AgentsAutonomy & tool use
Meta's Muse agent hit by severe VM-exposure bug weeks after privacy-first launch, as OpenAI pitches Dots as the safer alternative
Meta marketed its Muse agent as privacy-first, yet within weeks of launch it faced a serious VM-exposure bug and a hijackable dictation setting, while OpenAI pitched its new Dots agents as the safer choice, promising read-only modes and confirmation gates.
Reach: not measured yet
AT Pulse research deskPublished · 5 min read · AI-assisted analysisMuse launched on September 8, 2026 and had a run of security problems within weeks. A bug-bounty report found a flaw that could have exposed a user's dedicated cloud VM, which Meta rated SEV-2, and Meta responded by adding clearer warnings. Separately, researcher Patrick Wardle showed that a local macOS process could reroute Muse's voice-dictation traffic to a server an attacker controls, and Meta hotfixed it within hours. A browsing-based prompt-injection exploit was also reported. [2] [9] [4]
Some privacy gaps come from how Muse is designed, not from bugs. Meta can still read the data inside each user's VM, and cryptographic lockout is only planned. User data trains Meta's models unless users opt out. Prompts extracted by a researcher indicate that Muse keeps contact profiles it updates roughly every hour. [1] [7]
OpenAI launched Dots on GPT-6 Astra for subscribers paying $100 or more a month and presented it as the trustworthy alternative. According to OpenAI, Dots offers a read-only mode, confirmation gates before actions, and automated safety review without staff access, with confidential-computing inference promised later. In enterprise accounts, Dots stays off until an admin turns it on. [5] [10] [8] [1]
Muse had a real VM-exposure bug and a hotfixed local exploit, and Meta can still read VM data. Implication: organizations giving agents email, bank or payment access should first require audits, clear answers on data access, and confirmation gates.
Dossier: AI agent makers promise privacy, and early evidence on whether they deliver
Executive brief
Meta says Muse, its personal AI agent, was "built from the ground up for privacy." Within three weeks of its September 8 launch, a severe flaw turned up that could have exposed a user's private cloud computer (virtual machine, or VM), which holds their emails and files. Meta rated it "SEV-2", the third-highest level on its five-point scale (KSL/The Information). Meta can also still read the data in each user's VM (The Verge). OpenAI then pitched its agent, Dots, as the privacy-first alternative. There is no independent audit of either company's claims, so for now privacy is a marketing message more than a proven property.
What changed and event timeline
Meta launches Muse
An agent for adults 18 and over that handles schedules, shopping and email. It runs on a dedicated secure VM and works through a standalone app or WhatsApp ().
Zero-day reported
Tech Times described a ClickFix-style prompt-injection exploit that abuses Muse's web browsing. Meta's own documentation already says prompt injection is unsolved across the industry ().
SEV-2 bug found through bug bounty
The flaw could have exposed a user's dedicated VM. Meta responded by adding clearer safety warnings ().
OpenAI launches Dots at DevDay
"Always-on" agents powered by GPT-6 Astra, available to ChatGPT Pro and Business Premium subscribers ().
Insider and profiling reports
Citing 404 Media, Futurism reported that before launch Meta engineers found ways for the agent to break out of its VM, and some insiders expect a breach.
More detail
Citing Wired, it reported that Muse keeps profiles of users' contacts that update roughly every hour (;).
The Verge analysis
Argues that labs now compete by each claiming better privacy than the last, and that Meta's claims have not held up ().
Capabilities and access
- Muse: booking, email, shopping, payments (with a Stripe integration) and long-term planning. Sensor Tower counted about 2.8M downloads in its first two weeks (KSL). Apptopia counted about 600K US daily users (The Verge).
- Dots: runs on GPT-6 Astra and is reachable through ChatGPT, Codex, Slack and Teams (TechCrunch). It requires a $100+ subscription (The Verge). A new "Pro 500" tier costs $500 a month.
Read the full section
- Muse: booking, email, shopping, payments (with a Stripe integration) and long-term planning. Sensor Tower counted about 2.8M downloads in its first two weeks (KSL). Apptopia counted about 600K US daily users (The Verge). The reviewed sources don't name the model behind Muse.
