Muse uses technical controls to limit agent access

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 30:24

   The third thing that I would say is actually going to be a major differentiator for us that I think might be surprising to some people is privacy and security. And we're investing in this just a huge, huge amount. And, you know, part of the view that we have on this is that in order for this to be useful, it needs to not just have state-of-the-art intelligence. It needs to really understand you, right?

2. 30:50

   So in order to be able to understand your goals, you end up connecting it to all the stuff, right? You talked about connecting it to your ad system, but people connected to messaging and email and all this stuff, health information, whatever. And in order to do that, people need to have a very high degree of confidence in the system. Now, the good news here is that Meta has spent, at this point, more than 10 years focusing on building WhatsApp into, I think, like, it is the largest, like, global end-end encrypted system, and we've designed it in a way where even Meta can't see the messages that people send, and that's been this just really transformative thing.

3. 31:37

   I think it makes it so that people trust WhatsApp. It's also been a very important lesson for Meta to learn that, like, that has been really important to our success with WhatsApp, that we've designed the systems that even we can't see the content. that means that whatever people are worried about, if they're worried about, you know, government getting access to it, a hacker getting access to it, someone at Meta doing something bad with it that they don't want, all that stuff you can kind of- take off the table if you design the system so that you can't see it.

4. 32:03

   So we took that as one of the foundational lessons. When we were getting started with this, Nat and I actually personally recruited Moxie Marlinspike. Founder of Signal. Yeah, and one of the person, one of the people who helped us build the WhatsApp ads and encryption back in the day and back in 2014, he joined to specifically work on this confidential VM project, which makes it so that we can, you can have your virtual machine and have all this information in your Muse, and we can make the commitment that even meta cannot see the content that is in there.

5. 32:36

   And you can do this technically. It's like an incredible kind of... Like the commitment can be technically verified. Yeah, and that's something that we're going to publish more about in the coming weeks as we basically get closer to rolling this out a lot more widely. And out of all these early VM efforts that these labs are doing with these agents, you think this is unique, what you're doing? I don't think anyone is doing it.

6. 32:59

   I don't think anyone's doing it. I think that there's a lot of other security measures that we're putting in place that I think we should talk through, because even before this is ready, there's that, and even people who don't want to use this, it's incredibly secure because we focused on this from the beginning. There's also the auto-approve, you have to see what it's doing. Yeah, so let's get into all that stuff in a second.

7. 33:22

   But I'm not aware of anyone having anything close to the confidential vm system that that muse has and it's just i think it's a very fundamental thing because you're you're like you want to know that this is your agent yeah and that that if you put content in there that um that basically you can trust that no one else is going to get access to it so what are the two ways to do it well a lot of people earlier in the year when stuff like open clock came out they started getting max studios and you know one way to feel good about it is where you literally like you physically have your device running in your home. But the other way to do it is you build a kind of, that's going to be tricky because I don't think there are going to be billions of people who are going to buy a Mac Studio and configure it and run it at their

8. 34:04

   home. Especially with RAM prices right now. But it's also just, it's like technically difficult. Right. It's like, I mean, part of what we're trying to do with Muse is build a version of that personal agent experience that just works, that I can like give to everyone in my family of various levels of technical literacy and like it just works and within a day it's like doing kind of all the stuff that they that they want in their life so part of that is like you don't want someone to have to set up their own computer or vm you just kind of like want to be able to provision it in the cloud but you want it to have the security and confidentiality that you'd have if you had the box sitting under your desk like in your house sure um so i think that's a very fundamental thing.

9. 34:45

   Like you said, there's other pieces, too, because not everyone is going to use that. I mean, we built a secure credential store, right? There's no reason for you to just, like, store out in the open, like, all your kind of your credit card and your passwords. It creates one-time card numbers and all that. Yeah, so your agent, like, shouldn't know that stuff. It should just be able to kind of access it when it needs to because you've asked it to log into a thing and not otherwise.

10. 35:11

    It's actually not a single thing. You have your kind of core agent, but we also built all these Sentinel agents that basically monitor the incoming and outgoing traffic and data that your agent is sending for the purpose of flagging to you when you might want to review something. So that's all that the Sentinels do is effectively, they kind of look at, they try to see if someone's trying to do like a prompt injection.

11. 35:39

    They look at, okay, did your Muse agent share something that is kind of going out that is not something that you might be comfortable with? If so, then the Sentinel agent is basically empowered to trigger this human in the loop review. So if you're going to log into something, if you're going to do a payment, if you're going to transfer kind of sensitive information, You basically, each time, need to approve it.

12. 36:03

    And you can tell it, I'm good with stuff like this in general, like always allow this kind of thing. But in general, the Muse agent can't kind of make those judgments itself. And that's like built into the system and the architecture in a pretty deep way. And then even when we do things like, you know, all the connectors, you connect it to your email, you know, I think some people, when they've designed this, they just kind of make it so, okay, you connect and now you have access to everything.

13. 36:28

    But the approach that we've taken is, like, all right, if you connect to your email, like, it should start read-only, right? And then if you want to, like, be able to have it send an email, then fine. Like, go ask it for that specifically, right? Especially most people trying this have probably never tried a product like this. So it's, yeah. So this is, like, a core design principle for us is, like, is basically least privilege, right?

14. 36:50

    So just, like, yes, you're going to ask it to do a lot of things. And each step along the way, get access to the least privilege that you need and only add to that as necessary. So this is very fundamental in the design of the product. And if you look at all the other agents that are out there, I think no one else is anywhere close to the level of sophistication or depth that we've built into this.

15. 37:10

    And again, it's sort of informed by our experience building WhatsApp into this state-of-the-art, end-to-end encrypted system around the world and the importance of building a system where even meta can't see the content. And so kind of getting the band back together and having Moxie, like, architect this has been, I think, one of the foundational things that in some ways it may not be what some people would think meta would focus on.

16. 37:33

    But, like, you know, we're kind of, you know, it's interesting. We're two things. I mean, social media is, it's like not, you know, it's inherently about sharing. But then there's all these other things that are inherently about kind of privacy and sensitive context. And we've done well at both of those. So I think that this is more the latter. It's going to be very important to just be extremely focused on how we handle that content.