The Model Is Untrusted Code: A Design Review of Meta's Muse

How Muse contains a prompt-injected agent, replayed against one malicious email, plus the questions I'd push on and the parts worth copying.