Meta Muse runs agents on AMD EPYC Turin hosts with two cores and 8GB of memory

extract

Meta Muse runs agents on AMD EPYC Turin hosts with two cores and 8GB of memory — AI agent can pass terminal commands to Ubuntu host system The 9D25 that hosts Muse comes with 126 cores and 254 threads. Update 7:53PM ET: Added a tweet from Meta's David Singleton and a link to Muse's security paper. Meta's new AI agent Muse is powered by AMD EPYC Turin host systems, with each sandbox sporting two dedicated cores and 8GB of memory. Blogger Evan Hoffman and analyst Tae Kim both discovered that Muse will run some rudimentary Ubuntu commands if prompted, passing along the output to help identify things like the specs of the host system. More concerning is that Muse seems able to execute commands that might be unsafe, with Hoffman claiming that Muse offered to set up SSH to Muse's private VM. Both Kim and Hoffman asked Muse about the VM's specs, and in both instances, Muse revealed that it's running on AMD EPYC 9D25 CPUs, a high-density Turin chip with up to 128 cores (two of which are generally fused off or reserved). The VMs are running on Ubuntu 24.04 and using Linux kernel 7.0. The systems hosting Muse don't include GPUs. The AI agent revealed that Meta uses separate GPU servers for inference, isolating the agent to CPU-only sandboxes. The agent suggests that each user gets their own private sandbox that's persistent, which allows us to do some math on how many people an individual tray can host. Assuming a 2P system that offers up to 510 vCPUs with 2TB of memory, hosting up to 254 Muse users. Muse has reportedly passed over 500,000 daily active users as of a few days ago, which would come out to somewhere around 2,000 server trays with dual EPYC 9D25 CPUs and 2TB of memory. This is just some rough napkin math; don't take it as law. It's possible Meta has CPU-only servers deployed with multiple different chips to host Muse, and it's also possible there's overhead in the configuration. Turin chips support up to 6TB of memory with high-density DIMMs, for instance. Still, EPYC hosts seem popular for this use case, mainly because of their core density, as even a dual-core sandbox can add up quickly when multiplied across hundreds of thousands (or even millions) of users. Muse isn't completely open. Hoffman shared an example where an attempted command failed due to improper permissions when Muse tried to query the kernel buffer. Presumably, sudo (admin) commands would be blocked as well. However, there might still be some security loopholes. Hoffman says that Muse offered to set up SSH into the private Muse VM. With a reverse SSH tunnel — where the destination machine initiates the connection, bypassing the firewall — an attacker may be able to execute more damaging commands. Meta's David Singleton says this is intended behavior, however, describing Muse as "a free computer in the cloud." Meta has an extensive white paper on the security architecture of Muse published on its research website. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds. Jake Roach is the Senior CPU Analyst at Tom’s Hardware, writing reviews, news, and features about the latest consumer and workstation processors. - Darkhands The LLM is most certainly only seeing its sandbox that it uses for commands and scratchpad. And whatever hypervisor its running on probably isn't devoting 8GB ram to each one until it's actually needed.Reply Plus 2TB RAM isn't all that much, especially for a large corporation. That's a single 1U rack server worth. - mac2213 Everyone is lost trying to explain that AMD Turin is running the personal Muse VM and looking to explain that in terms of math and security. Intel booked this deal two years ago for Granite Rapids with AWS when they did the Custom Xeon 6 deal. TDX and AMX solve all the problems that everyone is struggling to square the circle on. There is a place for all three solutions; Nvidia running frontier Llama on Vera/Rubin. AMD running Muse.ai general assistant. And Intel Granite running Muse agents on your own data sets using TDX for security and AMX for matrix math. Stop hating Intel and accept that they got something right here with the Xeon features. Diamond improves on it all.Reply - acadia11 I want to see open claw comparisons, clearly, muse has an installation base advantage with WhatsApp, etc … but it would be nice to see agent capability comparison.Reply - DS426 Reply What's all that rambling for? AMD has AVX-512 extensions and SEV-SNP for confidential computing/hardened VM's. It really just comes down to the software provider's preference/design and the code path established for such.mac2213 said:Everyone is lost trying to explain that AMD Turin is running the personal Muse VM and looking to explain that in terms of math and security. Intel booked this deal two years ago for Granite Rapids with AWS when they did the Custom Xeon 6 deal. TDX and AMX solve all the problems that everyone is struggling to square the circle on. There is a place for all three solutions; Nvidia running frontier Llama on Vera/Rubin. AMD running Muse.ai general assistant. And Intel Granite running Muse agents on your own data sets using TDX for security and AMX for matrix math. Stop hating Intel and accept that they got something right here with the Xeon features. Diamond improves on it all. Yes, the highest-density Xeon's are good for long-horizon agentic AI as well -- what's your point? Those security failures are on Meta's security configurations and hardening, not on CPU hardware security. SSH being enabled on the VM doesn't have anything to do with CPU hardware sec. - moon2 Reply I'm a little lost wondering why you're taking about Intel at all... What's the relevancy of Intel when taking about muse sandboxes and the AMD chips powering it?mac2213 said:Everyone is lost trying to explain that AMD Turin is running the personal Muse VM and looking to explain that in terms of math and security. Intel booked this deal two years ago for Granite Rapids with AWS when they did the Custom Xeon 6 deal. TDX and AMX solve all the problems that everyone is struggling to square the