Meta Rushed to Fix Muse ‘VM Escape' Vulnerability Immediately Before Launch

Meta was scrambling to patch Muse in the final stretch before launch, after engineers found several security problems in the company’s new AI agent. According to 404 Media’s reporting, at least one of those bugs could have let a normal Muse user escape the agent’s virtual machine and get into Meta’s own sensitive databases and services. The issue was serious enough to reach Mark Zuckerberg, and teams were working nights and weekends to clean it up.

The key risk here is a “KVM escape.” Muse runs each user’s agent in a kernel-based virtual machine, which is meant to keep the agent isolated from Meta’s infrastructure. But if that boundary fails, a user can get out of the sandbox and start interacting with the system that runs it, or even other users’ virtual machines. Meta’s internal bug bounty page treats that as a top-tier problem and says it would pay up to $300,000 for a valid report.

An internal post from Meta leaders on September 18 said the company had started a service-hardening push on August 27 after “a sudden spike in reported KVM escapes” and growing concern around agent safety. The work, they said, went on for “a handful of weeks and weekends” and focused on shrinking what Hatch agents could reach, including tightening the ports and IPs they could contact. Muse launched 11 days before that post, which makes the timing look pretty uncomfortable.

Meta says Muse is meant to let people build personal agents that can work with email, calendar, messaging, browsing, and third-party accounts. But the rollout has already been messy: researcher Patrick Wardle found a zero-day that let apps and terminal commands control a user’s Muse, and another user got Muse to export Instagram follower data that shouldn’t have been exposed. Meta says it has added protections through dogfooding, red teaming, and bug bounty work. The bigger question is whether the company is shipping an agent product whose security model is already one bad escape away from production systems.