Meta’s Muse agent runs on billions of consumer devices. That scale creates a security problem no sandbox can fully contain: how do you let an agent read a user’s email, send messages on their behalf, and navigate the open web — without giving it the keys to everything?
The answer, revealed at Meta Connect 2026 and detailed in a companion research blog post published September 8, is a kernel-level enforcement architecture called Sentinel. It is the most technically ambitious attempt yet to solve agent security at the operating system layer rather than the application layer, and its design choices reveal where the broader agent infrastructure market is heading.
The Architecture: eBPF as the Enforcement Layer
Sentinel does not rely on traditional sandboxing. Instead, it uses eBPF — extended Berkeley Packet Filter — to intercept and classify agent behavior at the kernel level. Two specific eBPF program types carry the load:
eBPF cgroup programs intercept network connections at the process level, enabling Layer 4 and Layer 7 filtering. This means Sentinel can block an agent process from reaching a network destination before the connection is established, not after data has already left the machine.
eBPF programs on LSM (Linux Security Module) hooks implement taint propagation. Every tool process that an agent spawns starts in a clean state. When that process reads user data — an email, a calendar entry, a contact — it becomes tainted. The taint is not a flag in application code; it is a kernel-level classification that follows the process through its lifecycle.
The practical consequence: a tainted process cannot send network requests to arbitrary destinations. If it tries, the request falls back to a human approval flow. Meta describes this as “tainted egress” — the kernel itself decides whether agent-generated traffic is permitted based on the data classification of the process that initiated it.
Credential Surrogation: The Agent Never Sees Real Tokens
The second pillar of the architecture is credential surrogation via a service called hatch-authd. The problem it solves is familiar to anyone who has built agent integrations: if an agent needs to send an email on your behalf, it needs OAuth tokens. But giving an agent your real tokens means a compromised agent has full access to your account.
hatch-authd stores OAuth tokens in the user’s virtual machine and mints short-lived surrogate tokens that the agent can use. The surrogate grants narrow, time-limited access to the specific action the agent is performing. The agent never sees the real credential. If the surrogate is compromised, the blast radius is limited to the specific permission and time window encoded in that token.
Sentinel acts as the sole authority for connector actions — every time the agent wants to interact with an external service, the request passes through Sentinel’s enforcement layer, which checks the taint state of the requesting process and validates the surrogate token.
The Bug Bounty: Meta Prices the Exploit
Meta’s bug bounty for Muse offers up to $300,000 for critical vulnerabilities. The most telling number: $130,000 specifically for single-user prompt injection attacks.
That figure does something unusual. It prices the exploit Meta is most worried about at a level that signals genuine concern. Prompt injection — where adversarial content in an email, webpage, or document tricks the agent into performing unintended actions — remains the fundamental attack surface for agent systems. Meta’s own research blog acknowledges this directly:
“Muse can and will still make mistakes. Prompt injection remains an open problem in the industry.”
The defense-in-depth stack Meta describes layers five distinct mitigations: model training on adversarial inputs, harness-level labels marking untrusted input sources, ensemble classifiers detecting injection patterns, human-in-the-loop approval gates for sensitive actions, and now kernel-level process classification via Sentinel. No single layer claims to solve prompt injection. The architecture assumes each layer will eventually be bypassed and designs the system to fail safely when it does.
Muse Confidential: The TEE Horizon
Meta also announced Muse Confidential VM — a Trusted Execution Environment variant that would run agent processes inside hardware-isolated enclaves. Signal founder Moxie Marlinspike was cited as a security advisor on the project. The feature is not yet live; Meta’s timeline targets late 2026.
This matters because it represents the next layer in the stack. Sentinel’s eBPF enforcement protects the kernel from the agent. A Confidential VM would protect the agent’s runtime from the host operating system itself — closing the gap where a compromised OS or a hypervisor-level attack could still intercept agent data.
What This Means for Agent Infrastructure
The deeper issue is not whether Meta’s specific implementation will work. It is that the agent security problem is being solved at the infrastructure layer, not the application layer.
Traditional security models — OAuth scopes, rate limiting, content filtering — sit in the application and assume the runtime environment is trusted. Agent systems break that assumption. An agent that reads your email and acts on it needs runtime-level enforcement that can classify data flow, not just API-level permissions.
Meta’s approach — kernel-level taint tracking, credential surrogation, hardware-isolated execution — is expensive, technically demanding, and tightly coupled to its own infrastructure. Most agent platforms cannot replicate it. But the pattern it establishes — that agent security requires operating system participation, not just application logic — will shape how every serious agent platform designs its runtime.
The $130,000 prompt injection bounty is the most honest signal in the whole announcement. Meta is not claiming to have solved the problem. It is pricing the remaining attack surface and inviting the security community to find the next failure mode. That posture — assume breach, limit blast radius, price the gap — is where agent infrastructure is heading.