Muse escapes containment
Meta patched a pre-launch Muse AI agent KVM escape that could have exposed internal databases.
In the weeks before launching its Muse AI agent, Meta found several security flaws, including kernel-based virtual machine escapes. At least one could have let an ordinary Muse user break out of the isolated KVM and reach sensitive internal Meta databases and services. The issues were escalated to Mark Zuckerberg, and teams rushed to fix a spike in reported KVM escapes before launch. At least one flaw was related to a Linux KVM exploit identified in July.
- Muse agent instances run in KVMs meant to stay isolated from Meta infrastructure.
- At least one flaw could let a normal user reach sensitive internal databases.
- Issues reached Mark Zuckerberg and triggered a pre-launch remediation sprint.
- At least one bug was tied to a Linux KVM exploit found in July.
Full article975 words · extracted from 404media.co · click to collapse
Good Monday morning, I'm on my second coffee of the day already so please excuse any jitters that come through today's newsletter. We've got a big constitutionality ruling on Flock, a scoop about a major fire Meta needed to put out pre-Muse launch, and a lot more from trawling the World Wide Web. Let's get into it.
THE BIG STORY
Meta Rushed to Fix Muse ‘VM Escape' Vulnerability Immediately Before Launch
In the immediate weeks before Muse’s launch, Meta engineers found several security vulnerabilities in the company’s viral AI agent product, at least one of which could have allowed malicious users to break outside of Muse’s intended environment and access Meta’s own sensitive databases and services, 404 Media has learned. The issues were so severe that they reached Mark Zuckerberg and staff worked overtime to fix them.
These specific vulnerabilities were discovered before the launch of the product but required a multi-team “mad dash” to fix “a sudden spike in reported KVM escapes,” according to an internal post by Meta executives to its core infrastructure team seen by 404 Media. In order for Muse to work, a user gives the AI agent access to various important services and accounts that they own. On Meta’s end, each individual Muse instance runs on a kernel-based virtual machine, which connects to, but is supposed to be isolated from, Meta’s own critical infrastructure. A “KVM escape” is when, through a security vulnerability, a Muse instance is able to escape from that virtual machine and interact with the system that runs it, or with other users’ virtual machines.
According to a Meta source, as well as internal security documentation and internal posts viewed by 404 Media, at least one of the vulnerabilities could have allowed an outside attacker — that is, a normal Muse user — to access data in sensitive internal Meta databases. At least one of the vulnerabilities was related to an exploit found in Linux kernel-based virtual machine code in July. 404 Media granted the Meta source anonymity to speak about sensitive security matters.
Read the rest of the story here.
MORE FROM 404
“Indiscriminate mass surveillance.” In a major first, a federal judge in Oklahoma ruled Thursday that a police officer violated the Fourth Amendment rights of a woman accused of meth trafficking when he searched her license plate in Flock’s automated license plate reader system simply because her license plate was from California, then used her travel history as part of the reason to search her car.
Are you signed up for The Abstract? If not, you’re missing out, and I don’t want any of our readers experiencing FOMO, so check your account settings to make sure you’re subscribed. In this week’s issue: “Our Solar System Is Terminally Unstable and Will Be Completely Destroyed, Study Finds.” Cool!!!!
And if you’re looking for a Monday listen, on the 404 Media podcast we get into the massive FBI hack that we broke last week, and how a surveillance company is telling cops it wants to add facial recognition tech to Flock camera data. That’s out for everyone today (Supporters got it early!). Listen wherever you get your pods, or watch on YouTube.
FROM AROUND THE WEB
Today in stats that will make you go WTF: The Internet Watch Foundation has found “more photorealistic child sexual abuse material in the first half of 2026 than for the whole of the prior year,” the Guardian reports, thanks to people generating child sexual abuse material using AI tools. The IWF said it assessed 6,310 AI images that met the legal definition of child sexual abuse, which comes in at 40% higher than last year. In case you missed the memo when experts started sounding the alarm on this when we covered the issue in 2024, AI generated child sexual abuse material is not a “victimless crime.”
Is that not enough WTF for you on a Monday morning? UPS made a video of workers as little kids using AI, and it did not land. As one reply puts it succinctly: Fucking yikes??? Please pray for the UPS social media team.
Norway might ban the pervert glasses. The country’s parliament will propose a temporary ban on Meta’s smart glasses in public spaces, including all the common sense spots like schools, pools, doctor’s offices and changing rooms, but also beaches and parks. Lord I see what you do for others...
I Super Like this report about pay-to-win dating app schemes. Straight Arrow News reports that some users are “so furious they’ve filed formal federal complaints against Match Group, the publicly traded technology giant that owns the largest dating apps on the market, including Hinge, Tinder and OkCupid. As people leave their luck to a for-profit algorithm with subscription fees of up to $600 per year, public records obtained by Straight Arrow show, they’re calling on federal regulators to crack down on a company they accuse of deceptive business practices and algorithmic manipulation.”
I am reading it for the articles. Former Motherboarder (IYKYK) turned instant New York Times Bestselling Author Brian Anderson has a wild story in Playboy about drug smuggler Ken “Goldfinger” Connell and the world of the Grateful Dead. I am not personally a Deadhead but I am a fan of Brian’s writing!
Always such a relatable guy. Sam Altman said in an interview with Politico that at OpenAI they “believe that the world should accept some bad things happening for the benefits of this technology and people having the agency.” What bad things, Sam? What bad things?
It’s Nobel Prize winner day. I wonder if I won.
About the author
Sam Cole is writing from the far reaches of the internet, about sexuality, the adult industry, online culture, and AI. She's the author of How Sex Changed the Internet and the Internet Changed Sex.
