{"schema_version":"0.8.0","id":"LR-2026-0137","record_version":4,"title":"Meta Muse AI agent KVM escape vulnerability discovered before launch","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":4.31},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-08","extraction_run_id":null},"system":{"model_name":"Muse","model_version":null,"developer":"Meta","harness":"Muse agent","tools_granted":["computer_interaction","web_navigation","applications"],"permissions_scope":"Access to sensitive user information, including emails and financial accounts; agents run inside a KVM intended to isolate them from Meta’s wider infrastructure.","autonomy_level":"unknown","guardrails_present":["kvm_isolation"],"deployment_context":"unknown","tier":"provider","lifecycle_stage":"pre_release","integration_type":"agentic_with_tools","intended_use":"AI-powered personal assistant that performs tasks on a user’s behalf, such as booking flights, shopping for groceries and managing other tasks.","safeguard_state":null,"production_intended":true},"event":{"date_occurred":null,"date_disclosed":"2026-10-08","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"human_review","summary":"Meta’s pre-launch Muse AI agent, which runs inside a KVM to isolate it from Meta’s infrastructure, was found by engineers to have a vulnerability that could let an ordinary Muse account break out of the virtual machine and reach sensitive data in Meta databases. The issue, detected less than two weeks before launch, triggered an emergency fix and reached CEO Mark Zuckerberg; some engineers doubt the rushed protections are sufficient.","tags":["kvm-escape","pre-launch","virtualization-boundary","data-access"],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"The reported KVM escapes indicate the isolation boundary around the agent was breached, but no source states an autonomous agent caused the event.","responsible_party":null,"adversarial_actor":"unknown","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"The vulnerability was fixed ahead of launch, though some employees doubted the rushed protections were sufficient.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: The vulnerability could have allowed an ordinary Muse account to reach sensitive information in Meta databases, an unbounded scope stated.","harm_class":["third_party_security"],"affected_description":"Sensitive information held in Meta databases; sensitive user information including emails and financial accounts","protected_class_involved":null,"data_categories_exposed":["pii","financial_accounts","emails"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://english.mathrubhumi.com/technology/meta-muse-ai-agent-security-flaw-kvm-escape-vulnerability-m41f3hap","publisher":"news search (Bing News index)","date":"2026-10-08","type":"press","title":"Meta’s Muse AI agent faced security scare before launch; engineers feared ‘massive data breach’","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.guardrails_present":"C","system.tier":"D","system.lifecycle_stage":"C","system.integration_type":"D","system.intended_use":"C","system.production_intended":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.near_miss":"C","event.adversarial_actor":"D","event.remediation":"C","event.agent_involved":"C","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"system.developer":[{"source_index":0,"quote":"Muse is Meta’s AI-powered personal assistant, built to perform tasks on a user’s behalf rather than simply respond to prompts."}],"system.harness":[{"source_index":0,"quote":"To perform such computer-based tasks, Muse agents run inside a kernel-based virtual machine, or KVM."}],"system.tools_granted":[{"source_index":0,"quote":"The agent can interact with a computer, navigate websites and use applications to carry out actions such as booking flights, shopping online and handling other digital tasks on a user’s behalf."}],"system.permissions_scope":[{"source_index":0,"quote":"The technology is designed to operate with access to sensitive user information, including emails and financial accounts, making security around the system particularly critical."}],"system.autonomy_level":[{"source_index":0,"quote":"The stakes are particularly high because Muse is designed to act with a degree of autonomy."}],"system.guardrails_present":[{"source_index":0,"quote":"To perform such computer-based tasks, Muse agents run inside a kernel-based virtual machine, or KVM."}],"system.deployment_context":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"system.integration_type":[{"source_index":0,"quote":"The agent can interact with a computer, navigate websites and use applications to carry out actions such as booking flights, shopping online and handling other digital tasks on a user’s behalf."}],"system.intended_use":[{"source_index":0,"quote":"Muse is Meta’s AI-powered personal assistant, built to perform tasks on a user’s behalf rather than simply respond to prompts."}],"system.production_intended":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"event.detection_method":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"event.summary":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."},{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."},{"source_index":0,"quote":"The vulnerability was eventually fixed in what 404 Media described as a “mad dash” ahead of the launch."}],"event.tags":[{"source_index":0,"quote":"However, engineers reportedly detected a “sudden spike in reported KVM escapes” less than two weeks before Muse was launched."},{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."