Muse nearly launched with a dangerous escape route. In the immediate weeks before release, Meta engineers found several security vulnerabilities in the company’s viral AI agent product. At least one flaw could have let malicious users break out of Muse’s intended environment and reach Meta’s sensitive databases and services.
The problem was serious enough to reach Meta CEO Mark Zuckerberg, sending security teams into a multi-team “mad dash” before launch. Engineers worked nights and weekends to handle what an internal post described as “a sudden spike in reported KVM escapes.”
A KVM escape occurs when a Muse instance breaks out of its virtual machine through a security vulnerability, then interacts with the system running it or with another user’s virtual machine. That boundary is the foundation of Muse’s design, so finding holes in it was not a minor pre-release cleanup task. It was the product’s security model asking for a lawyer.
A rushed fix for a high-risk flaw
The security push began on August 27, 2026, and lasted a “handful of weeks and weekends.” Muse was released 11 days after the push began, leaving Meta’s teams with a narrow window to repair the vulnerabilities before users gained access.
Meta vice president of core infrastructure Surupa Biswas, vice president of engineering Francois Richard, and senior director of engineering Josh Barry described the effort in an internal post dated September 18, 2026. The post covered the security work after engineers found several problems in the Linux virtualization software Meta uses for Muse.
At least one vulnerability related to an exploit found in Linux kernel-based virtual machine code in July. Meta’s bug bounty program offers up to $300,000 for bugs that allow a VM escape, and its highest risk category is “Compromise of Meta production and users beyond Muse” with a VM escape.
That bounty structure makes the stakes clear. Muse does not run as a simple chatbot waiting for prompts; each user gets a dedicated virtual machine that stores the agent’s data and context while connecting to the user’s services. If that machine fails to stay isolated, the problem reaches beyond one person’s assistant.
Muse also builds intimate contact profiles
The security concerns arrive alongside a separate privacy issue: Muse creates a detailed file on every person in the user’s life. Those profiles can include a person’s name, relationship, location, occupation, important dates, and interaction history.
Muse updates a page for each person or group tied to the user every hour, drawing from messages, photos, and its own memory. The profiles can record when the user last spoke with someone, how often they communicate, and details about their relationship.
They can also include guidance on how to interact with contacts, such as when to call or where to take them out. Other profile sections cover facts, history, relationship details, commonalities, open threads, and suggestions for strengthening relationships — a personal database that knows when your friend became a “maybe call soon.”
Meta says Muse gathers data from public information and material the user has chosen to share. The company also says Muse seeks human confirmation before completing actions such as sending an email or making a purchase, while an audit log lets users review the agent’s activity and future plans.
Those controls matter because the same architecture that supports a personalized agent also concentrates sensitive context in a dedicated virtual machine. Muse’s ability to track relationships and act through connected services depends on that context, making the isolation flaws more consequential than a routine software bug.
Meta says Muse is built to be safe, secure, and private, with protections and user controls. “Muse is the first personal AI agent built for everyone and we’re proud of the work we’ve done to make it safe, secure and private, with built-in protections and user controls that put people in charge of how they use it,” Meta spokesperson Daniel Roberts said.
The company fixed the vulnerabilities before launch, but the timeline leaves a clear lesson: an AI agent with access to personal services needs strong isolation before it needs a clever personality. Muse arrived after a frantic security push, carrying detailed records about users’ relationships inside the very environment engineers had been racing to secure.
Based on
