Meta built a copy of OpenClaw, then got hacked through it
Issue #043 · 4 min read
Meta built a copy of OpenClaw, then got hacked through it
Muse's zero-day, a three-way model price war, and why GitHub just buried RSA SSH keys
The big story
Meta's AI agent Muse had a bad week, and it got worse in a specific order.
First, Meta admitted Muse's likeness to OpenClaw isn't a coincidence. Meta says Muse was built from scratch. But it also acknowledged Muse was "heavily inspired" by OpenClaw, right down to some of its workspace filenames and content — that's TechCrunch.
Then someone found a hole in it and used it to take control of the agent.
Meta has now patched the exploit, a zero-day meaning a flaw nobody had a fix for when it was found and used. The bug let an attacker steer Muse itself, not just trick it with a bad prompt.
Zoom out and this is the same shape as every AI agent security story this year: a fast-moving assistant gets access to real systems, and the security work trails behind the ship date. MIT Technology Review's read on the summer lines this up with the OpenAI–Hugging Face incident and disclosures from Anthropic and Meta — a pattern, not a one-off.
For product managers, the lesson isn't "don't ship agents." It's that if your agent can touch a filesystem, an inbox, or another company's data, the security review needs to happen before launch, not after someone finds the gap for you.
What shipped
OpenAI released two new models, GPT-6 Sol and GPT-6 Luna, and the pitch is the same one everyone's making this month: more capability, less money. Sol and Luna join GPT-6 Astra as cheaper, faster options, and they're already showing up everywhere — GitHub Copilot, Vercel's AI Gateway, and alongside Anthropic's simultaneous Claude Opus 5.5 launch. Ars Technica calls this the frontier model race entering "comparison shopping" mode — worth reading if you're the one who has to justify next quarter's model spend to finance.
OpenAI also shipped better prompt caching for GPT-6, adding higher cache hit rates, new diagnostics, and explicit breakpoints you control directly. If your product calls the API repeatedly with similar context — a support bot, a coding assistant, anything with a system prompt that barely changes — this is a real cost lever, not a nice-to-have.
GitHub quietly tightened SSH security, removing several older algorithms and requiring larger RSA keys. It's infrastructure housekeeping, not a feature, but if your team still has old RSA keys configured for repo access, they'll stop working. Worth a five-minute check before it breaks someone's Friday deploy.
What I'd actually do this week
Ask your security team, not just your eng lead, whether any agent you've shipped has been red-teamed for exactly this: someone hijacking the agent itself, not just prompting it badly. Muse and the Hugging Face incident both started with an agent that had system-level trust.
If you're running GPT-6 in production, check whether Sol or Luna covers your use case at lower cost before your next renewal conversation. The model war means yesterday's pricing is already stale.
Audit your CI and deploy pipelines for old RSA SSH keys before GitHub's changes catch you off guard.
Reply and tell me what broke, or what you shipped instead — I read every one.
Tools mentioned
- GPT-6 Sol and Luna
- Better prompt caching for GPT-6
- Security improvements for SSH
- GPT-6 Sol and Luna on AI Gateway
- GPT-6 Sol and Luna in GitHub Copilot