A vulnerability in Meta’s Muse permits access to users’ virtual machines and cloud-account data after users approve a security prompt.

The reported vulnerability affects the virtual environment associated with Meta’s AI product Muse. An external security researcher submitted it through Meta’s bug-bounty program, and the report says it had not previously been publicly disclosed. It permits access to a user’s dedicated virtual machine and personal cloud-account information, including emails and documents.

User authorization is an explicit prerequisite in Meta’s account. Exploitation requires the user to select “Allow” in a security prompt after Muse summarizes information or the user clicks a malicious webpage link. The source therefore does not describe an unconditional or zero-interaction compromise.

Meta revised its severity assessment and plans stronger warnings. A spokesperson said the issue was initially classified SEV-2—the second-highest level in Meta’s five-level incident-severity system—and later reassessed as SEV-3. Meta plans more prominent warnings when Muse detects an impending connection to a malicious website, but the report does not establish that a technical fix has been deployed or give a count of affected users.