The Pulse
Meta Strengthens Muse Warning After Vulnerability Could Expose User Data
Meta is making a safety warning in its Muse AI agent more prominent after a security vulnerability could have exposed users’ dedicated virtual machines. The flaw was reported through Meta’s bug bounty program, and the company says the warni
AI.info Team · Written with AI · fact-checked ·
“as an extra layer of protection”
Meta spokesperson, quoted by The Information
Meta is making Muse’s safety warning more prominent after an outside researcher found a vulnerability that could have let an attacker access a user’s dedicated virtual machine, The Information reported on September 25. The cloud-based machines hold user data, including emails and files. The revised warning will appear if Muse suspects a user is connecting to a malicious website, Meta said. The report does not establish that an attacker exploited the flaw or that user data was accessed.
A malicious link and an approval prompt
The vulnerability was reported through Meta’s bug bounty program, according to an internal incident report reviewed by The Information. The attack would require a user to ask Muse to summarize or interact with a link to a malicious webpage, then approve a prompt that includes a safety warning, Meta’s spokesperson said. Meta is responding by making that warning more prominent when the agent suspects a dangerous connection.
The company first classified the flaw as SEV-2, its second-highest level on a five-point scale, a rating generally used for incidents with significant impact, The Information reported. Meta later reclassified it as SEV-3. Those internal labels describe how the company assessed the incident; they do not, by themselves, show that an attacker successfully reached a user’s machine.
Muse’s private computer holds connected data
Muse is designed to act for users across services, including email and the web. Each user has a dedicated cloud virtual machine where Muse and connected service data are stored, according to Meta’s September 8 security post. The company also describes Sentinel, a separate permission system that governs actions and network traffic, and says Muse asks users to approve some actions.
That design makes the warning consequential: approving an action is part of the control path between a personal agent and potentially sensitive information. A more visible alert may help users spot a risky link, but it does not remove the underlying exposure described in the incident report. The practical test is whether Muse can reliably identify suspicious destinations and explain the risk before a user grants access.
Millions of downloads raise the stakes
Reuters reported that market intelligence firm Sensor Tower estimated about 2.8 million Muse downloads in its first two weeks, with the app topping free-app charts in the United States and Canada. The estimate offers a measure of the agent’s early reach, though downloads do not show how many people connected sensitive accounts or used the product regularly.
Meta has presented Muse as an agent that can browse, handle tasks and work with connected services. Its own safety post also acknowledges that Muse is not immune to attack and that prompt injection remains an open problem. The newly emphasized warning adds friction at one point of risk; it does not change the fact that users are being asked to make security decisions while an agent acts on their behalf.