circle on. There is a place for all three solutions; Nvidia running frontier Llama on Vera/Rubin. AMD running Muse.ai general assistant. And Intel Granite running Muse agents on your own data sets using TDX for security and AMX for matrix math. Stop hating Intel and accept that they got something right here with the Xeon features. Diamond improves on it all. - me-three Reply Meta's Muse agent is same concept as OpenClaw, except that one is turnkey, cloud-based, with a finite set of canned "skills," while the other started as an open, self-hosted tool and has now become a de facto standard for both hobbyists and enterprise.acadia11 said:I want to see open claw comparisons, clearly, muse has an installation base advantage with WhatsApp, etc … but it would be nice to see agent capability comparison. Muse is currently a home-run hit with consumers, reaching #1 on both Apple & Google Play stores with record downloads. Meta stock jumped 11% following launch. It's popular enough that Amazon has blocked Muse on its site. https://www.fool.com/investing/2026/09/23/meta-s-muse-ai-agent-sees-fastest-adoption-since-chatgpt-time-to-buy-meta-stock https://pulse2.com/meta-muse-reaches-no-1-on-u-s-app-store-as-personal-ai-agent-gains-early-traction You can't compare the two feature-for-feature, because they're targeted for different audiences. Obviously you can do more with OpenClaw, but at this point you need to be a geek, or a business that hires help setting it up. I've been wondering how/when agentic AI will come to the masses, now that "agentic Windows" is off the menu because of RAMageddon. Muse is a pretty emphatic answer. Its strong uptake will spawn multiple competitors. AI doomers notwithstanding, the age of AI agents is definitely roaring out of the gate. - mac2213 Reply When I ask Meta.ai this question; can you give me a benchmark of AVX512 vs AMX running small llama locally that would make sense on why Intel is a more interesting competitive solution for the Muse sandboxed VMs. I get an answer that might change your thinking.moon2 said:I'm a little lost wondering why you're taking about Intel at all... What's the relevancy of Intel when taking about muse sandboxes and the AMD chips powering it? - mac2213 Reply I'll give the same answer here that I gave below. study the Meta ai benchmark comparison of AVX512 vs AMX running small llama locally that would explain why Intel is a more interesting competitive solution for the Muse sandboxed VMs.DS426 said:What's all that rambling for? AMD has AVX-512 extensions and SEV-SNP for confidential computing/hardened VM's. It really just comes down to the software provider's preference/design and the code path established for such. Yes, the highest-density Xeon's are good for long-horizon agentic AI as well -- what's your point? Those security failures are on Meta's security configurations and hardening, not on CPU hardware security. SSH being enabled on the VM doesn't have anything to do with CPU hardware sec. - jp7189 Reply As far as i understand it, these muse instances are only running the harness on the local cpu... no llm at all. The harness then connects to an off box gpu based service for the actual llm.mac2213 said:I'll give the same answer here that I gave below. study the Meta ai benchmark comparison of AVX512 vs AMX running small llama locally that would explain why Intel is a more interesting competitive solution for the Muse sandboxed VMs. That is why Im confused why it would matter which cpu is faster at llm inference. They both suck and no one in their right mind would waste time trying an llm on 2 cores from any vendor. - mac2213 Reply Just repeating what meta says here.jp7189 said:As far as i understand it, these muse instances are only running the harness on the local cpu... no llm at all. The harness then connects to an off box gpu based service for the actual llm. That is why Im confused why it would matter which cpu is faster at llm inference. They both suck and no one in their right mind would waste time trying an llm on 2 cores from any vendor. 1. The harness itself IS doing matrix math today, just not the big LLM. Even before it calls the off-box GPU, that 2 vCPU box has to do: embedding your files/mails for RAG vector DB search over those embeddings PII / safety classifier / Sentinel checks tokenization / prompt packingThose are all small matrix ops. On Turin AVX-512 only, Vector DB search is baseline. On Granite Rapids AMX it's 2.71x boost, 7.34x with SVS Scalable Vector Search, and 34% faster summarization and 2.15x Chatbot uplift vs 128-core Turin. For embedding models, Google measured AMX as 3x lower latency at batch 1 and 7x higher throughput at batch 6 vs same VM without AMX. So for the same 2 vCPU sandbox, Granite can do the RAG work that Turin has to punt to GPU for. 2. The roadmap is to move the small LLM INTO the VM for privacy. You nailed it in our earlier thread - if Meta keeps sending raw files to a token factory, they can't claim the security they bragged about. The fix is Muse Glimmer - the small distilled model built for consumer GPU / CPU - running inside your TDX enclave. Once that happens, 2 cores with AVX-512 alone truly does suck. 2 cores with AMX BF16 does not: Turin 2 vCPU: ∼7-15 tok/s for Llama 3.1 8B Q4, unusable Granite 2 vCPU AMX: 45 tok/s AVX FP32 baseline, 226 tok/s for 1024/128 and 395 tok/s for 2016/32 with AMX BF32 in OpenVINO, next token <50msThat's still not a frontier model, but for a 1-3B local safety model + embedding + Glimmer 1B inside the Secure VM, it's the difference between "has to call off-box" and "can stay local." Granite gives Meta the option to keep your private data plane entirely in TDX - no egress - with 5.5x AI inference perf over EPYC Genoa and 3.65x average. Turin can't offer that because it has no AMX tile engine, only AVX-512 VNNI. So the comment is right for today: both suck for big LLM on 2 cores. Granite + AMX is the bet that tomorrow, the small LLM does run on those 2 cores, inside your VM, for privacy and cost/watt. I recommend taking your debate directly to Meta and skipping my cut and paste of your question and the answer.