The Agent Can Rewrite Itself. So Who Controls It?

Meta just gave its new personal agent, Muse, a remarkable amount of freedom. It can browse, work across your accounts, write code, build tools and run subagents. But Meta made one part of the system deliberately difficult for Muse to control: its own authority. In this episode of Attention Span, I look inside Muse Secure VM and the security architecture surrounding the agent. We get into Sentinel, the separate system that decides what Muse is allowed to do; why Muse can use your accounts without ever seeing the real credentials; how “tainted egress” changes permissions after a process touches private data; and why reading an email can give an agent considerably more power than “read access” suggests. And somehow, all of this takes us back to computer-security ideas from 1975. The larger question is one we are going to encounter everywhere as agents become more capable: How much freedom can we give an agent to discover new ways of doing things without allowing it to expand its own authority? *Watch it*, and tell me where you would draw that boundary. *IN THIS EPISODE* → What “rogue agent” actually means technically → How Muse Secure VM isolates the agent → Why Sentinel sits outside the environment Muse can modify → How an agent can write a new tool without granting that tool permission → How surrogate tokens keep real credentials away from the model → What “tainted egress” means and why permission may need memory → Why “read my email” can unlock much more than email → Least privilege and complete mediation, 51 years later → Where Muse's security architecture still has unresolved problems → Secure from whom? The agent, other users, or Meta itself → DeepSeek Harness + Muse: capability can become fluid; authority cannot *META MUSE* → Introducing Muse Meta's product announcement and overview of Muse Secure VM. https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/ → How We Built Safety Into Muse The technical deep dive. This is where Meta explains Sentinel, Linux isolation, surrogate tokens, credential insertion, eBPF-based taint tracking and network egress controls. https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse *THE SECURITY IDEAS BEHIND IT* → Melanie Mitchell: Misleading Metaphors and Real Risks A useful grounding discussion of what we actually mean when we say an agent “escaped” or “went rogue.” https://aiguide.substack.com/p/misleading-metaphors-and-real-risks → Saltzer & Schroeder: The Protection of Information in Computer Systems The 1975 paper behind principles such as least privilege and complete mediation that suddenly look very current again. https://web.mit.edu/Saltzer/www/publications/protection/Basic.html *RELATED ATTENTION SPAN* → Everything Is a Plugin: DeepSeek Harness Our previous episode on agents that can create and modify their own tools. https://www.youtube.com/watch?v=jtyV7O4Pt0s → AI Escaped? The OpenAI–Hugging Face Incident What actually happened when cybersecurity agents found routes outside their intended environment. https://www.youtube.com/watch?v=RGeZ2moLkIc *MORE FROM TURING POST* → We Don't Know What They Know Our deeper look at the problem of understanding what increasingly capable models know and how they will use it. https://www.turingpost.com/p/we-don-t-know-what-they-know → Turing Post https://www.turingpost.com → Instagram @turingpost_tv https://www.instagram.com/turingpost_tv → TikTok @turingpost_tv https://www.tiktok.com/@turingpost_tv → Interviews: @realturingpost