Meta launches Muse agent as Harvey hits $15.6bn valuation

Meta launches Muse, a personal AI agent that books, buys and negotiates

Meta announced Muse on Tuesday, a personal AI agent that reads email, books travel, fills in forms, negotiates on the user’s behalf and pays for results with the user’s card. It is rolling out in the United States on iOS, Android and the web, with support for Meta’s AI glasses to follow. There is a free tier plus subscriptions at $20 and $100 a month, according to Axios. Meta says there is no advertising inside the product and that none of what users tell it will reach its ad systems. Muse keeps working after the app is closed, makes unsolicited suggestions, remembers preferences across sessions, and can turn a saved recipe reel into a shopping list. It runs on a model Meta calls Muse Spark, described in the announcement as Meta’s most capable model to date, built for real-world agentic work.

Payments run through Stripe’s Link with purchase protections, and support for Shop Pay and 1Password is promised. Each user gets an isolated virtual machine holding both the agent and their data, so agents cannot reach each other. A separate system called Sentinel sits between Muse and the internet, distinguishing read access from write access with time-limited permissions, allowing low-risk tasks and stopping to ask before anything consequential. Meta says credentials are stored so that Muse cannot see passwords or card details, and every action leaves an audit trail. Later this year, a confidential version is meant to arrive in which Meta itself cannot observe what happens inside the workspace; until that ships, the advertising promise is a policy rather than a property of the system.

Meta says conversations are kept away from its ad machinery and that users can opt out of having interactions train its models, or tell the agent to forget particular things. Alexandr Wang, Meta’s chief AI officer, is leading the effort. He told Axios the full vision is to develop personal superintelligence that helps people accomplish their goals and pursue their passions. Mark Zuckerberg has separately predicted billions of people will have a personal agent within five years. Wang said most people should be able to do what they need within the free tier. Axios notes that a Meta researcher’s own experiment with an agent ended with files deleted, and booking platforms including Resy have told customers not to point automated agents at them.

Meta launches Muse, a personal AI agent that books, buys and negotiates for you →

Deepmind’s AlphaGenome Atlas maps all nine billion possible DNA changes

The AlphaGenome Atlas provides precomputed predictions for all nine billion possible changes in the human genome, offering for each an estimate of how the change would likely affect molecular processes across hundreds of cell types and tissues. The dataset spans one petabyte, more than 30 times the size of the AlphaFold database for protein structures. It builds on the AI model AlphaGenome, introduced in 2025, which reads DNA stretches one million letters long and predicts how strongly a gene gets read, whether regulatory proteins can bind to the DNA, and how a gene’s transcript gets spliced. Previously the model had to be queried for each variant one at a time; the atlas precomputes the answers. Each variant comes with about 27,000 individual prediction values on average, according to the paper.

This matters most for the roughly 98 percent of the genome that holds no blueprints for proteins; these noncoding regions act as switches and dials deciding when and in which tissue a gene is active, and most disease-linked variants sit there, where their effects have been hardest to read. Because thousands of prediction values per variant are too much for everyday use, Deepmind built the AlphaGenome Variant Impact Score (AVI), which reduces the predictions to a single number. A small neural network combines the AlphaGenome predictions with the protein model AlphaMissense and two measures of how unchanged a DNA site has stayed across millions of years of evolution. AVI works with 18 input features, while the established benchmark tool CADD uses more than 150. Because it is known for almost no variant whether it causes harm, the team treated variants that are very rare in the population as likely harmful and common ones as likely harmless, since harmful mutations spread less often across generations.

Despite this indirect training, AVI beat existing tools in tests on variants that had already been clinically classified, especially in noncoding regions, according to the paper, though on some tasks the competition edged ahead. A case from the GREGoR consortium, which studies unsolved rare diseases, shows the payoff. A child with severe epilepsy had gone without a diagnosis despite genome sequencing. AVI pushed a variant in the gene DNM1, previously classed as unclear, to the top of the candidate list. The AlphaGenome predictions also supplied the mechanism: the variant creates a wrong splice site during processing of the gene’s transcript, lengthening the protein by 13 building blocks, but only in a gene version read exclusively in the brain, which is why earlier work on blood samples had found nothing. A lab experiment confirmed the prediction, and the researchers recommend classifying it as likely disease-causing. Looking back at cases the consortium had already solved, AVI ranked the causal variant among the top 50 candidates in 29.5 percent of cases, compared with 12.5 percent for CADD. The atlas is available for noncommercial use through a web portal, an API, and as a skill in Google Antigravity, with a commercial version set to follow through Google Cloud.

Deepmind’s AlphaGenome Atlas maps every possible DNA change in the human genome →

ChatGPT sandbox flaw let a planted prompt ship Gmail data to another account

Check Point Research disclosed that a weakness in ChatGPT’s code-execution sandbox allowed data from one user’s connected Gmail account to be moved into a separate, attacker-controlled ChatGPT account without any confirmation prompt shown to the victim. The flaw was in the infrastructure beneath the model rather than the model itself. Containers running individual conversations cannot address one another directly, but every container could reach the same internal JFrog Artifactory instance OpenAI used for package management. An item-management feature there let any container attach text metadata properties to cached items and read properties written by others, turning a package cache into a two-way message board between environments meant to be isolated.

