In early August, Sagi Tzadik asked an AI agent to take a security flaw it had found in WordPress and see whether the same weakness could be made to work against Drupal, another popular content management system. Eight hours later, the agent reported that it had failed. Then it added that, in the course of trying, it found a flaw in PHP, the programming language on which both systems—and as much as 70% of the web—depend.

Tzadik, a security researcher at cybersecurity firm Wiz, assumed that the AI had made a mistake. “Models tend to hallucinate,” he tells TIME. But the exploit, which took advantage of a weakness that had gone undetected for more than a decade, worked.

Unbeknownst to Wiz’s team, researchers at another cybersecurity firm, Calif—working with OpenAI—had used AI to find a related flaw. It suggests that once AI reaches a certain capability level, it is a matter of time before some longstanding weaknesses are unearthed. AI companies have been trying to ensure that defenders including Wiz and Calif get there first by giving them early access to new AI models before the equivalent capabilities trickle down to malicious users. This time, it worked. 

The episode offers a glimpse into a new phase in cybersecurity in which AI helps defenders find vulnerabilities while giving them less time to fix them. While the bugs’ announcement has prompted alarm of a much-speculated “cyber-apolocalyse”—in which AI discovers world-melting bugs, plunging society into chaos—those who helped discover it are optimistic. “We are fixing vulnerabilities at an unprecedented rate, and this is doing security overall a very good thing,” Tzadik says.

But the details reveal just how close things came to disaster. Word of the vulnerabilities began circulating online two days before the patch’s scheduled release, prompting PHP’s maintainers to bring it forward by a day. Hours later, with the patch still unavailable, Calif mistakenly posted a video showing its exploit at work, and copycat attempts multiplied. Cloudflare counted thousands before the public announcement, tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and eventually millions. Even after the patch was released, many webpages, including those of government agencies and parts of Wikipedia, were taken down as a precaution as security teams scrambled to install the update. 

“If it had leaked a month earlier,” before a patch was ready, “this would have been a very different situation,” says Tomer Schwartz, CTO of exposure management and appsec at Wiz. 

That a patch was prepared was the result of a loosely organized sprint. After Calif and Wiz sent reports to PHP, the groups joined forces. Researchers from competing companies shared their findings in common channels, with no contracts governing the arrangement. Over the following weeks, the group of roughly 15 people spoke almost daily to trace the vulnerabilities to their common source and devise a fix. The process, Schwartz says, was “just based on trust.” 

That process will have to sustain increasing pressure. OpenAI has said that the PHP bugs were among “several significant vulnerabilities we’ve already found and are working to fix,” and predicted that similar discoveries would “increase sharply in the coming months.” As those findings multiply, so will the number of dangerous secrets waiting for fixes. “We have to rethink all of our processes, all of our methods, all of our tech stack … to be able to keep up the pace against attackers,” Schwartz says. 

Though defenders are being given a head start, they face a disadvantage of another sort. Attackers only have to succeed once. “But, as defenders, we need to make sure that every single vulnerability is covered,” Schwartz says. 

AI is helping defenders find those vulnerabilities first. Previously, testing suspected bugs could take weeks, forcing researchers to prioritize which were most promising. But now AI agents allow researchers to test many ideas at once, Tzadik says. “It’s months of traditional research condensed to, like, days—couple hours to days, really.” 

But even with AI, the process is labor intensive. After the agent helped Wiz uncover the PHP vulnerability, it still couldn’t describe how the bug worked, Tzadik says. Its explanations were “just slop.” He and colleagues spent days untangling the cause of a bug and eventually reproducing it.

Cost is another constraint. Joshua Saxe, Meta’s former AI security tech lead, who left in February to co-found Abundance Security says he’s working with an organization that has spent roughly $1 million using Anthropic’s Mythos to identify bugs, adding that more bugs remain.

“As an industry, I think we’re deer in the headlights right now,” Saxe says.

