Comparison · RedactSure Research
What Is the Enterprise Version of Meta Muse? There Isn't One From Meta, and Here Is What It Would Have to Add
Meta does not make one. Muse is a personal agent: it runs one person’s tasks in a dedicated cloud machine, acts across their apps and websites, holds their passwords and cards in a vault the agent cannot read, asks before sensitive actions, and keeps an activity log, all inside Meta’s own environment with Meta’s own model. An enterprise version would keep that pattern and add four things a personal assistant has no reason to have: the agent is handed the fields the work needs with identifiers as tokens rather than the whole page; the exposure decision for each task is written as a policy a named person confirms; the record of every run exports to the organization’s own monitoring as an AI Control Record; and the environment belongs to the customer and works with any model. RedactSure is built as that. Least Exposure is the principle underneath: for each piece of work, the agent receives exactly the data the task requires and nothing more, enforced before any model reads the screen. This page sets out what Muse does from Meta’s own documentation, what an enterprise needs that a person does not, and where RedactSure sits.
Key findings
- Muse’s design, in Meta’s words, is a dedicated Secure VM per user with a real Chromium browser, a separate Sentinel that must approve every network egress, credentials the agent uses through surrogate tokens without seeing, human approval before sensitive actions, and a complete activity log. Meta’s safety write-up is candid that the agent reads the page in full and that injection through observed web data is a known risk.
- The pattern is the right one, and it is the pattern RedactSure’s environment was built on for regulated work: isolated environment, credentials outside the agent, gate on egress, a person who can watch and take over. Meta shipping it to consumers confirms the architecture.
- A personal assistant is meant to know everything about its user. An enterprise agent is meant to know as little as the task allows about the organization’s customers, and to prove it. That reversal is the whole difference, and it is why the enterprise version cannot be Muse with an admin console.
- Four additions make the enterprise version: the render layer (fields and tokens, not the picture), the task-level exposure policy, the exportable control record, and separation of model and control.
- What a successful injection collects is the test. Against Muse, everything on the page except the password. Against RedactSure, tokens from a narrower surface, with the consequential action stopped for a named person.
What does Muse actually do?
From Meta’s own documentation, as of September 2026.
Each user gets a dedicated cloud virtual machine with its own browser, storage and compute, isolated from every other user’s. The agent operates websites and connected apps from inside it: browsing, filling forms, booking, buying, sending email, working on tasks in the background after the user closes the app. A separate Sentinel agent runs on the same machine, kept apart at the system level; nothing the agent does reaches the internet unless the Sentinel approves it, and the Sentinel asks the user when it needs to. Credentials and payment methods go into secure storage the agent cannot read; the agent holds a surrogate token and the real value is substituted at the network boundary after the action is authorized, with a one-time card number at checkout. Sensitive actions such as sending an email or making a purchase stop for the user’s approval. An activity log shows everything the agent has done and plans to do. Meta restricts its own staff’s access to the VM by operational policy today and plans a Confidential VM later in the year intended to prevent that access cryptographically.
That is a serious design, and its parts map one for one onto what an enterprise agent environment needs: isolation, credential separation, egress control, supervision, a record. Meta’s write-up is also clear about what it does not do. The browser is a full Chromium behind a virtualization layer, so the agent reads everything the page shows, and Meta names prompt injection via data the agent observes on the web as a known risk mitigated by approvals and deterministic boundaries rather than by changing what the agent reads.
Why can’t the enterprise version be Muse with an admin console?
Because the two products want opposite things from the agent’s knowledge.
A personal assistant’s value is that it knows its user: the inbox, the calendar, the cards, the preferences. Muse is built to see everything and to let nobody else, which is why the vault covers passwords and cards and the rest of the page is read in full. For a person managing their own life that is the right trade.
An enterprise agent works on other people’s records. The claimant, the patient, the student and the cardholder on the screen are not the operator’s own, and the organization’s obligation, under the minimum necessary standard, FERPA’s legitimate-interest condition, PCI scoping and its own privacy program, is to limit what reads those records to what the task requires. The enterprise version therefore has to do the thing a personal assistant never would: show the agent less than the screen, decide in advance what less means for each task, and prove afterward that the decision held. An admin console over a personal agent does not supply any of that. It supplies permissions, which govern what the agent may do, and the enterprise question is what the agent may see.
What does the enterprise version have to add?
| Muse (personal) | The enterprise version | RedactSure | |
|---|---|---|---|
| Isolated environment | Secure VM per user | Governed environment per organization | Yes, deployed into the cloud the customer’s posture requires, on hardware-encrypted enclaves |
| Credentials outside the agent | Vault with surrogate tokens | Same | Yes |
| Gate on consequential actions | Sentinel plus user approval, “always allow” available | A named person under existing permissions, every time, on the record | Yes, Supervised Delegation |
| What the model receives | The whole page | The task’s fields, identifiers as tokens | Yes, render-layer tokenization; the page read as fields, not a picture |
| Who decides what the agent sees and does | The user, per connection | A named workflow owner, per task, in a written exposure policy | Yes; the Planner sets which values are tokenized and what the agent may do on each screen, for the named person to confirm |
| The record | Activity log in the vendor’s app | Every screen as tokens, every approval with a name, exported to the customer’s SIEM | Yes, the AI Control Record |
| Who holds the keys | Meta, by policy today; user-held keys planned | The customer | Yes, customer-held keys; RedactSure holds ciphertext it cannot decrypt |
| Model | Meta’s own | Any, swappable without moving the controls | Yes, model-agnostic: Claude, GPT, Gemini, open source |
| What a successful injection collects | The page, password excepted | Tokens, from a narrower surface, action stopped for approval | Tokens |
The first three rows are Muse’s design, and RedactSure shares them. The next six are what an enterprise adds, and none of them is a feature a personal assistant has a reason to ship. They are the reason the enterprise version is a different product rather than a different tier.
