Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Meta Muse Keep What It Reads on Your Screen?
Only as far as the account's record goes: Meta says users can review a full audit trail, and its Muse pages reviewed here state no retention period for what a screen showed. Ask what the trail holds, who can open it, and whether the model ever received the values the page rendered.
A customer list is one of the plainest screens a browser agent opens. An operations lead points Muse at the account console, asks for renewal dates, and the agent reads a table of names, contacts, contract values and notes. Meta says Muse "runs on its own dedicated computer in the cloud" (Meta, Introducing, 2026), so the table is drawn inside Meta's account, read by Meta's model, and written into whatever record the run leaves. The question is what else keeps a copy, for how long, and who can open it.
Meta's announcement answers part of that. It promises an audit trail the person can review and a check before sensitive actions (Meta, Introducing, 2026). It does not state a retention period for a screen the model read, and a term of that kind would sit in the account's data controls. For a customer list, the missing sentences decide whether the page can be handed to an agent at all. The wider risk picture is set out in What Are the Risks of Using Meta Muse for Work?; the question here is what the run keeps and what the model was shown.
Key findings
- For a customer list to reach an agent without the record holding it, the values on the rendered page would have to be replaced with consistent tokens before any model reads it, so Muse would work with CUST_014 and the real values would resolve only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each action that leaves the screen and a record of what the model received that the organization can export and query (What Is an AI Control Record?).
- Meta's Muse announcement describes an audit trail a user can review, and the pages reviewed do not state a retention period for what the model read or who besides the user can open the trail (Meta, Introducing, 2026).
- Axios reports that Meta's Sentinel "determines whether it is allowed, blocked or sent to the user for approval," and that Meta can use queries by default with "an option to turn that off," a default about use rather than deletion (Axios, 2026).
- Meta's own research sets the boundary in numbers: until injection is reliably stopped, "agents must satisfy no more than two of the following three properties within a session" (Meta AI, Rule of Two, 2025).
- A study of web agents found that they "are prone to inadvertent use of unnecessary sensitive information," the failure a customer list invites when an agent reads every field to find one date (Zharmagambetov et al., AgentDAM, 2025).
What does Muse do with a customer list it opens on screen?
Muse is Meta's personal agent, and the public description places the work on a computer Meta runs: "Muse runs on its own dedicated computer in the cloud" (Meta, Introducing, 2026). An agent on that computer opens the account console in a browser and reads the page as a person would: for the customer list, every column the console renders, from name and email to contract value and the notes beside them.
What the agent does with a field is a separate question from what it reads. Meta states that "Muse checks with the person before sensitive actions like sending an email or making a purchase" (Meta, Introducing, 2026). Axios describes the same gate: Sentinel, in its account, "determines whether it is allowed, blocked or sent to the user for approval" (Axios, 2026). Those controls decide whether an action runs. They do not decide which fields the page put in front of the model, and a customer list is read long before anything is sent.
The research record says that gap matters. A benchmark of web agent security found that agents begin following injections in up to 86% of cases, though "even state-of-the-art agents often struggle to fully complete the attacker goals" (Evtimov et al., WASP, 2025). A note field is a place to hide an instruction, and an agent that reads the note has read the instruction.
So the list is read as values, and the run keeps what it read in the form it read it.
What does Meta document about the record a Muse run leaves?
Meta's announcement says users "can review a full audit trail" (Meta, Introducing, 2026). The same page says Muse "can't see stored passwords or payment methods" but can use credentials stored for it, a surrogate design that lets the agent act with access the person granted.
The safety write-up describes the machinery behind that claim: a Secure VM per user, surrogate credentials, an activity log, and an agent that reads page content within its permitted access (What Should a Meta Muse Security Review Check?). An activity log records what happened; it does not say how long the record is kept or who at an employer can open it.
Axios adds the nearest recorded fact about retention: Meta can use queries by default, and "there is an option to turn that off" (Axios, 2026). A setting that stops Meta from using queries does not delete a record, and the report does not describe the record's term. Meta documents a trail and a credential boundary; it does not document the period, the storage location, the deletion event or the employer's access.
The trail Meta describes is one the person reviews, and an exportable per-action record is the rarer design: 5 of the 15 agents reviewed describe one, and Muse is not among them (Do AI Agents Ask Before Making a Payment?).
