Muse, in its own files

Selected high-severity findings

All findings

Meta's claims and the incidents after launch

Meta launched Muse on 8 September 2026 as a personal AI agent. Each user gets a dedicated cloud computer, the Muse Secure VM, where the agent can read email, manage a calendar, use connected apps and make purchases. According to Meta, the VM runs in a container "so no one else's agent can reach it", a separate Sentinel process must approve any network access, and conversations and VM data are not shared with Meta's ad systems.

A bug-bounty researcher reported a flaw that could expose a user's VM to an attacker; Meta initially rated it SEV-2, its third-highest severity. Security researcher Patrick Wardle disclosed an unpatched macOS zero-day in the desktop client. On 24 September, developers Peter James and Jonny L. Saunders found that Muse could be prompted to compress its own root filesystem and hand it over, with prompting Saunders called "extremely easy". This review is based on that export. Meta described it as "intended behavior" rather than a breach, since each VM is isolated to its own user.

Quotations checked against their source files

A script checks each quotation against the cited file and line range, after normalising line wrapping and quotation-mark style. If any quotation does not match, the build fails and the page is not published. Five citations carry no quotation (side-by-side template comparisons and a list excerpt); for these only the file and line range are checked. Each citation is marked with its source type:

file

A document from the virtual machine, cited by path and line range.

transcript

A line from a recorded agent session, stored as one JSON record per line. The line number is located automatically by searching the decoded records for the quoted text.

derived

A value decoded from a binary or compressed file in the VM, such as an FST-encoded domain list or strings extracted from a compiled binary with strings -n 6. The decoded output is saved as a plain-text file, so the citation can be checked without re-running the decoder.

Where a finding draws a conclusion beyond what the files state, that conclusion appears separately under "Analysis".

Related research

Papers related to the findings above, with the number of related findings. Select a paper to filter the findings list.

Public sources used for context

These articles are cited for Meta's launch claims and the incident timeline under Context, and occasionally in an Analysis for Meta's public statements. All evidence comes from the VM files.