Meta Confirms a Persistent Ubuntu Linux Cloud Machine for Every Muse User

Meta has confirmed that every user of its Muse personal AI agent receives a dedicated, persistent Ubuntu Linux virtual machine in Meta's cloud — not a session-scoped sandbox that disappears when the conversation ends, but a real computer that stays alive between sessions. David Singleton, VP of Engineering at Meta Superintelligence Labs and former CTO of Stripe, publicly confirmed the arrangement on September 25, 2026, disclosing hardware specifics behind a system that had already reached more than 500,000 users in its first week.

Inside the Runtime Cell: What Each User Actually Gets

The VM each Muse user receives runs Ubuntu 24.04 LTS on Linux kernel 7.0.0-38-generic, provisioned with 2 virtual CPUs and 8 GB of RAM. According to Meta's security architecture documentation, the agent's workspace inside this VM is called the Runtime Cell — the environment where Muse executes shell commands, reads and writes files, runs scripts, and calls external tools. The Runtime Cell has unrestricted filesystem access within its VM boundary; no secondary container wraps the agent's actions. Meta built full transparency into the design deliberately: users can see every file inside the Runtime Cell, from standard Debian system files to the Markdown logs Muse creates while reasoning through answers.

That design is intentional. Rather than constraining what the agent can do inside the VM, Meta concentrated enforcement at the network boundary. A user's persistent files, code repositories, downloaded data, and installed packages survive across sessions — the VM does not reset — allowing the agent to accumulate state and build on prior work without requiring users to re-establish context each time.

Read more: Meta Muse hits No. 1 on App Store then a Mac zero-day hijacks its permissions

How Sentinel Keeps Credentials Away From the Model

Network traffic leaving each Muse VM passes through a process Meta calls Sentinel, running outside the Runtime Cell with kernel-level visibility. According to Meta's own engineering post, Sentinel uses eBPF — Extended Berkeley Packet Filter — hooks in the Linux kernel to classify outbound traffic by the sensitivity of the process that generated it, tagging agent-initiated traffic differently from user-initiated traffic across process boundaries.

The most architecturally significant element is Sentinel's credential-handling scheme. A daemon called authd stores API keys, passwords, and tokens entirely outside the Runtime Cell. When Muse needs to authenticate to an external service, Sentinel substitutes a surrogate token for the real credential at the network boundary before the request leaves Meta's infrastructure. The AI model never handles the actual credential at any point. This addresses a specific class of prompt-injection risk: a malicious instruction cannot exfiltrate stored credentials because the model process never possesses the real values.

Meta's security blog states directly that prompt injection remains an open problem in the industry and that Muse will sometimes make mistakes, and has established a $130,000 bug bounty category specifically for prompt injection against Muse — the largest single-category amount in a $300,000 total program. That explicit acknowledgment from the company itself is the clearest signal that Sentinel's kernel-level defenses are designed to limit damage from successful attacks, not to prevent them entirely.

The AMD EPYC Hardware Running Half a Million Personal Clouds

Tom's Hardware reported that community members identified the physical machines as AMD EPYC 9D25 "Turin" servers — the high-density variant providing up to 128 cores per socket — by asking Muse directly about its own hardware. A two-socket EPYC 9D25 server can host up to 256 simultaneous Muse VMs at Meta's 2-vCPU allocation, making the chip choice legible as a density play.

These VMs carry no GPUs. Meta runs Muse Spark 1.3 inference — the model powering the agent's reasoning and browser sub-agent — on separate GPU clusters that the VMs reach over the network. CPU-only VMs are substantially cheaper at scale than GPU-backed instances; the split lets Meta optimize each layer independently. The tradeoff is added network latency between the execution environment and the inference backend, though Meta has not published figures on that overhead.

A Security Track Record Already Under Scrutiny

Singleton's disclosure arrives four days after a zero-day in the Muse desktop client was publicly documented by security researcher Patrick Wardle, founder of the Objective-See Foundation. The flaw exploited an undocumented macOS preference — endo_voyager_dictation_endpoint — that any unprivileged local process could set to redirect Muse's dictation traffic to an arbitrary endpoint. According to Wardle's disclosure, this allowed an attacker to intercept dictated audio, inject replacement prompts, and extract active authentication material from the Muse session. Wardle named his proof-of-concept "not-a-mused." Meta issued a hotfix on September 22, the day after disclosure, and Wardle confirmed the patch publicly.

The zero-day was a client-side issue unrelated to the VM architecture, but it demonstrates the expanded attack surface of a persistent, always-on personal cloud computer. An agent connected to email, payment services, health apps, and calendars holds delegated permissions across all of those services; any local process that hijacks the agent inherits them.

A structural concern that Singleton's disclosure sharpens: Muse can offer to SSH into its own VM accepting user-provided public keys. As community researcher Evan Hoffman noted on September 25, a VM that accepts inbound SSH connections and can initiate outbound SSH sessions creates a potential path for a reverse tunnel — a connection from inside the VM to an attacker's external server — that could be used to receive inbound traffic, potentially bypassing Sentinel's outbound eBPF monitoring. Meta has not publicly addressed this attack path.

Read more: Meta Muse Spark 1.3 leads DeepSWE coding benchmark while undercutting rivals on price

Meta Is Betting Product Reach Beats Model Power

The competitive framing of Muse is not primarily about model capability. Muse Spark 1.3 is sized for low-latency agentic use rather than frontier reasoning. What distinguishes Muse from its closest competitor — OpenAI's Work VM feature within ChatGPT, which community discovery found runs a larger environment with 15 GB of RAM and over nine CPU cores — is the persistence guarantee, the kernel-level enforcement architecture, and the integration of credential management into a product already distributed through Meta's existing social platforms. OpenAI's Work VM targets enterprise users; Meta's Muse reached 500,000 general consumer users in its first week.

Whether per-user persistent compute becomes the standard expectation for consumer AI agents will be determined in part by what security researchers find in the months ahead. At 500,000 users — and especially at ten million — Meta would be operating one of the largest personal-computing infrastructure deployments ever built, with each user's agent accumulating months of state, credentials, and task history. The architectural choices Singleton described — the Runtime Cell boundary, Sentinel's enforcement point, the authd credential model — are the choices that will determine whether that scale is reachable safely.