first one in the Muse task list. Muse has a self-improvement prompt that builds a dossier on all your friends and every Facebook group you're in. Quote, Muse is instructed to read unmeated gathered deliberately from primary sources when doing its hourly social graph surveillance. Muse itself confirms this draws from any connected account including Gmail threads, Messenger conversations, Instagram profiles, Facebook timelines. The skills confirm all these are near at hand." I'm sure Meta is delighted to get all that data complete with social graphs, but Muse uses it mostly so it can help you go shopping. the highest human activity. Muse has a hidden feature to forward requests to Anthropic instead of using Meta's own Spark chatbot. This looks very like a way for Meta to train Spark on Claude's responses. Johnny says about the Muse code base, quote, that is 100% Claude authored, by the way, unmistakable. You have a Muse Linux box and you can read the whole thing and mess with it. So Johnny set up his Muse to run a Bit Torrent client. And you can even use Muse as a Monero crypto miner, which is the standard parasitical use case whenever anyone gives out free virtual machines. All of this on Meta's bill. Johnny explains where systems like this end up. Quote, "So here you are provisioning a persistent permissive computing environment run by something with an infinitely large attack surface for your customer base that consists of 99.9% of people who have never paid you a dime. So pretty much for free. Congratulations. The only form that this kind of product can take is a botnet factory." unquote. Meta's got a gadget coming for Muse as well in December. The Muse Charm. You wear it around your neck as a surveillance device for your friends so Meta's AI can train on your remaining friends. The one good point about Muse is that it's messing up venture capital funding for crappy little AI agent startups. Meta's moat is that it can just blow unlimited money on its botnet as a service and you cannot. Sorry lads, it was always going to be just the big boys. Thanks for tuning in to pivot toai. This Friday we have an interview with Cat Jones from action to protect rural Scotland who are quite successfully fighting data centers here. But what I would say my main thing is it's so important to get your head around the planning process and really help local communities with that really detailed advice on how to oppose things at the coal phase. >> The rough cut should be up tomorrow for supporters. You can become a supporter and keep Pivot toAI coming out daily by sending your $5 to the Patreon link in the show notes. Or if you prefer YouTube, just click the join button below the video. Wednesday is the supporter name read. If you want to be in that, then comment on the Patreon post or YouTube supporters can email me directly. Thank you all. I could not do this without you. I'll see you tomorrow and bye for now.
Assistir ao vídeo original no YouTube
Assuntos: Agentes de IA, Muse. Publicado no YouTube em 2026-09-28.
Seleção automática por assunto e idioma. O vídeo pertence ao canal de origem.
About Muse Sentinel and the Muse bug bounty program
Muse is the personal AI agent Meta launched on September 8, 2026. On the same day, Meta published "How We Built Safety Into Muse", a technical description of the system at launch. According to that post, the agent harness, whose internal codebase name is Hatch, runs with the user's files and tools inside a systemd-nspawn container on the user's virtual machine; root inside that container is mapped to an unprivileged host user, and the container has its own Debian root filesystem. Security services such as the safety classifiers, the credential store and Sentinel run outside the container, so the agent cannot disable them.
Sentinel is a separate agent that is the only permission authority for actions through connectors to third-party services and for all network traffic leaving the machine: Muse proposes actions, but only Sentinel can grant them. The agent only sees "surrogate" tokens, which Sentinel swaps for the real credential at the network boundary after a request is authorized. When the user has to decide, the approval dialog appears in the Muse app interface, not in the conversation, and permissions can be one-time, session-scoped, task-scoped, time-bounded or perpetual. Meta also opened the Muse bug bounty program to anyone on launch day, with rewards of up to $300,000 for valid reports, including up to $130,000 for successful prompt injection attacks affecting one user.
Fact sheet
- Agent: Muse (Meta)
- Security write-up: How We Built Safety Into Muse, published September 8, 2026
- Agent isolation: systemd-nspawn container with its own Debian root filesystem
- Permission authority: Sentinel, for connector actions and outgoing network traffic
- Credentials: Agent only sees surrogate tokens
- Permission scopes: One-time, session, task, time-bounded or perpetual
- Bug bounty: Up to $300,000 per valid report
- Prompt injection reward: Up to $130,000 for attacks affecting one user
Read also
Sources and references: Meta – How We Built Safety Into Muse · Meta Newsroom – Introducing Muse · video by the Pivot to AI channel on YouTube.
Comentários
Postar um comentário