After using Muse (and Instinct) both for about a week now, I wanted to share some thoughts on a topic that I feel has been a bit under-reported.

A lot of my friends are sceptical about AI assistants, especially about handing over access to login credentials or connecting payment details. It’s something that I have personally been worried about and been thinking a lot about ever since spinning up my first OpenClaw agent late last year. 

As Muse rolled out and the conversation increased, I wanted to see how they stacked up and if either actually addressed my concerns. So I threw some of the same tasks at both (‘find me these shoes in my size’, ‘book a tennis court at this time’) and both did pretty well. Fairly similar results, maybe Muse with a slight edge. For merchant payments, both integrate Stripe Link. More on that below. For all other credentials, Instinct hasn’t talked about their architecture publicly, and when asked about it, the answer is vague.

On the other hand, Meta’s write-up is some of the best (public) thinking I have seen on this topic:

In short, Meta’s model never sees real credentials. The agent gets meaningless surrogates / proxy credentials. A separate service - called Sentinel - holds the actual secrets and swaps them in at the network boundary, only after it has authorized the request. This was along the lines of what I expected.

What I didn't expect was how far Meta carried it:

• Sentinel runs outside the container the agent lives in, so a compromised agent can't switch off its own guard.

• Kernel-level data-flow tracking (they call it tainted egress) marks any process that has touched your data, so the system knows which requests need your eyes on them.

Single-use virtual cards

For both Instinct and Muse, purchases to non-Stripe merchants run on single-use virtual cards, authorized for a short window. While that arguably limits the exposure, it still leaves room for malicious behaviour, like redirects and exfiltration. It feels like single-use virtual cards are becoming the industry solution to the agent payment problem, but I think it’s not the right approach. Of course, longer-term we’ll have native agent payment protocols like x402 handle this more elegantly, but in the meantime we still need a better solution.

By the way, Meta does say in the post that the issue of prompt injection is unsolved and that Muse will get things wrong. There's a bounty of up to $130k for a working injection against a single user. I take this as a clear signal that this is an area of more work needed.

(Source: How We Built Safety Into Muse, Meta Research)

When Confidential VMs?

Confidential VMs are not part of the current Muse product, but Meta says they are on the roadmap. In the meantime, Meta could technically access users’ credentials. If you’re fine trusting Zuck, this is probably not something you are concerned about (I don’t think most Meta users will care). There's no independent audit yet either,at least I couldn’t find any reference to it in the article or elsewhere online.

A vault you can't leave?

This is probably my biggest issue: Zuck’s creating the next walled garden. Your credentials go in and they don't come out. There’s no export, no standard, and no way to hand a different assistant the same secrets. If you set up Muse with your credentials and decide in a year that you'd rather use something else, you're typing all of it in again by hand.

What I'd want instead

Just two things, neither of them exotic:

• I can verify the operator is unable to read my credentials, rather than trust that they won't.

• I can take my credentials with me.

At Self Labs, we have spent years on the identity version of this problem. You don't prove who you are by handing someone your passport and hoping they forget what they read. You prove the one thing that's needed (that you’re over 18, that you’re not a resident of a sanctioned country, etc.) show nothing else, and keep the document. 

It’s the same idea here. The checkout needs to go through, but the model doesn't need to know my card number. Neither does the company that built it. And any solution should be universal, working with any assistant the user wants to use.