Meta adds stronger Muse safety warning after vulnerability report
A security researcher reported a Muse flaw through Meta's bug bounty program that could let an attacker access a user's dedicated cloud VM; Meta's response was a stronger in-app warning rather than a patch.
🚨 META ADDS STRONGER MUSE SAFETY WARNING AFTER NEW AI AGENT VULNERABILITY REPORT Meta Platforms is adding a clearer safety warning within its Muse AI agent after a security researcher found a vulnerability that could let an attacker access a user's sensitive personal information, Reuters reports, citing The Information. • The flaw was reported by an outside researcher through Meta's bug bounty program and had not previously been disclosed • Per an internal Meta incident report reviewed by The Information, it could have allowed an attacker to access a user's dedicated virtual machine — an individualized cloud-based account containing data including emails and files • Meta initially classified it as "SEV-2", its third-highest severity level on a five-point scale • Meta's reported response is a strengthened in-app warning, not a patch — the report does not say whether the underlying flaw has been fixed • Meta did not immediately respond to Reuters' request for comment • Muse, launched earlier this month, carries out tasks such as shopping, travel booking, emailing and payments on users' behalf ⚠️ Analyst Note: This follows the Muse macOS zero-day we covered on Sep 22 — Patrick Wardle's not-a-mused PoC, which abused an undocumented dictation-endpoint setting and required existing local code execution. The newly reported bug-bounty flaw concerns access to users' cloud virtual machines; the report does not link it to Wardle's bug, so treat them as separate issues. Two security problems in Muse's first month underline the risk of AI agents holding broad access to email, files and payments. Source (Reuters, citing The Information, 25 Sep 2026): https://tech.yahoo.com/ai/meta-ai/articles/meta-bolsters-muse-safety-warning-181523688.html Earlier zero-day PoC (Patrick Wardle): https://github.com/pwardle/not-a-mused Our Sep 22 coverage: https://x.com/DailyDarkWeb/status/2102271029942890616 #DDW #Meta #Muse #AISecurity #AgenticAI #ThreatIntel #CyberSecurity #DarkWeb
This post quotes another post: “Meta Muse local zero-day PoC released by Patrick Wardle”