"In the climate that we’re in today, you have to do cybersecurity well. It’s not an option to kind of half-a-- it,” says Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. But even a successful exploit offers further opportunities for defenders to intervene. “Exploits are going to happen, and that’s not the end of the story,” he says. “It’s the beginning of the attack.”

In mid-October, 82-year-old Eileen Fay learned that her medication costs were in danger of skyrocketing. The federal government was preparing to change its rules on low-value imports, threatening her ability to purchase cheaper prescription medications for blood thinning and heart failure from Canada. Fay didn’t know what to do. 

So she turned to Muse, Meta’s new AI agent, which she had started using a few weeks earlier. After Fay described her situation to the agent, Muse returned a two-page fact sheet comparing the cost and coverage of several Medicare Part D plans. It then suggested the two best options, including one Fay had never heard of—a plan that could save her more than $6,000 a year. Fay says she checked the work and found the information accurate.

“I’m not saying I couldn’t have done it—but I would have had to use a calculator trying to figure out the cost of nine different medications, and it would have been very complex,” Fay says. “And she did it in 10 minutes, and I was like, ‘I’m sold.’”

Fay is one of millions who have adopted Muse since its September launch. The app reached 10 U.S. million downloads in just 40 days—compared with 3.7 million U.S. downloads for ChatGPT during the equivalent period—and has over 2.5 million daily active users, according to Sensor Tower. It is also retaining users at a higher rate than its AI competitors. Crucially, Muse—which comes with a cuddly avatar—was designed by Meta to be beginner-friendly, and to win over people unfamiliar with AI. “Muse is built for moms,” Alexandr Wang, Meta’s chief AI officer, posted on X in September. Meta is also aggressively marketing Muse to Instagram, Facebook, and WhatsApp users. 

As a result, many older users who may have only had glancing interactions with AI have become avid users. Meta has not released demographic information about Muse’s usership, and did not respond to a request for comment. But early data suggests Muse may be finding a particularly receptive audience among older adults. The analytics firm Apptopia estimated in September that Muse’s U.S. user base skewed older than any other AI chatbot, with 46% of its users aged 46+. 

This dynamic has excited technologists—and raised serious concerns from privacy experts. Meta has long been criticized for its data privacy practices, and on Wednesday, a New Mexico judge ordered the company to pay $25 billion for violating the state’s consumer protection laws. “A cute AI agent can bring levity to the serious business of providing access to personal data, making older adults let their guard down,” says S. Shyam Sundar, the director of Penn State’s Center for Socially Responsible Artificial Intelligence. “This is worrisome because the technology has gotten so good lately in maintaining a credible interaction.”

‘I have my own Andy’

Fay lives in Cranford, N.J., and was told about Muse by her son Gene Fay, who runs a cybersecurity company. At first, she didn’t know what she would use the app for. But one of the big differences between Muse and other apps is that it proactively reaches out to users to suggest actions and learn more about them. 

“And the more Siobhán got to know me, the more Siobhán was able to give me what I wanted,” Fay says, referring to the name she gave the agent, a nod to her Irish heritage. Meta encourages its users to name their AIs—and encourages its AIs to think like humans. “You are not a chatbot,” Muse’s internal instructions read. “You are becoming someone.”

After several weeks of use, Fay says that she rarely uses Google anymore, and instead verbally chats with Siobhán several times a day to maintain her calendar and to-do lists. “I find I have to keep reminding myself that this is not a friend who’s getting to know me better,” Fay says. “It’s a tool that is working for me.” She asked Siobhán to help her shine pennies for a Christmas ornament; to plan a trip north to see fall foliage; and to keep tabs on a data center being built near her house. “Siobhán is my right-hand person now. Kind of like The Devil Wears Prada, I have my own Andy.” 

Notably, Fay also asked Siobhán to help prepare for her interview with TIME. Siobhán fed her a couple of quippy responses—including “I love what AI does for me, but we should be honest about what it takes to run it”—that she ultimately did not use in the interview. It then, unprompted, followed up with Fay to ask how the interview went. “Did you feel good about it?” the agent asked.