Where does RedactSure sit?
RedactSure is the enterprise version of that pattern, built for regulated work before Muse shipped; Muse’s launch confirms the pattern. AI co-workers do real work across an organization’s applications inside a governed environment: an ERP, a claims platform, an EHR, a student information system, the payer portals and email around them, with no per-application integration and no change to user permissions. Every sensitive value is replaced by a consistent token at the render layer before any model reads the screen, and the environment hands the model the fields the work needs rather than the picture. The Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy for each task before it runs and approves every payment, submission and record change while it runs. Every screen and every approval lands in the AI Control Record as tokens and exports to the organization’s own SIEM. Real values live in hardware-encrypted enclaves with keys the customer holds, and the environment works with whichever model the organization chooses. Everyone else controls where data can go. RedactSure controls what the AI can see.
None of this is a criticism of Muse, which does what it was built to do well. It is a description of what a different customer needs. What Does an AI Agent See When It Takes a Screenshot? and Can a Credential Vault Protect the Data an AI Agent Reads? walk the two differences that matter most.
What the record shows
There is no enterprise version of Meta Muse from Meta, and there should not be, because a personal assistant and an enterprise agent want opposite things from the agent’s knowledge. Muse’s design, isolated machine, vault, egress gate, approvals and a log, is the right pattern and the one RedactSure’s environment shares. The enterprise version has to add what a personal assistant never would: the agent handed the task’s fields with identifiers as tokens instead of the page, a written exposure policy a named person confirms per task, a control record exported to the organization’s own monitoring, customer-held keys and a swappable model. RedactSure is built as that. The test that separates the two is what a successful injection collects: the page, or tokens.
Frequently asked questions
Can we deploy Muse for our employees?
Muse is a consumer product that acts on a person’s own accounts inside Meta’s environment. Whether it has a place for personal tasks is an employee-policy question; it is not built to work the organization’s systems of record under the organization’s controls, and it reads the page in full.
Is RedactSure built on Muse or on Meta’s technology?
No. RedactSure’s environment predates Muse and shares the pattern, not the code. The environment is model-agnostic and runs on the customer’s cloud with customer-held keys.
Does RedactSure hide everything from the agent?
No. It hides the identifiers the task does not need and hands the agent the fields it does. Amounts, dates, codes and clinical or coverage facts the work runs on stay in clear where the policy says so. Protected values are set by policy, starting with identifiers.
What is the Planner?
The part of the environment that sets the task-level policy: which sensitive values are tokenized before the model reads the screen, and what the agent may do on each screen, not only in the application. The named person who owns the workflow confirms it before the run, and the confirmed policy is one of the artifacts of the AI Control Record.
Which is more secure, Muse or RedactSure?
Different questions. Muse is built to keep a person’s data from everyone except the agent, and its Confidential VM will make that cryptographic. RedactSure is built to keep an organization’s customers’ data from the agent itself, and to prove it. An enterprise needs the second.
What should we ask any vendor claiming to be the enterprise Muse?
Show us what the model received for one screen of our workflow, and tell us what changes if we switch models. The first answer places the vendor in the table above; the second says whether the controls are ours.
Related reading
What Does an AI Agent See When It Takes a Screenshot? · Can a Credential Vault Protect the Data an AI Agent Reads? · Should the AI Agent’s Secure Environment Belong to the Model Vendor? · What Is an AI Control Record? · On the RedactSure blog: Secure AI That Crosses Every Silo
Sources
Vendor documentation
- Meta AI Research, “How We Built Safety Into Muse: Security and Safety for AI Agents” (September 2026). https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
- Meta, Muse product page. https://ai.meta.com/muse/
Standards
- OWASP, LLM01:2025 Prompt Injection, Top 10 for LLM Applications 2025. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
RedactSure documents
- RedactSure, “Secure AI That Crosses Every Silo” (2026). https://redactsure.com/blog/secure-ai-that-crosses-every-silo/
- RedactSure, “The Two Gaps AI Agents Opened in Your Security Stack” (2026). https://redactsure.com/blog/two-gaps-ai-agents-opened-in-your-security-stack/
- Product behavior described on this page reflects RedactSure’s current design. Meta and Muse are trademarks of Meta Platforms, Inc., named to identify the product.
Bring your hardest questions.
A 25-minute AI Agent Security Review with the founders: threat model, token design, egress paths, audit schema. Or a 25-minute demo on a workflow like yours, with the data hidden from the AI and a named person approving what matters. We come with diagrams, not a pitch deck.
Book a security review Book a demo · Something elseAbout the author
Chris Sowa is a founder of RedactSure and a former CEO of AI companies; he started his first years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.