The flaw, reported by an outside researcher through Meta’s bug bounty program and not previously disclosed, could have allowed an attacker to access a user’s dedicated virtual machine — an individualized cloud-based account containing data including emails and files, according to an internal Meta incident report reviewed by The Information.
The vulnerability was initially classified as a “SEV-2,” Meta’s third-highest severity level on a five-point scale, typically used for incidents with significant impact, the report said.
Meta did not immediately respond to a Reuters request for comment.
Muse, launched earlier this month, is Meta’s personal AI agent designed to carry out tasks such as shopping, travel booking, emailing and payments on behalf of users.
Muse has rapidly climbed Apple’s App Store and Google Play rankings in recent weeks, topping the free-app charts in the United States and Canada, with market intelligence firm Sensor Tower estimating about 2.8 million downloads in its first two weeks.
