Cases › security breach › LR-2026-0137
Meta Muse AI agent KVM escape vulnerability discovered before launch
Whose AI: Meta · Musesecurity breach
Severity major: The vulnerability could have allowed an ordinary Muse account to reach sensitive information in Meta databases, an unbounded scope stated.
Earliest source we hold 2026-10-08
Meta’s pre-launch Muse AI agent, which runs inside a KVM to isolate it from Meta’s infrastructure, was found by engineers to have a vulnerability that could let an ordinary Muse account break out of the virtual machine and reach sensitive data in Meta databases. The issue, detected less than two weeks before launch, triggered an emergency fix and reached CEO Mark Zuckerberg; some engineers doubt the rushed protections are sufficient.
Risk grouping: Not yet classified
| Before or after release | Before release “Meta’s new Muse AI agent was barely weeks away from launch when engineers discovered a security vulnerability that could have allowed users to break out of the virtual machines running the agent and potentially access sensitive data stored in Meta’s internal systems, according to a report by 404 Media.” source |
|---|---|
| The AI's part | Attacked “According to 404 Media, one of the vulnerabilities could have allowed someone using an ordinary Muse account to gain access to sensitive information held in Meta databases.” source |
No source we hold states: who caused it, intended or not.
The story
1 · What it was doingMeta’s Muse AI agent, a personal assistant for users, was being prepared for launch. It runs inside a KVM and is designed to act on a user’s behalf with access to sensitive information such as emails and financial accounts.
2 · What went wrongA vulnerability could have let an ordinary Muse account break out of the virtual machine isolating the agent, breaching the KVM isolation boundary meant to keep it away from Meta’s wider infrastructure.
3 · What it reached or didThe escape could have reached sensitive information held in Meta databases and the underlying host system or other environments.
4 · How it was caughtMeta engineers detected a sudden spike in reported KVM escapes less than two weeks before Muse was launched.
5 · What was doneThe vulnerability was fixed in a rushed effort ahead of launch, with security teams working around the clock and the issue reaching CEO Mark Zuckerberg; some employees doubted the protections were sufficient.
No source states: {'q': 'entity', 'value': None, 'quote': None, 'url': None}, {'q': 'intent', 'value': None, 'quote': None, 'url': None}.
Others like this
Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer 2026-09-29
Show every field, with its source and grade
The AI system
Model
Muse
C one secondary source states it
Developer
Meta
C one secondary source states it
Software around the model
Muse agent
C one secondary source states it
Tools it was given
computer interaction, web navigation, applications
C one secondary source states it
What it was allowed to do
Access to sensitive user information, including emails and financial accounts; agents run inside a KVM intended to isolate them from Meta’s wider infrastructure.
C one secondary source states it
Safeguards in place
kvm isolation
C one secondary source states it
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
Stage of the model
before release
C one secondary source states it
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
AI-powered personal assistant that performs tasks on a user’s behalf, such as booking flights, shopping for groceries and managing other tasks.
C one secondary source states it
Meant for live use
yes
C one secondary source states it
What happened
Earliest source we hold
2026-10-08
A the date the source itself carries
Who caught it
a human reviewer
D inferred by us from the described behaviour, reason shown
Themes
KVM escape, pre launch, virtualization boundary, data access
C one secondary source states it
Near miss
yes, no harm happened
C one secondary source states it
What was done
The vulnerability was fixed ahead of launch, though some employees doubted the rushed protections were sufficient.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
The reported KVM escapes indicate the isolation boundary around the agent was breached.
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
others' security
D inferred by us from the described behaviour, reason shown
Who was affected
Sensitive information held in Meta databases; sensitive user information including emails and financial accounts
C one secondary source states it
Kinds of data exposed
personal information, financial accounts, e-mails
C one secondary source states it
Why this severity
The vulnerability could have allowed an ordinary Muse account to reach sensitive information in Meta databases, an unbounded scope stated.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
Country
United States
D inferred by us from the described behaviour, reason shown
LR-2026-0137 · version 4 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON