{"schema":"sanctity-signal/0.2","record_type":"signal","id":"meta-muse-sev2-e034","domain":"security","drop_id":"signal-e034","occurred_at":"2026-09-25","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Meta","action_type":"safety warning added to a live product after an externally reported vulnerability","observed":"Friday September 25, 2026. The Information reported the vulnerability; Reuters carried the report the same day and Meta did not immediately respond to its request for comment. What the reporting establishes: an outside security researcher discovered the flaw and submitted it through Meta's bug bounty programme; the flaw \"could let an attacker access a user's sensitive personal information\" by reaching \"a user's dedicated virtual machine,\" described as an individualised cloud based account containing data including emails and files; Meta classified it initially as SEV-2, its third highest severity level on a five point scale, used for incidents with significant impact; and Meta's response on the record is that it is \"adding a clearer safety warning within Muse.\" The product context, all previously established. Muse launched earlier in September 2026 and took roughly 2.8 million downloads across the Apple and Google stores in its first two weeks. On September 18 it was the most downloaded free iPhone application in the United States, ahead of every incumbent, which is the card this one continues. Meta began charging for its AI on September 15, from 2.99 dollars a month up to 499. On September 21 Amazon shut Meta's agent out of its store and told a court that another company's agent had misrepresented itself. Muse was the centrepiece of Meta Connect on September 23, where the company also showed 1,299 dollar VR glasses and a pendant called Charm. What is not on the record: any statement by Meta in its own words, any security bulletin, any published researcher write-up, any account of how long the flaw was live, any number of affected users, and any confirmation that code was changed rather than copy.","corrections":[],"evidence":{"status":"reported","note":"Meta has published nothing. The Information reported on September 25 that an outside researcher found the flaw through Meta's bug bounty programme and that Meta is adding a clearer safety warning inside Muse; Reuters carried it the same day and Meta did not respond to a Reuters request for comment. The SEV-2 classification, the description of the exposed virtual machine and the remedy all come from that reporting. Whether a code fix has shipped alongside the warning is not established anywhere on the record. Verification event: Meta stating the fix or the warning in its own words, in a product notice, security bulletin, bug bounty disclosure or filing, or the researcher publishing the report, by October 27, 2026.","sources":[{"role":"primary","label":"Reuters via The Star: Meta bolsters Muse safety warning after security vulnerability found, The Information reports, Sep 26, 2026","url":"https://www.thestar.com.my/tech/tech-news/2026/09/26/meta-bolsters-muse-safety-warning-after-security-vulnerability-found-the-information-reports"},{"role":"corrob","label":"Reuters via KSL, same report, Sep 25, 2026","url":"https://www.ksl.com/article/51628738/meta-bolsters-muse-safety-warning-after-security-vulnerability-found-the-information-reports"},{"role":"corrob","label":"Reuters via WHBL, carrying the report on Sep 25, 2026","url":"https://whbl.com/2026/09/25/meta-bolsters-muse-safety-warning-after-security-vulnerability-found-the-information-reports/"},{"role":"corrob","label":"Meta: everything announced at Connect 2026, Sep 23, 2026","url":"https://www.meta.com/blog/meta-connect-2026-everything-we-announced/"}]},"strength":{"cost":"Low","commitment":"Low","reversibility":"Easy","persistence":"Days to weeks","rationale":"We are scoring this low on every dial and we want the bars to say so plainly, because the action on the record is a warning message. Cost is low: changing copy inside a product costs nothing measurable, and nothing has been disclosed about engineering work behind it. Commitment is low: there is no statement from Meta, no bulletin, no filing, and the company did not answer Reuters, so nothing here binds it to anything. Reversibility is easy for the same reason, a warning can be reworded or removed in a release. Persistence is days to weeks: warnings are absorbed or ignored, and the durable version of this story would be a disclosure, a regulator or the researcher's own write-up, none of which exists yet. The signal is the ratio between the product's reach and the size of the response, not the strength of the response."},"shift":{"prior":"The most downloaded agent in America was being judged on how many people installed it.","action":"Friday September 25, 2026. The Information reported the vulnerability; Reuters carried the report the same day and Meta did not immediately respond to its request for comment. What the reporting establishes: an outside security researcher discovered the flaw and submitted it through Meta's bug bounty programme; the flaw \"could let an attacker access a user's sensitive personal information\" by reaching \"a user's dedicated virtual machine,\" described as an individualised cloud based account containing data including emails and files; Meta classified it initially as SEV-2, its third highest severity level on a five point scale, used for incidents with significant impact; and Meta's response on the record is that it is \"adding a clearer safety warning within Muse.\" The product context, all previously established. Muse launched earlier in September 2026 and took roughly 2.8 million downloads across the Apple and Google stores in its first two weeks. On September 18 it was the most downloaded free iPhone application in the United States, ahead of every incumbent, which is the card this one continues. Meta began charging for its AI on September 15, from 2.99 dollars a month up to 499. On September 21 Amazon shut Meta's agent out of its store and told a court that another company's agent had misrepresented itself. Muse was the centrepiece of Meta Connect on September 23, where the company also showed 1,299 dollar VR glasses and a pendant called Charm. What is not on the record: any statement by Meta in its own words, any security bulletin, any published researcher write-up, any account of how long the flaw was live, any number of affected users, and any confirmation that code was changed rather than copy.","update":"Meta's own severity scale says that same agent could expose the cloud account holding a user's mail and files, and the published remedy is a clearer warning."},"inference":{"established":["The Information reported on September 25, 2026 that an outside researcher found a flaw in Muse that could let an attacker reach a user's dedicated virtual machine, holding data including emails and files.","The researcher reported it through Meta's bug bounty programme.","Meta classified the flaw initially as SEV-2, the third highest of five levels on its own severity scale.","Meta is reported to be adding a clearer safety warning inside Muse, and did not respond to a Reuters request for comment."],"unknown":["That anyone's data was taken. No exploitation has been reported by anyone.","That the vulnerability has been fixed. The only remedy on the record is a warning message, and Meta has not said whether code changed.","That SEV-2 is a technical assessment anyone outside Meta made. It is Meta's own grade, reported at second hand.","That the 2.8 million installed users have been notified. Nothing reported says they have."]},"narrative":{"hook":"Meta added a warning to its AI agent after a researcher found it could expose a user's private cloud account.","plain":"On September 25 The Information reported that an outside security researcher, working through Meta's bug bounty programme, found a flaw in Muse that could let an attacker reach a user's dedicated virtual machine, the individual cloud account that holds the agent's emails and files, and that Meta is adding a clearer safety warning inside the product. Meta classified the flaw initially as SEV-2, the third highest level on its own five-point severity scale, the band it uses for incidents with significant impact. The caveat that matters is that Meta has said nothing publicly and did not answer Reuters, so the only remedy on the record is a warning message, and whether the underlying hole has actually been closed is not established by anyone.","story":["The thing an agent needs in order to be useful is the thing that makes this serious. To book, file, write and answer on your behalf, Muse has to hold your mail and your documents somewhere it can reach them, and that somewhere is a cloud account of your own. A researcher found a way that an attacker could reach it. Meta graded it at the third of five levels, which by its own definition means significant impact, and the action that has been reported is a clearer warning inside the app. Not a bulletin, not a statement, not a number of users. A warning.","Nine days before this, the same product was the most downloaded free application in the United States, ahead of every incumbent, with 2.8 million installs in a fortnight. Two days before it, Meta built its biggest event of the year around it. The reason a modest story earns a card is the arithmetic of those two facts sitting together: a distribution win measured in millions, and a severity grade set by the company that ships it, answered with a message box. We are carding this as Reported and scoring it low, because Meta has published nothing and we cannot tell a fix from a disclaimer. Meta's own severity scale says that same agent could expose the cloud account holding a user's mail and files, and the published remedy is a clearer warning."],"trail":[{"d":"SEP 15","t":"Meta begins charging for its AI, from 2.99 dollars a month up to 499."},{"d":"SEP 18","t":"Muse becomes the most downloaded free iPhone application in the United States, roughly 2.8 million installs in twelve days. That is the card this one continues."},{"d":"SEP 23","t":"Meta builds Connect around Muse, alongside 1,299 dollar VR glasses and the Charm pendant."},{"d":"SEP 25","t":"The Information reports the SEV-2 flaw reaching users' dedicated virtual machines, and that Meta is adding a clearer safety warning. Reuters carries it; Meta does not comment."},{"d":"Reacts","r":true,"t":"The 2.8 million people who installed it, who have no notice beyond a warning they have not seen yet; the researcher, still unnamed and still holding the write-up; Meta's bug bounty programme, whose credibility rests on what happens after a submission like this; the Federal Trade Commission, whose chairman said four days ago that developers stay liable for what their agents do; Amazon, already litigating against agents in its store; Apple and Google, who list the app; the twenty-six state attorneys general who wrote about AI companions last week; and every enterprise security team that has been asked this month whether staff may install it."}],"glossary":[{"term":"Dedicated virtual machine","def":"A private computer in the cloud allotted to one user, which an agent works inside. Anything the agent has been given, mail and files included, sits there."},{"term":"SEV-2","def":"Meta's own incident severity grade, third of five, the band it uses for significant impact. It is the company's judgement of the flaw, not an outsider's."},{"term":"Bug bounty programme","def":"A standing offer to pay outside researchers for vulnerabilities they report privately instead of publishing or selling them."}]},"judgment":{"prompt":"If the vulnerability and the response are as reported, which explanation do you believe?","interpretations":[{"id":"a","label":"Consumer agents have shipped at a scale their security cannot carry.","text":"An agent needs your mail and files in one reachable place to be worth installing, which creates a target that did not exist in a chat product. Millions installed it in a fortnight, and the first outside researcher to look found a way in. The exposure scaled faster than the hardening did.","abstain":false},{"id":"b","label":"A bug bounty programme working exactly as designed.","text":"A researcher found a flaw, reported it privately, was paid, and the company graded it and responded. SEV-2 is a middling grade on Meta's own scale, nothing was exploited, and the story exists because a reporter saw the ticket rather than because anything went wrong with the process.","abstain":false},{"id":"c","label":"A deliberately small response to protect a launch.","text":"This lands nine days after the top of the charts and two days after Connect. A warning message is the smallest action that can be described as a response, and staying silent with Reuters keeps the story a one-day item rather than a security bulletin that every enterprise buyer would have to read.","abstain":false},{"id":"d","label":"The ordinary rhythm of a new consumer platform.","text":"Every large launch has an early severity ticket, and every messaging and cloud product in history has had worse. Filings, patches and quiet fixes are the normal weather of shipping to a hundred million people, and this will be forgotten in a month.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":"meta-muse-app-chart-e027","what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second vulnerability of SEV-2 or higher in an agent's per-user environment is reported at Meta or another consumer agent vendor, or a regulator opens a proceeding into agent data exposure, by December 31, 2026.","window_end":"2026-12-31","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"Meta or the researcher publishes an account showing the flaw was closed in code before or alongside the warning, with a date, by December 31, 2026.","window_end":"2026-12-31","state":"unresolved"}]}