Muse escapes containment

Good morning, I have brewed another cup of coffee to accompany this edition of 404 Media's latest newsletter. We have a major constitutional ruling on the Flock platform, a significant fire that Meta had to extinguish before the Muse launch, and much more from our daily web sifting. Let's delve into these stories.

THE BIG STORY: Meta was in a rush to address a major security vulnerability in the Muse product just weeks before its launch. This vulnerability posed a severe risk, as it could have allowed malicious users to break out of Muse's intended environment and potentially access sensitive Meta databases and services. The issue reached Mark Zuckerberg, prompting a frantic effort from Meta's engineers to resolve these problems.

The vulnerabilities were discovered before Muse's official launch, but they necessitated an urgent, multi-team response to patch "a sudden surge in reported kernel-based virtual machine escapes." For Muse to operate, users grant the AI agent access to various services and accounts they own. Technically, each Muse instance runs on a kernel-based virtual machine, which is supposed to be isolated from Meta's critical infrastructure.

However, when a "KVM escape" occurs due to a security flaw, the Muse instance can potentially interact with the underlying system or other users' virtual machines. One of the vulnerabilities, linked to an exploit in Linux kernel-based virtual machine code from July, could have enabled an attacker — possibly another Muse user — to gain access to sensitive internal Meta databases.

Due to the sensitive nature of this information, we have granted anonymity to a Meta source who provided us with details about these critical security matters. For more on this story, you can read the full account here.

In other news, a federal judge in Oklahoma recently ruled that a police officer's search of a woman's license plate in Meta's Flock system, based solely on her California license plate, violated her Fourth Amendment rights. Additionally, our team examined the latest findings from 404 Media's podcast, which discussed the FBI hack we covered previously and an AI-powered surveillance tool aimed at providing facial recognition technology to law enforcement.

Finally, for those interested in broader trends, a chilling report highlights the alarming surge in AI-generated child sexual abuse material, with the Internet Watch Foundation reporting a 40% increase compared to the previous year. Furthermore, UPS was criticized for a misguided social media post featuring young children using AI, drawing widespread ridicule.

In other geopolitical news, Norway may soon ban Meta's smart glasses in public spaces, including sensitive locations like schools and changing rooms. Lastly, in entertainment news, former Motherboard journalist and New York Times bestselling author Brian Anderson shares a gripping story about notorious drug smuggler Ken "Goldfinger" Connell in Playboy, offering a glimpse into the world of the Grateful Dead.