Meta rushed to fix a Muse ‘VM escape’ before launching its agent
404 Media reported on Monday that Meta engineers hit what an internal post called “a sudden spike in reported KVM escapes” in the weeks before Muse launched, and worked overtime to fix them. Each Muse instance runs on a kernel-based virtual machine that is supposed to be isolated from Meta’s own infrastructure; at least one of the flaws could have let an attacker break out of that isolation and reach sensitive internal databases and services. The issues reached Mark Zuckerberg, and a Meta source said the fixes were rushed specifically so they would not delay the launch, with senior engineers expecting a breach to follow.
The rest of the damage is already public. Wired found that Muse’s background processes generate a profile page for every person in a user’s life - family, partners, colleagues, even people who never installed it. Users separately reported that Muse reads private messages and uploads them despite being told not to, that impersonating a Muse agent tricked it into granting root access, and that it undersold a seller’s Marketplace goods while sharing their home address. Apple has since tightened macOS privacy settings to stop third-party apps misusing message history.
WHY IT MATTERS
This is the agent-security story the whole “let an assistant into your accounts” pitch has been building toward, and it lands hardest on anyone wiring tools into an autonomous loop. The failure is not a clever jailbreak: it is an agent that shipped with its isolation boundaries unfinished because the launch date beat the fix, which is the same trade-off that decides whether your own sandbox holds. Muse is called “Hatch” internally, and the source’s warning about half-baked protections rushed out to make the date is the line to read against your own permission model. The caveat deserves one line: most of this rests on unnamed internal sources, and Meta has not publicly confirmed or denied the VM-escape account.