Meta engineers raced to patch KVM-escape bugs in Muse's VM sandbox before its Sept 8 launch

Meta·Meta Muse (internally codenamed 'Hatch')Fixed

In the weeks before Muse's launch, Meta engineers found several vulnerabilities in the Linux KVM virtualization layer isolating each user's Muse agent, at least one of which could let a normal Muse user escape their virtual machine and reach Meta's own internal databases and services.

Blast radius

Not disclosed publicly in numeric terms; the issue was serious enough to be escalated to Mark Zuckerberg, and internal engineers reportedly believe a major data breach via this boundary is 'inevitable.' No post-launch exploitation has been confirmed.

Root cause

Muse's security model relies on a shared virtualization boundary as a production security perimeter, even though users effectively have root control inside their own agent's VM.

How it was caught

An internal 'sudden spike in reported KVM escapes' surfaced roughly three weeks before launch; later reported publicly by 404 Media via internal documents and a source.

What changed

Meta hardened the VM boundary, reduced the network surface and internal destinations reachable from agent VMs before shipping, and offers up to $300,000 in its bug bounty for a KVM escape.

Take-awayDon't rely on a single shared virtualization boundary as your only production security perimeter when users have root inside agent VMs that sit next to your internal infrastructure.