Social media companies including Meta have pulled back on efforts to protect voters from election-meddling lies

Social media feeds are awash with an unprecedented flood of AI-driven disinformation ahead of November’s US midterm elections, according to experts, who warn many posts are likely “slipping through the cracks”.

As tens of millions of Americans prepare to cast their vote, social media companies have scaled back their efforts to protect voters from lies meant to manipulate elections.

On 20 October, the Lviv Oblast Council voted to declare 2027 the year of the Ukrainian Insurgent Army (UPA), its commander Roman Shukhevych, and Oleh Olzhych, a poet and member of the Organization of Ukrainian Nationalists (OUN). The vote on the UPA and Shukhevych took 45 seconds, Ukrainska Pravda reported, citing the council's online broadcast. It reopened a dispute Kyiv and Warsaw had only just settled. In May, President Volodymyr Zelenskyy gave a special operations unit the honorary name "Heroes of the UPA," and Polish President Karol Nawrocki later stripped him of the Order of the White Eagle in response.

Poland is the main hub for Western aid to Ukraine, and that role rests on Polish trust, which every new fight over the two nations' shared past erodes. Since 2022, Poland has also paid for nearly 30,000 Starlink terminals for Ukraine, Rzeczpospolita reported. The sorest point is the UPA. Poland recognizes the UPA's 1943 Volhynia massacres of Poles as genocide, a classification Ukraine disputes, pointing to the broader Polish-Ukrainian conflict of World War II, in which both sides killed civilians.

A batch vote, then a "catastrophe"

The resolution honoring the UPA commander and his fighters passed with 52 of the 55 deputies who voted, none against. The one on Olzhych passed 49 of 54. A source in the council told Ukrainska Pravda that, after a lunch break and an air raid alert, deputies voted through 30 to 40 minor items one after another without discussion, and the UPA year passed among them.

A source in the Office of the President called the situation a "catastrophe."

"Ukraine looks irrational. We only just settled the previous crisis, and now this. Everyone knew it was not allowed, the head of the oblast knew about it personally. But the chase for cheap one-day hype won out. The consequences are already here, and they will only grow," the source told Ukrainska Pravda.

The same source said the decision put the next Polish military aid package at risk. Polish Defense Ministry spokesperson Janusz Sejmej said this was "not true," and Deputy Defense Minister Cezary Tomczyk said Poland would keep helping Ukraine.

Ukraine's Foreign Ministry called the decision counterproductive, noted that oblast deputies are not subordinate to central authorities, and urged Poland to refrain from sharp steps that could hinder the normalization of relations. "Only Russia stands to gain from tension in our relations with Poland," Iryna Vereshchuk, deputy head of the Office of the President, wrote.

Explore further

“Heroes of UPA” unit will keep its name, Budanov’s office says despite Polish pressure

Warsaw holds Kyiv to its word, but Lviv won't budge

Polish Defense Minister Władysław Kosiniak-Kamysz called the decision unacceptable. Deputy Foreign Minister Marcin Bosacki told Polsat News on 21 October that it was hard to imagine a worse decision for Polish-Ukrainian relations. He said Zelenskyy's aides had assured Warsaw it would not take effect, and that the resolution had disappeared from the council's website after Poland intervened, which he called promising. Warsaw would hold the Ukrainian authorities to their word, he added.

The council itself does not plan to revoke or revise the decision, its representatives told Liga on 21 October.

On 23 October, Polish Prime Minister Donald Tusk said he had received a signal from Zelenskyy that he "will in no way support this decision" if further steps depend on him. "Ukraine will simply have very serious problems with integration if it does not also respect our sensitivity," Tusk said.

Poland bans proposal's initiator, who took part in search in Łasków, from Schengen Area

Poland has barred Sviatoslav Sheremeta, the Lviv Oblast Council deputy who initiated the decision, from entering the Schengen Area for five years, until 20 October 2031. Polish Interior Minister Marcin Kierwiński announced the ban on 21 October at the request of Foreign Minister Radosław Sikorski. Sikorski described Sheremeta as a reenactor of the Galizien Waffen-SS division.

Before the ban was announced, Sheremeta told Zaxid.Net that he had never taken part in military-historical reenactment, and noted that Sikorski's post had at first named a "P. Sheremeta." He found Polish officials' reaction strange, since Lviv and other oblast councils had declared years of the UPA and Shukhevych before. "This is nothing new," he said. He added that the decision was not aimed at anyone, least of all Poles or Poland, and that a ban would hurt the two countries' cooperation on commemoration.

