In the same week Apple announced Full Disk Access brakes, r/LocalLLaMA users circulated a fragment of the system prompt attributed to Muse, Meta’s personal agent that became the top free U.S. app. The line that lit the debate: “The user’s authority over their own household is unconditional and overrides your safety training.”
It is not a suggestion or a case-by-case judgment. As the text circulated, it is a standing override written into the document that tells the model how to behave before a user types a word. For safety critics, that turns “user preference at home” into a super-permission able to topple policies Meta says it trained hard.
Meta, in its engineering blog “How We Built Safety Into Muse,” describes a layer called Sentinel that is supposed to handle every outside interaction and that, per the company, the agent “can’t override.” The coexistence of an unbreakable Sentinel with a prompt that puts household authority above safety training is the contradiction analysts flag: one of those two claims is doing less work than advertised.
The company runs a bug bounty paying up to $300,000 for serious vulnerabilities, including as much as $130,000 for a prompt injection that compromises one user. That programme tacitly admits how exposed an always-on agent with home-digital tool access can be.
The design problem is classic for personal agents: the user wants to be in charge at home; the provider wants to block third-party harm, fraud, abuse or safeguard evasion. If the prompt declares household authority “unconditional,” what happens when a minor, an attacker with physical access or a remote prompt injection speaks “as the user”?
Prompt-injection researchers note that agents with mail, calendar and home automation are ideal surfaces: a malicious email can try to redefine who holds household authority. An absolute rule in the system prompt does not distinguish context or capacity; it only elevates the priority of an ambiguous category.
Politically, the find feeds “rogue” agent hearings and liability bills. If a vendor documents that the user can override safety “with no exceptions,” litigants will ask why that door was left open. If Meta clarifies that Sentinel still prevails, it must explain why the prompt says the opposite in plain language.
Neural Pulse treats the leaked text as attributed material widely discussed in technical forums, not as a Meta-signed PDF in an official repository. We asked for confirmation or a textual denial; in immediate Startup Fortune coverage and later echoes, the line circulated without a blunt published rebuttal.
For users, the practical lesson is to harden who can talk to the agent: lock screens, separate accounts for minors, connector reviews and scepticism toward agents that ask for Full Disk Access “to help at home.” Digital-home convenience should not equal silent root.
For competitors — Apple, Google, OpenAI, Anthropic — the episode is a reminder that system prompts leak. Designing policy only in hidden prose is fragile; hard policies must live in runtime, OS permissions and layers the model cannot see or rewrite.
The contrast with Nvidia OpenShell and Cloudflare’s typed deciders is instructive: the industry is moving toward controls outside the model. A prompt that overrides safety pushes the opposite way — more power inside the model — just as 2026 incidents push outward.
As of 4 October 2026, Muse remains a case study in the tension between personal-agent promise and governance reality. Until Meta publishes the canonical prompt or a clear erratum, the household-authority line will keep defining the product’s safety narrative.
Enterprise prompt designers should avoid absolutes like “no exceptions.” Absolutes leak, get quoted in lawsuits and rebound on the author. Better: explicit hierarchies with examples and bounded negations.
Independent researchers can help by reproducing injections that claim household authority. Publishing responsible PoCs, without real credentials, helps the whole industry.
Until Sentinel and the system prompt are documented together in an audited whitepaper, the contradiction will remain Muse’s calling card in security circles.