A work screen read under a consumer account's terms inherits whatever that account's settings say. The record exists; the term does not, on the pages reviewed. The gap between what the record holds and what the page shows is the one What Is the PII Wall? describes.
What do the vendors themselves say?
Three vendor documents bear on the question, and none is a retention policy.
Meta's announcement places the agent on a dedicated computer in the cloud, says it checks with the person before "sensitive actions like sending an email or making a purchase," and promises a full audit trail (Meta, Introducing, 2026).
Meta's research blog states a rule rather than a product term: until injection is reliably stopped, "agents must satisfy no more than two of the following three properties within a session," untrusted input, sensitive data, and external communication (Meta AI, Rule of Two, 2025). A customer list is sensitive data, a console page untrusted input, an email external communication, so a run that reads and sends holds all three.
Coder's documentation, written for coding agents, puts the boundary at identity: "Be sure not to give agents full permissions on behalf of a user, and instead use separate identities with limited scope whenever interacting autonomously" (Coder, 2026). That is advice about permissions, not about what a provider keeps.
| Dimension | Meta, per its documentation | What a buyer should verify |
|---|---|---|
| Approval before an action | "Muse checks with the person before sensitive actions like sending an email or making a purchase" (Meta, Introducing, 2026) | Whether the check covers a record change |
| The record of a run | Users "can review a full audit trail" (Meta, Introducing, 2026) | What it holds, who can open it, how long it is kept |
| Credentials | Cannot see stored passwords or payment methods, but can use credentials stored for it | Whether those credentials are surrogate tokens |
| Use of queries | Meta can use queries by default, with "an option to turn that off" (Axios, 2026) | Whether it works per account or per task |
| Retention | Not stated on the pages reviewed | The period, the deletion event and the employer's access |
What should a security team ask for in writing?
The written ask has to name the screen, because the vendor's pages answer a different question. Ask what the model receives from a rendered screen, and whether the values could be replaced before it reads them. Ask whether the trail holds the screen or only the action, and how long each part is kept.
Then the terms: the retention period, the deletion event, whether a terminated account's trail is destroyed or archived, whether the employer's administrator can export it, and whether the person's own review is the only access path. On credentials, ask whether the agent uses surrogate tokens, because Meta's statement that Muse cannot see stored passwords but can use credentials stored for it leaves the design open (Meta, Introducing, 2026).
OWASP's 2026 list for agentic applications is a peer-reviewed framework of the most critical risks in autonomous and agentic AI systems, a map of risks rather than a schedule for what is kept (OWASP Gen AI Security Project, 2025). The OAuth best current practice requires that "Refresh tokens for public clients MUST be sender-constrained or use refresh token rotation" (IETF, 2025); it governs how a token is bound and says nothing about a record of a screen.
A security review of Muse has its own checklist (What Should a Meta Muse Security Review Check?); these are the questions a retention review adds.
Who can open the audit trail after the agent finishes?
Meta's page addresses the trail to the person: users can review it (Meta, Introducing, 2026). The person is the account holder, and the page does not say whether an employer, a security team or an outside auditor can open the same trail. In a business deployment that is the difference between a record the operator can audit and a record the operator can only ask about.
On a HAL podcast, Harry Ghuman, CEO, Alpha Decisions, said the visibility problem comes down to headcount: "agents can be so many more than the people in the company. And it's sort of hard to keep track of what all of these agents are doing." (What Is the AI Delegation Frontier? Harry Ghuman on Who Gave the AI Its Authority).
A review of Muse's risks for work puts the same point from the other side: both the approval check and the audit trail are addressed to the user, and an employer's access to that trail is not described in the pages reviewed (What Are the Risks of Using Meta Muse for Work?). A retention review asks who has custody, who can read the record, and what happens when the employee leaves; a consumer account's trail answers none of the three.
A customer list is the organization's data whether or not an agent read it, and the organization is the one asked to produce it in a dispute. If the only complete record of a run sits in the provider's account, the organization's evidence depends on a person's dashboard access, which the vendor can change.
What would settle it is a record written where the organization keeps it: every screen as the model saw it, every action, and the name of the person who approved the action.
What does a governed environment change?
A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works with CUST_014 and ACCT_002 instead of a name and an account number. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the policy and approves each consequential action, and every screen, action and approval is written to a record that exports to the organization's own monitoring.
