A security researcher has publicly disclosed a zero-day vulnerability in Meta's Muse AI agent, which launched on September 8, 2026. The flaw could potentially allow malware to hijack the system and access user data. This incident follows a previous security issue with the predecessor, Muse Spark 1.1, identified during a July 2026 evaluation by the firm Irregular.
In response to earlier security concerns, Meta implemented a Secure Virtual Machine and the Sentinel approval process. Additionally, the company established a bug bounty program with rewards reaching $300,000 for critical findings, including $130,000 for prompt injection vulnerabilities. Meta previously published a security retrospective on August 14, 2026.
The Muse agent faces further operational challenges. On September 21, 2026, Amazon blocked the AI from performing shopping tasks on its platform, citing concerns regarding unauthorized access and insufficient identification mechanisms for the agent. The public disclosure of the zero-day vulnerability marks the second major setback for the project since its official launch.