}],"event.near_miss":[{"source_index":0,"quote":"The vulnerability was eventually fixed in what 404 Media described as a “mad dash” ahead of the launch."}],"event.adversarial_actor":[{"source_index":0,"quote":"However, engineers reportedly detected a “sudden spike in reported KVM escapes” less than two weeks before Muse was launched."}],"event.remediation":[{"source_index":0,"quote":"The vulnerability was eventually fixed in what 404 Media described as a “mad dash” ahead of the launch."}],"event.incident_class":[{"source_index":0,"quote":"However, engineers reportedly detected a “sudden spike in reported KVM escapes” less than two weeks before Muse was launched."}],"event.agent_involved":[{"source_index":0,"quote":"The stakes are particularly high because Muse is designed to act with a degree of autonomy."}],"event.failure_class_detail":[{"source_index":0,"quote":"However, engineers reportedly detected a “sudden spike in reported KVM escapes” less than two weeks before Muse was launched."}],"impact.harm_class":[{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."}],"impact.affected_description":[{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The technology is designed to operate with access to sensitive user information, including emails and financial accounts, making security around the system particularly critical."}],"impact.severity_because":[{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."}],"context.industry":[{"source_index":0,"quote":"Muse is Meta’s AI-powered personal assistant, built to perform tasks on a user’s behalf rather than simply respond to prompts."}],"context.country":[{"source_index":0,"quote":"Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media."}],"impact.severity":[{"source_index":0,"quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-08"}]},"notes_on_gaps":"No source states event.date_occurred, event.date_disclosed, event.duration, event.time_to_contain, event.date_detected, event.operations_paused, event.precursor_events, event.input_provenance, event.secondary_failure_classes, impact.direct_loss_usd, impact.remediation_hours, impact.records_exposed, impact.third_parties_affected_count, impact.loss_range_usd, impact.downstream_exposure_count, impact.protected_class_involved, context.org_size_band, context.denominator_available, context.denominator, context.shared_model_id, context.upstream_incident_id, context.incident_evidence, context.regulatory, or context.coverage. event.failure_class is left null because no source states an autonomous agent caused the event; the KVM escape is a boundary breach, not an agent-mechanism failure. system.autonomy_level is unknown because no source states the approval or monitoring arrangement. system.deployment_context is unknown because no source states where the system was running. event.trigger is unknown because no source names a cause. impact.severity is major because the source states an unbounded scope (access to sensitive information in Meta databases) rather than a dollar figure. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-09] system.integration_type: agentic_with_tools. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.responsible_party: provider. event.adversarial_actor: unknown. event.detection_method: a person at the operator or developer noticed it in review or logs. event.incident_class: the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. impact.harm_class: third_party_security. impact.reversibility: not_applicable. context.industry: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: classified from described behaviour. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":"Information","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Meta’s Muse AI agent, a personal assistant for users, was being prepared for launch. It runs inside a KVM and is designed to act on a user’s behalf with access to sensitive information such as emails and financial accounts.","quote":"Muse is Meta’s AI-powered personal assistant, built to perform tasks on a user’s behalf rather than simply respond to prompts.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A vulnerability could have let an ordinary Muse account break out of the virtual machine isolating the agent, breaching the KVM isolation boundary meant to keep it away from Meta’s wider infrastructure.","quote":"According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases.","source_index":0,"grade":"C"},{"step":"reached","text":"The escape could have reached sensitive information held in Meta databases and the underlying host system or other environments, though the report does not say it was actually accessed.","quote":"A KVM escape occurs when software running inside a virtual machine breaks through the isolation layer and gains access to the underlying host system or other environments.","source_index":0,"grade":"C"},{"step":"caught","text":"Meta engineers detected a sudden spike in reported KVM escapes less than two weeks before Muse was launched.","quote":"However, engineers reportedly detected a “sudden spike in reported KVM escapes” less than two weeks before Muse was launched.","source_index":0,"grade":"C"},{"step":"done","text":"The vulnerability was fixed in a rushed effort ahead of launch, with security teams working around the clock and the issue reaching CEO Mark Zuckerberg; some employees doubted the protections were sufficient.","quote":"The vulnerability was eventually fixed in what 404 Media described as a “mad dash” ahead of the launch.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-09","source_urls":["https://english.mathrubhumi.com/technology/meta-muse-ai-agent-security-flaw-kvm-escape-vulnerability-m41f3hap"]}}