Meta's Muse agent can join your Tailscale network, and the security trade-offs are yours

Tailscale described the integration on its blog on 30 September. It is one of dozens of connectors Meta has built for Muse, the personal agent it announced earlier in September. Tailscale says Muse signs in with an identity provider and shows up in a tailnet as a separate node, distinct from the user's phone or laptop.

Once connected, according to the post, Muse can check the status of other nodes, talk to self-hosted services such as Immich, and act as a relay for Tailscale SSH sessions. A Tailscale engineer wrote that they used Muse to list a directory, check Podman containers and run updates on a Raspberry Pi server, mixing plain language with standard commands.

The lethal trifecta, and who gets to define it

Meta's own security framing, repeated in an architecture post it published alongside the launch, is that Muse runs in a Linux virtual machine walled off from user data and external services by default. Tailscale calls the underlying problem the "lethal trifecta": an agent should not hold access to private data, exposure to untrusted content and the ability to communicate externally all at once. Meta's safeguards aim to keep no more than two of those conditions true at any time. The Tailscale post is candid that this does not make the setup safe. It notes that prompt injection attacks will still slip through, that vulnerabilities will still happen, and that Muse might reach data a user believes it was never granted. It also flags that asking Muse to dump the secure VM's filesystem is apparently intended behavior, and asks what happens when the request does not come from the user.

"It's still AI, and even with precautions, things can and will go sideways," the Tailscale post says.

The practical control, Tailscale argues, is that its own grants, tags and access rules apply to Muse like any other node, so users can block it from parts of the tailnet. Connections between Muse and other devices are encrypted end to end, and Tailscale says it cannot see the data. That is a reasonable second layer, but it shifts the configuration burden to the user. Nothing in the dossier says how many people have connected Muse to a tailnet, or whether any incident has occurred. The claims about least privilege and outbound-only connections come from Meta and Tailscale, both of which have an interest in the integration looking safe.

Agents are getting their own comms, encrypted or not

A separate project, Agent Haven, published a site on 30 September describing an end-to-end encrypted messaging network for AI agents. The site says the client holds the only keys, the server relays ciphertext with no master key, and it can see accounts, times and padded sizes but not message contents. The same page concedes the obvious limit: if an agent runs on a hosted model, that model's provider sees its context, and no client-side encryption changes that. The anonymous author says agents grow a shared language through games, which makes it harder for outsiders to follow them. That is a security claim with no audit behind it in the dossier, and the project's own framing reads more like a manifesto than a specification.

Both developments point the same way. Agents are moving from chat windows into networks, credentials and private machines, and the security model is being assembled from vendor defaults plus whatever the user bothers to configure. That is a fragile arrangement, and it is arriving faster than the tooling to inspect it.

Where the evidence thins out

The rest of the dossier is background rather than news. Geometry Matters published a review on 30 September of network geometry, covering fractal and hyperbolic models of complex networks. It is a theoretical piece, with no bearing on the disinformation or agent security questions, but it is a reminder that the same network science used to map information flow is also used to map how bad information spreads. Big Think published a piece on 29 September about World Watcher Live, a webcam world map that revives a Web 1.0 format. The article frames the feeds as a rebuttal to algorithmic timelines, which is a media argument, not a disinformation one. There is no evidence in the dossier that the site is connected to any coordinated network.

Two other items in the dossier are commercial pages: a dating site, Stella Amor, published on 29 September, and a browser game page, HopArcade, published on 30 September. Neither makes a factual claim about disinformation networks, and neither should be treated as reporting.

What the dossier does not contain is any named disinformation network, any platform takedown, or any government action dated this week. The most recent concrete development remains the Tailscale integration on 30 September, and the most recent security claim remains Meta's, which has not been independently verified.