A spike in reported KVM escapes before the launch

404 Media reported on 5 October 2026 that Meta engineers found several security vulnerabilities in its Muse agent in the weeks before the product launched, at least one of which could have let a normal Muse user leave the agent's intended environment and reach sensitive internal Meta databases and services. The outlet reviewed an internal post and security documentation and spoke to an unnamed Meta source; it says the issues were serious enough to reach Mark Zuckerberg, and that several security teams worked nights and weekends to close them.

The internal post, sent on 18 September by Meta's vice president of core infrastructure Surupa Biswas, vice president of engineering Francois Richard and senior director of engineering Josh Barry to the company's core infrastructure team, framed the work as a "service hardening push". It describes "a sudden spike in reported KVM escapes, plus heightened awareness of agentic safety issues" as the reason for the rally, and says the push began on 27 August. The post says the teams reduced "the surface area accessible to Hatch agents" and constrained the port and IP destinations that agents and their host machines could reach.

The Meta source told 404 Media that fixes were pushed as quickly as possible without delaying the launch, producing what the source called "half-baked protections being rushed out to enable the launch". The source said many senior engineers believe a major data breach is inevitable as a result of Hatch.

Meta calls Muse "Hatch" internally. It gives each user a dedicated virtual machine, and the agent holds root inside it. A KVM escape is code inside that virtual machine reaching the host or other users' virtual machines. In Meta's design, the boundary that separates a user's agent from production is the hypervisor boundary, and Wardle's account of the design has the agent's machine sitting inside Meta's production environment with limited access to internal services.

Meta's own bug bounty lists a Muse virtual-machine escape as its highest-severity class, with a $300,000 maximum payout. Its published description of the top risk level is "compromise of Meta production and users beyond Muse", reached by "reaching Meta production services or internal networks from Muse", which is what at least one of the pre-launch flaws could have done according to the source. Security researcher Patrick Wardle, who separately found a Muse macOS flaw after launch, told 404 Media that Hatch "makes the virtualization boundary a production security boundary", and that having access to the production environment "literally one KVM escape away, is plain irresponsible".

The account rests on one anonymous Meta source together with internal documents and posts that 404 Media says it reviewed. Meta has not publicly confirmed the pre-launch KVM specifics; its response to 404 Media addresses Muse's safety and privacy generally without addressing them. A company spokesperson told 404 Media that Muse is "the first personal AI agent built for everyone" and that Meta is "proud of the work we've done to make it safe, secure and private", adding that it has strengthened Muse through dogfooding, agentic red teaming and its bug bounty program. No successful escape from a user's virtual machine into Meta production has been reported.

After launch, and separately, security researcher Patrick Wardle found a zero-day in the Muse macOS app that let locally running code redirect the app's dictation to an attacker's server and capture a login token; Meta patched it within about a day, according to Wardle's disclosure as reported by WebProNews. Meta's David Singleton described it as a local privilege escalation rather than a remote exploit, and it predates this report.