Meta scrambled to patch Muse VM escapes that could have reached its internal databases

The attacker in this report needed only an account. According to a Meta source and internal documents viewed by 404 Media, at least one of the flaws could have let an outside attacker, meaning a normal Muse user, reach data in sensitive internal Meta databases ^[7]. To get that far, the attacker only had to sign up ^[10].

A KVM escape lets a guest interact with the host that runs it, or with other users' virtual machines ^[6]. In Muse, those guests are where the agent works with the services and accounts users handed it ^[4][5]. So one broken boundary puts two things in reach: Meta's back end, and other tenants' delegated access ^[10]. 404 Media's reporting describes the first. It does not say whether any user's account access was reachable through the bugs Meta fixed ^[7].

On the record, this is a closed finding. Meta engineers found the escapes in the weeks before launch, and staff worked overtime to fix them ^[1][2]. The account comes from one anonymous Meta source plus internal documents, and it describes an internal discovery under launch pressure with no outside actor or campaign attached ^[9][3].

The July link is the part that carries past launch day. At least one escape was related to an exploit found in Linux KVM code that month ^[8]. That puts part of Muse's containment in the host kernel and how current its patches are, alongside Meta's own agent code ^[5][8].

For buyers of agent services that hold account access, the evidence puts the risk in the isolation layer ^[4][6]. The questions are whether each user gets a dedicated guest, what the host can reach, and how fast hypervisor fixes land on production hosts. The evidence covers one vendor and one launch ^[9].