Meta Muse SEV-2: your agent's VM holds your email

Every personal AI agent you hand your inbox to gets a container somewhere with your life in it. On September 25, Reuters reported that an outside researcher found a way into that container. Meta is adding a clearer safety warning inside Muse after a bug bounty submission showed an attacker could reach a user's dedicated virtual machine — the individualized cloud account that holds emails and files. Meta rated it SEV-2, its third-highest severity on a five-point scale.

What actually happened

The flaw came in privately through Meta's bug bounty program and had not been disclosed before The Information broke it on Friday. Meta did not immediately respond to Reuters' request for comment. The company's response, so far, is a warning in the product rather than an architectural change.

Note what the target is. Not a chat log. The Muse VM is a persistent cloud workspace the agent uses on your behalf, and by design it accumulates the material it needs to be useful — mail, documents, whatever you connected. Compromise the workspace and you do not steal one answer. You inherit the agent's standing access.

This is the second publicly reported Muse security problem in four days. On September 22, Mac security researcher Patrick Wardle disclosed a local zero-day: an attacker who already has code execution on the machine can flip an undocumented Muse setting that controls the dictation transcription server, redirect that traffic to their own host, and capture both voice prompts and the victim's Muse account token. Malwarebytes' write-up quotes Wardle calling the result "the ultimate backdoor" — the agent's connected services (WhatsApp, email, calendars) plus its macOS permissions for files, microphone, camera and location. That one needs prior local access, which lowers the odds and raises the ceiling.

Two different bugs, same underlying shape: the agent is a credential with a filesystem.

Why agent blast radius matters for your business

Scope the agent, not the user. The reason both of these are bad is that the agent holds a bundle: your mail, your calendar, your files, your connected apps, all under one token. If your team is running personal AI agents against work accounts, the account the agent authenticates as should be a separate, scoped identity with the minimum set of connectors — not the owner's everything-account. We have made the same argument about bot agents signing into your tools and it keeps being the fix.

Treat the agent workspace as production. A persistent VM that accrues your documents is infrastructure, whether or not anyone calls it that. It deserves the same questions you would ask of a file server: what is in it, who can reach it, how long does data live there, and what happens to it when the employee leaves.

A safety warning is not a control. Shipping a clearer in-product warning puts the decision on a user who is mid-task and has already decided to trust the thing. If the risk matters to your business, the control has to sit above the user — an allowlist, a separate device, or not connecting the mailbox at all.

Assume the consumer agent is unfinished. Muse launched recently and has two disclosed security findings inside a week. That is not unusual for a new agent product; it is the normal early curve. The mistake is wiring a brand-new consumer agent into the accounts that run your company because it is convenient.

Inventory what your staff already connected. Most owners we talk to do not know. Ask this week: which AI assistants have OAuth grants against company Google Workspace or Microsoft 365, and who approved them. The answer is usually "several, nobody."

Sources: Reuters via KSL, Malwarebytes.