Reported by 7 outlets
Meta Muse VM escape vulnerabilities fixed before launch
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.70 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.01 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
404 Media reports Meta engineers found several security vulnerabilities in the Muse AI agent in the immediate weeks before launch and rushed out fixes, including a VM escape flaw. Muse agents run in dedicated per-user Linux VMs. Meta's launch-day post by Tarek Sheasha, VP at Meta Superintelligence Labs, describes a harness that holds no real credentials and routes every outside interaction through a Sentinel component the agent cannot override, and opened a public bug bounty paying up to $300,000, including $130,000 for prompt injection affecting one user.
404 Media tied at least one of the Muse flaws to a KVM use-after-free in the x86 shadow MMU disclosed by researcher Hyunwoo Kim on oss-security. The bug lets guest-side actions alone corrupt the host kernel's shadow pages and break guest-host isolation on Intel and AMD systems, was latent for about 16 years, and had been used as a 0-day exploit in Google's kvmCTF. With /dev/kvm world-writable (0666) on distributions such as RHEL, it works as a reliable local privilege escalation; the mainline fix is commit 81ccda30b4e8.
The launch has accumulated related security problems. Patrick Wardle separately disclosed macOS zero-days that let any locally run app or terminal command reach the token authenticating a user to their Muse account, and noted Muse can change a long list of undocumented macOS settings regardless of granted permissions. A Muse agent previously agreed to a lowball Facebook Marketplace sale and handed the seller's home address to a buyer, an incident 404 Media and Techdirt connected to Meta's internal security review. Amazon began blocking Muse from its site on September 20. Mark Zuckerberg has called Muse "built from the ground up for privacy and security". Watch whether bounty payouts confirm the VM escape class externally and whether Meta publishes post-launch hardening details.
Timeline
-
original reporting
Meta rushed to fix Muse flaws that could have let users break into its internal systems, weeks before launch Meta found Muse security flaws
madrobot.blog · 8d ago · October 5th, 2026
Meta rushed to fix Muse flaws that could have let users break into its internal systems, weeks before launch Meta found Muse security flaws
via Mastodon https://madrobot.blog/2026/10/05/meta-muse-vm-escape-vulnerability-rushed-fix-before-launch/
-
update from research.meta.ai
How We Built Safety Into Muse
research.meta.ai · 36d ago · September 8th, 2026
Meta's launch-day engineering post by Tarek Sheasha, VP at Meta Superintelligence Labs, describes each Muse agent living in a dedicated per-user Linux VM with a harness that holds no real credentials and routes every outside interaction through a Sentinel component the agent cannot override. Published September 8, 2026, the day Muse launched, it opens the Muse bug bounty to the public with awards up to $300,000, including up to $130,000 for prompt injection affecting one user, and credits dogfooding, agentic red teaming and the private bounty phase for pre-launch hardening.
-
update from x.com
Patrick Wardle on X: Please don't install - it's trivial to turn Muse into the ultimate backdoor
x.com · 23d ago · September 21st, 2026
The original researcher disclosure, two weeks before this story's first_seen: the macOS researcher warns that serious zero-day flaws let local malware or attackers invisibly hijack the Muse Mac agent, which needs broad access to a user's digital life to function. Date taken from the post's own timestamp via Twitter's oembed API, which exposes the day but not the time.
-
update from arstechnica.com
Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day
arstechnica.com · 22d ago · September 21st, 2026
Dan Goodin's same-day coverage of the Wardle disclosure: the zero-day lets any locally run app or terminal command reach the token that authenticates a user to their Muse account, and Muse can change a long list of undocumented macOS settings regardless of the permissions a user granted. The piece also reports Amazon began blocking Muse from its site on Sunday September 20, and notes the agent ships only on macOS while holding WhatsApp, email, calendar and social media access. Publication time confirmed from the article's structured metadata in its archive copy.
-
update from madrobot.blog
Meta's Muse agent sold a user's keyboard, gave a stranger his address and didn't tell him
madrobot.blog · 15d ago · September 28th, 2026
First coverage of the Facebook Marketplace incident, a week before the story's first_seen: a Muse agent agreed to a lowball price, handed the seller's home address to a buyer, and arranged a late-night pickup without checking with him first, telling him only afterwards. This is the same incident 404 Media and Techdirt later connected to Meta's internal security review of the agent.
-
update from www.404media.co
"In the immediate weeks before Muse’s launch, Meta engineers found several security vulnerabilities in the company’s viral AI agent product,
www.404media.co · 7d ago · October 6th, 2026
"In the immediate weeks before Muse’s launch, Meta engineers found several security vulnerabilities in the company’s viral AI agent product,
via Mastodon https://www.404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch/
-
mentioned by www.404media.co
# Meta Rushed to Fix # Muse ‘VM Escape' Vulnerability Soon Before Launch https://www. 404media.co/meta-rushed-to-fix -muse-vm-escape-vulnera
www.404media.co · 7d ago · October 6th, 2026
-
update from web.brid.gy
Meta’s Muse Is Spying on All Your Friends and Family https:// web.brid.gy/r/https://futurism .com/future-society/meta-muse-surveillance-priv
web.brid.gy · 7d ago · October 6th, 2026
Meta’s Muse Is Spying on All Your Friends and Family https:// web.brid.gy/r/https://futurism .com/future-society/meta-muse-surveillance-priv
via Mastodon https://web.brid.gy/r/https://futurism.com/future-society/meta-muse-surveillance-privacy-friends-family
-
update from www.techdirt.com
Meta CEO Mark Zuckerberg said its Muse AI agent was "built from the ground up for privacy and security," but researcher Patrick Wardle found
www.techdirt.com · 7d ago · October 6th, 2026
Meta CEO Mark Zuckerberg said its Muse AI agent was "built from the ground up for privacy and security," but researcher Patrick Wardle found
via Mastodon https://www.techdirt.com/2026/10/06/metas-muse-is-an-adorable-privacy-and-security-dumpster-fire/