404 Media reported Monday that Meta engineers discovered several serious vulnerabilities in Muse's virtualization layer in the weeks before the agent's launch, including Linux KVM 'VM escape' bugs that could have let a user break out of their sandbox and reach Meta's own internal databases and services. A sudden spike in reported KVM escapes around August 27 triggered an all-hands hardening push, with multiple security teams working nights and weekends; the issue was considered serious enough to be raised to Mark Zuckerberg.

According to a source granted anonymity, teams were asked to ship hot fixes as quickly as possible without slipping the launch, producing what the source called 'half-baked protections being rushed out to enable the launch.' An internal September 18 post by Meta's core infrastructure leaders confirmed the push, saying Muse is 'a fundamentally different paradigm' because Meta hosts and runs agents directly on behalf of end users, and describing steps to reduce the surface area accessible to agents and constrain reachable network destinations.

The report lands amid a pile of other Muse security headaches: Amazon has blocked Muse from its platform over credential-handling concerns, a researcher demonstrated a prompt-based private-data exposure flaw last month, and the company has been strengthening safety warnings. Meta insists credentials stay in a separate secure vault and that containers prevent cross-agent access — but senior engineers reportedly consider a massive data breach 'inevitable' without deeper fixes.