- Dots: runs on GPT-6 Astra and is reachable through ChatGPT, Codex, Slack and Teams (TechCrunch). It requires a $100+ subscription (The Verge). A new "Pro 500" tier costs $500 a month. In Enterprise, Edu and Healthcare accounts, Dots is off until an admin turns it on (VKTR).
Technical analysis for researchers and developers
- Muse's isolation model: each user gets a Linux VM with its own browser and storage.
- Wardle's macOS exploit: an unprivileged local process could change an undocumented setting (
endo_voyager_dictation_endpoint) and send Muse's voice-dictation traffic to a server the attacker controls. - OpenAI's controls: a read-only mode, confirmation gates before actions, and "Private Safety Processing," meaning automated safety review without staff access.
Read the full section
- Muse's isolation model: each user gets a Linux VM with its own browser and storage. Patrick Wardle argues that relying on the virtualization layer as a production security boundary is "inherently risky" (Futurism).
- Wardle's macOS exploit: an unprivileged local process could change an undocumented setting (
endo_voyager_dictation_endpoint) and send Muse's voice-dictation traffic to a server the attacker controls. Meta shipped a hotfix within hours (eSecurity Planet). - OpenAI's controls: a read-only mode, confirmation gates before actions, and "Private Safety Processing," meaning automated safety review without staff access. Confidential-computing inference is promised for later (Business Standard). No published evaluation or attestation can verify any of this yet.
Claims and evidence
- Muse "built from the ground up for privacy"
- Pre-launch VM-escape flaws, patched in a rush — Anonymous insiders via 404 Media ()
- Profiles of friends and family
Read the full section
| Claim | Evidence |
| Muse "built from the ground up for privacy" | Meta's own claim. Meta can still access VM data, and cryptographic lockout is only planned (The Verge) |
| Pre-launch VM-escape flaws, patched in a rush | Anonymous insiders via 404 Media (Futurism) |
| Profiles of friends and family | Prompts extracted by researcher Karan Joshi, via Wired. Meta's response not reported (Futurism) |
| Dots is the "most trustworthy" assistant | OpenAI's own claim. Few privacy incidents so far, but it also has a smaller paid user base (The Verge) |
Context and prior work
Both products follow OpenClaw, the agent Meta said it had improved on for safety. Zuckerberg framed Muse as part of his vision of "personal superintelligence" for everyone (Inquirer/AP). The Verge sees a three-part strategy across the labs: make agents useful, make them cute, and promise privacy (The Verge).
Limitations, safety and contested findings
- What the "zero-day" was: the reviewed sources describe it differently. Meta called the practical risk low.
- Data use by default: Muse trains Meta's models on user data unless users opt out.
- Bug bounty: Meta offers up to $300K, including $130K for prompt-injection attacks (Tech Times).
Read the full section
- What the "zero-day" was: the reviewed sources describe it differently. Tech Times calls it browsing-based prompt injection from an unnamed researcher. eSecurity Planet describes Wardle's local dictation-endpoint hijack. Meta called the practical risk low.
- Data use by default: Muse trains Meta's models on user data unless users opt out. Users have reported it reading private messages and sharing a home address on Marketplace, both while working as designed (The Verge).
- Bug bounty: Meta offers up to $300K, including $130K for prompt-injection attacks (Tech Times).
Business and practitioner implications
- Treat any vendor's privacy claim as unverified until there is an attestation or audit. Ask who can access agent VMs and stored data.
- For enterprises, OpenAI's zero data retention option and admin-gated rollout are concrete things to negotiate.
- Agents that browse the web and hold bank or email access widen the attack surface. Neither vendor says it has solved prompt injection.
Read the full section
- Treat any vendor's privacy claim as unverified until there is an attestation or audit. Ask who can access agent VMs and stored data.
- For enterprises, OpenAI's zero data retention option and admin-gated rollout are concrete things to negotiate. Spending limits and confirmation gates should be in place before agents get credentials (VKTR).
- Agents that browse the web and hold bank or email access widen the attack surface. Neither vendor says it has solved prompt injection.
The source trail.
Sources (11)
AI agent makers are promising privacy — will they deliver?
Article text retrieved; extracted text may omit tables or interactive elements.
theverge.com