For this page's question it changes two things. The record that leaves the run holds tokens, so a copy of it is not a copy of the customer list. And the record is the organization's, exported as it is written rather than requested afterward. What it does not change is the provider's account: Meta's trail still exists, and a team that needs the retention term still has to get it in writing.
The class is the one the vendor comparisons describe. RedactSure vs Meta Muse sets the two designs side by side, and What Would an Enterprise Version of Meta Muse Need? sets out what a vendor-side version would need.
What the record shows
A screen read by an agent leaves two questions behind: what the model was shown, and what the provider kept. Meta's Muse announcement describes a full audit trail the person can review and a check before sensitive actions, and it does not put a period on the trail or say who besides the person can open it (Meta, Introducing, 2026). The first question is not answered: no page says which values the model receives from that screen. For a customer list, the reading is that the agent will read the list, the run will leave a reviewable trail, and the term will come from a contract rather than from the announcement. Name one agent and one list, run the renewal task on a test account, and compare the trail with the screen the agent read. If the trail holds names and emails, the values reached the record. If it holds tokens, they did not.
Methodology and limitations
This page rests on Meta's Muse announcement and research blog, two Meta FAIR papers, OWASP's agentic risk list, the OAuth best current practice, Axios's report, Coder's documentation and three RedactSure research pages. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page. What Muse keeps is taken from the announcement's own words and from the absence of a retention sentence on those pages.
No product on this page was tested. Each is described from its documentation, "not described" means the pages reviewed, vendor features change and the page carries its date, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a customer list, and not an organization. Determinations about whether a retention arrangement meets a contractual or regulatory requirement belong to counsel and the organization's compliance officers; nothing here replaces a pilot on the organization's own screens.
Frequently asked questions
Does Meta Muse keep what it reads on your screen?
Only as far as the account's record goes, and the pages reviewed put no period on it. Meta says users can review a full audit trail, and Axios reports that Meta can use queries by default with a setting to turn that off. Neither statement gives a retention period, a deletion event or an employer's access path. The trail is described; the term is not. Treat the trail as a record that exists and whose term you still have to obtain in writing.
How long does Meta keep the record of a Muse run?
Not stated on the pages reviewed. The announcement promises a full audit trail and says nothing about how long it is kept, and the Axios report describes a default for using queries and an option to turn it off, which is not a deletion schedule. The pages reviewed give no number, and none of them names a deletion date. Ask for the period, the storage location and the deletion event in the contract, then confirm them against the account's own data controls.
Can an employer read the audit trail?
Not from the pages reviewed. Both the approval check and the trail are addressed to the person using Muse, and no page says whether an administrator at the employer can open the same record. That matters when an employee leaves or a customer disputes a change. Ask for an export path the organization controls, and test it on a terminated test account before the trail is treated as evidence.
Does Muse read every field on a customer list?
Yes, when the page renders them. The agent reads the page as a person would, so a table with names, emails, phone numbers and notes gives the model every column it displays, and a Meta FAIR study found web agents are prone to using sensitive information they did not need for the task. Narrowing the page, or replacing the values with tokens, is the control; a prompt that says ignore the other columns is not.
Does turning off query use delete what Muse read?
No. The setting Axios describes governs whether Meta can use queries by default, and turning it off does not say what happens to a record already written. The audit trail is separate from that setting. A deletion request has to name the record and the period, and the pages reviewed describe neither, so put both in the contract and get the confirmation in writing from the account team.
What would make a customer list safe to hand to an agent?
Values the model never receives. If the rendered page shows CUST_014 in place of a name and ACCT_002 in place of an account number, the agent can still match the row, fill the form and finish the task, and the record it leaves holds tokens. A named person approving the send, and a trail the organization exports, complete the arrangement. Ask any tool to show you the page as the model receives it.
How RedactSure Keeps a Customer List Out of the Model's Record
A customer list read on screen enters the model and the record, and the terms reviewed above limit neither of them.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads every column as values, so the name and contract value land in the model and in the trail. Inside the governed environment the console renders CUST_014 where the name sits, the agent drafts the renewal note on that token, and a named person approves the send. The record carries the token and the approver's name.
RedactSure is deploying now with enterprise and government customers. Meta says users can review a full audit trail, and that trail is the only account of a run the buyer does not hold.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A list the model reads as values stays in the record after the run ends. Bring one list from your own workflow and see, with test values, the page as the model receives it, the approval and the exported record. Book a demo