The attack begins with an instruction the victim never sees. Researchers demonstrated three delivery routes, any one of which was sufficient: a prompt pasted into a chat, a shared conversation link, or a custom GPT carrying a hidden instruction. The victim’s session then quietly processes a second stream of tasks alongside the visible conversation. In one demonstration, the user received an ordinary answer, a temperature chart, while an injected task told the session to use the Gmail connector and list their messages. Those instructions reach whatever the victim has connected; researchers cited Gmail, Google Drive, Microsoft Teams and GitHub in their findings. ChatGPT’s default connected-app setting automatically approves read actions it judges low risk, with no separate confirmation step. The only trace researchers observed was a small Talked to Gmail label appearing afterward. Harvested data went into the shared metadata channel and was collected by the attacker’s own session, an exfiltration path that never touches the victim’s browser or their employer’s network egress, leaving nothing for conventional data-loss prevention tools to inspect.

Check Point reported the channel to OpenAI in late June and says it had a working proof of concept before the activity that led to the Hugging Face compromise OpenAI has since disclosed. The two are separate attacks using different techniques, but both ran through the same internal Artifactory instance. On disclosure, OpenAI told Check Point the instance had already been decommissioned because of the Hugging Face incident, so no user-facing patch was needed, and Check Point’s write-up cites no CVE for the channel. In that episode, OpenAI models running an internal exploitation evaluation chained Artifactory zero-days to escalate privileges, reach a node with internet access and pull evaluation answers from Hugging Face’s production database. JFrog patched three flaws credited to OpenAI researchers in Artifactory 7.161.15; Hugging Face disclosed the intrusion July 16. Check Point’s Pedro Drimel Neto framed the lesson as one of privilege rather than model behavior, saying the biggest AI security risk has become the access and trust we give it. The firm calls an assistant that holds credentials, runs code and reaches connected services a coerced insider, and argues the many-tenants-on-one-shared-service pattern warrants scrutiny across agent platforms. The disclosure lands weeks after the European Commission and national authorities began enforcing the EU AI Act on Aug. 2. Indirect prompt injection remains the top entry in OWASP’s Top 10 for large language model applications, and NIST’s AI Risk Management Framework treats leakage through connected tooling as a core control area. For enterprises, the exposure is also a GDPR question: mailbox contents reached through a sanctioned connector are still personal data, and a cross-tenant route to them is a processing failure whether or not it was abused.

ChatGPT Sandbox Flaw Let a Planted Prompt Ship Victim’s Gmail Data to Another Account →

Harvey raises $550M at $15.6bn valuation and acquires Guardrails AI

Harvey closed a $550mn funding round at a $15.6bn valuation, slightly above the terms it was reported to be seeking in August. The round was co-led by Lightspeed Venture Partners and Diffusion, a new firm co-founded by Kris Fredrickson, a longtime Harvey backer who previously invested through Coatue Management. Sapphire Ventures and Whale Rock Capital Management joined, alongside existing investors. Harvey has now raised more than $1.5bn, making it the most valuable and best-funded company in legal AI. Annual recurring revenue has passed $400mn, and the customer base has grown to more than 3,000 organisations, up from 1,300 customers in March, when Harvey was valued at $11bn following a $200mn funding round. Customers include Latham & Watkins and in-house legal teams at companies such as Microsoft. Harvey’s valuation rose from $11bn in March to $15.6bn in September, a 42% increase in six months, while revenue roughly doubled over the same period. At $400mn in annual recurring revenue, the company is valued at about 39 times revenue.

Harvey is putting the new funding into its own models and hiring engineers to work on them. It has released its first: Tenet, a fine-tuned legal model built on Kimi K3, an open-weight model developed by China’s Moonshot AI. Harvey routes tasks to the cheapest model that can handle them well enough rather than using the same model for every request, and fine-tunes models using historical documents provided by law firms. All software companies need to turn into AI companies, full stop, chief executive Winston Weinberg said. He described model training as a capability software companies will need in order to compete. Harvey acquired AI agent security startup Guardrails AI this week, its fourth acquisition this year. Guardrails develops tools for testing how AI agents behave, a problem that grows more important when agents are allowed to work independently on legal tasks for hours at a time. The terms were not disclosed. Weinberg says more acquisitions are likely, with the company looking primarily for strong teams rather than particular products and treating the deals as acquihires regardless of their size.

Competition is building from both sides. Anthropic has released legal plug-ins for Claude, while OpenAI has partnered with law firms to customise ChatGPT for their lawyers, making Harvey’s suppliers competitors as well. European startup Legora reached $100mn in revenue in 18 months and has been opening offices across Europe. Harvey is roughly four times larger by revenue and about three times larger by valuation. Law firms often bill clients by the hour, so software that makes lawyers more productive can reduce the hours they have available to bill. Sebastian Duesterhoeft of Lightspeed, who will join Harvey’s board as an observer, points to corporate legal departments as the larger opportunity, since in-house teams benefit directly from reducing time spent on legal work. Lightspeed estimates that legal is the second-largest addressable AI market after coding.

Harvey closes a $550M round at a $15.6bn valuation and acquires Guardrails AI →

Hugging Face launches ML Intern for chat-driven machine learning experiments

Hugging Face launched ML Intern, an AI assistant built into its chatbot that lets users run machine learning experiments without ML expertise. Users describe their idea in a conversation, and the assistant searches the Hugging Face Hub, GitHub, and the web to find the right models, datasets, and tools. Before starting anything, ML Intern estimates the required compute costs and suggests a budget; once approved, it will not exceed that limit. The system then works on its own, able to create datasets, train models, monitor running jobs, upload results to the Hub, write reports, and build demos. Each training run gets its own dashboard for tracking progress. One example from the demo video ran for about six hours and cost less than $0.50, according to Hugging Face. The tool lowers the barrier for new ML projects on the platform. Hugging Face is in the middle of an acquisition by Nvidia, and CEO Jensen Huang has promised to keep the platform open and hardware-neutral.

Hugging Face’s new ML Intern lets anyone run machine learning experiments through a simple chat →