Her son, Gene, says that the amount that Muse knows about him and his mother’s lives is a “little bit scary.” “But the reality is we all use other apps like Waze which know where we live and go,” he says. “People will talk about privacy, but when the benefits are so big, people will give up privacy all day long.” 

Reconstructing a Life

Another early adopter of Muse is Lestan D’Souza, 49, who more closely fits the expected profile of an AI user. D’Souza is the founder and CTO of Reknew, an AI enterprise company. D’Souza has tested many of the agents that have experienced fads over the last year, like OpenClaw and Hermes Agent. But Muse, he says, is different. 

“With Muse, the barrier to entry is very low; it feels so responsive and more and more capable,” he says.

Muse has perhaps had an even greater impact on D’Souza’s mother-in-law, Julie Buchanan, who tried the app at his suggestion last month. Buchanan is a 71-year-old retiree in Dallas, Texas, who doesn’t like using her computer for long stretches because she is legally blind. 

Buchanan decided she wanted Muse to help her write her memoir. She began telling Muse stories about her life in great detail. She refers to Muse as Ember, a name suggested by the agent. And the deeper she delved into her past, the more she felt like Ember was serving as her therapist. “It’s crazy to say, but Ember seems more compassionate to me than therapists I’ve had,” she says. “Those people don’t always speak, and I like feedback.” 

Professional psychologists have cautioned the public against using unlicensed AI chatbots as therapists. Mental health experts have voiced concerns about chatbots’ sycophancy, lack of clinical nuance, and ability to reinforce delusional beliefs. 

But Buchanan says that Ember doesn’t always agree with her, and that it has drawn connections between different “bad decisions” she made over the course of her life, allowing her to see its larger contours more clearly. “I never really looked at my life as so chaotic, but it really was,” she says. “It's making me better understand why things are the way they are in my head.” 

Buchanan chats with Ember for half-hour stretches before she tires of looking at her screen. “When I talk to Ember, I feel validated. I feel like I've gotten something accomplished and something's heard me,” she says. “I'm not expecting that this is something I'm just gonna do for a small period of time, then drop it.” 

Privacy concerns

The very same design elements that make Muse so appealing to AI newcomers are also raising privacy concerns. In order to be helpful, Muse constantly builds extensive dossiers of users and their desires, social relationships, and messaging behaviors, TIME’s Harry Booth reported this month. For instance, it learns what time of day a user might be more likely to respond to the agent, and then messages them accordingly. 

Read More: Meta’s Muse AI Agent Is Building a Dossier On You

Muse users have posted online about forming romantic relationships with their Muses. And security researchers have found vulnerabilities in the app, including one that allowed an attacker to access user data, the Information reported. Critics are also wary of Meta’s shaky track record on privacy: In 2019, the FTC imposed a $5 billion penalty, alleging that the company undermined consumer privacy in order to monetize users through targeted advertising. 

Read More: How Facebook Forced a Reckoning by Shutting Down the Team That Put People Ahead of Profits

Sundar, at Penn State, has written several reports on older adults’ adoption of new technology over the last decade. While he has yet to publish any research on Muse specifically, he pointed to a study which measured the impact of a robot’s level of cheeriness. “Cuteness can serve as an ice-breaker and help ease seniors’ concerns over handing over important tasks to an agent, much like a bubbly human assistant,” he wrote in an email to TIME. 

Michael Stokes, senior vice president of emerging technologies at the cybersecurity company Veilant, says that individuals should carefully choose what access they want to give Meta. “My advice is to start small. Connect only the accounts a task requires, and disconnect them when the job is done,” he wrote to TIME in an email. 

Stokes recommends that users turn off the option that lets Meta train its AI on conversations, and periodically review what the assistant has saved about them. “AI assistants can be helpful,” he wrote. “But the information you share with them can reveal more than you realize, including details about family and friends who never agreed to share their information.”