Meta Rushed to Fix Muse ‘VM Escape' Vulnerability Immediately Before Launch
Meta rushed fixes for Muse AI agent VM-escape flaws, including one that could reach Meta's sensitive internal databases, with engineers warning of a future breach.
Internal Meta posts seen by 404 Media describe a 'sudden spike in reported KVM escapes' in the Muse AI agent (internally 'Hatch'), triggering a multi-team hardening push from August 27 until days before launch. At least one flaw could have let an ordinary Muse user access sensitive internal Meta databases; the issue reached Mark Zuckerberg. Meta pays $300,000, its maximum bounty, for Muse VM escapes that reach production services. Post-launch, Patrick Wardle found a separate Muse zero-day allowing apps and terminal commands to control a user's agent.
- KVM escape spike triggered weeks of overtime fixes just before Muse launch; issues reached Zuckerberg.
- At least one flaw could expose sensitive internal Meta databases to any Muse user.
- Meta's maximum $300,000 bounty covers Muse VM escapes reaching production services.
- Senior engineers reportedly expect a massive data breach resulting from Muse ('Hatch').
- Patrick Wardle found a separate Muse zero-day enabling app and terminal control post-launch.
- Organizations
- MetaMark ZuckerbergPatrick Wardle
- AI models
- Muse
From the original article
5 min read at 404media.co
The vulnerability could have let a Muse user access sensitive internal Meta databases.
By Jason Koebler · 404media.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.