Ukrainians have the right to choose their own heroes and honor them, Sheremeta believes. He suggested that recent statements by Polish officials may be linked to the discovery of Ukrainian civilians killed by Polish armed groups in Łasków in 1944.

Sheremeta also directs Dolia, a memorial search center. In October, Dolia carried out a search in Łasków, a village in Poland's Lublin Voivodeship, and found the remains of more than 40 Ukrainians, including women and children. The Ukrainian Institute of National Memory, which commissioned the search, says they were killed by units of the Polish Home Army and the Peasants' Battalions in an attack on 10 March 1944 in which more than 300 people died. Exhumation is planned for spring 2027.

The dispute over shared memory has shaped relations between Kyiv and Warsaw for a decade. After local authorities in Hruszowice removed a UPA monument in 2017, Ukraine's Institute of National Memory halted exhumations of Poles in Ukraine. Despite a 2019 pledge by the institute to stop blocking them, the first exhumation took place only in April 2025, in Puzhnyky, after Tusk announced a breakthrough.

Datacenter and chip costs fueled sharp decrease in AI sector although non-AI stocks still had a strong showing

The latest shudder for stocks in the AI industry pulled markets lower worldwide on Thursday, while oil prices hit their highest levels since May on worries about the war with Iran.

The S&P 500 fell 1.2% for its worst day since July, while the Nasdaq composite tumbled 2.6%. The weakness for tech stocks was so overwhelming that it masked strength for the rest of the US market, in which the majority of stocks actually rose. The Dow Jones Industrial Average added 11 points, or less than 0.1%.

Poland has paused the delivery of a large military aid package to Ukraine after a Lviv regional council honored the Ukrainian Insurgent Army (UPA), a WWII nationalist force, a source in the Ukrainian government told European Pravda on 21 October. A Polish Defense Ministry spokesperson told Fakt the report was untrue, though he told WP he knew nothing about a possible delay in shipment.

If confirmed, the freeze would carry a history dispute into Poland’s military aid. The row flared in May, when Kyiv named a special forces unit after the UPA, and in June Poland’s president stripped Zelenskyy of Poland’s highest honor. Even so, Ukraine’s ambassador said in August that Polish military aid was still flowing.

A vote and a disputed freeze

The Lviv Oblast Council voted on 20 October to name 2027 the year of the UPA, its commander Roman Shukhevych, and nationalist activist Oleh Olzhych. The UPA fought Nazi Germany and the Soviet Union, but Poland holds it responsible for mass killings of Poles in Volhynia and Eastern Galicia in 1943–1944. The resolution disappeared from the council’s website late that evening, RMF24 reported.

The source blamed what it called the councilors’ irresponsible actions, saying the vote came as Poland prepared the shipment and that work through closed channels is underway. The ministry spokesperson, Janusz Sejmej, called the report untrue. Asked whether it could reflect a delay in shipment, he said he knew nothing about that.

Explore further

Progress on a sore point for Ukraine and Poland: remains of over 40 Ukrainians killed by Polish WWII units found in Łasków

Polish officials push back

On 20 October, Defense Minister Władysław Kosiniak-Kamysz wrote that Ukraine’s authorities must distance themselves from the council’s position.

The next morning, Prime Minister Donald Tusk called the vote unwise and harmful above all to Ukraine. He said he had warned Zelenskyy earlier that such gestures hinder Ukraine’s friends, though the president was not responsible for this vote. At such moments, Tusk said, Russians always rub their hands.

Foreign Minister Radosław Sikorski then requested that councilor Sviatoslav Sheremeta, who proposed the resolution, be added to Poland’s list of unwanted persons. That afternoon, Interior Minister Marcin Kierwiński said the decision had been made. Sheremeta is barred from the Schengen zone until 2031, RMF24 reported. Poland had already barred him once, in 2017, the outlet said.

Kyiv asks for restraint

Earlier on 21 October, before the ban, Ukraine’s Foreign Ministry called the vote counterproductive in a reply to journalists and urged Warsaw to avoid abrupt steps. Zelenskyy’s closest aides had also promised the resolution would not take effect, Deputy Foreign Minister Marcin Bosacki told TVN24.

Jury had found Meta misled consumers after Trump’s 2016 presidential campaign obtained user data without consent

A judge in New Mexico ordered Meta Platforms to pay $25bn on ⁠Wednesday after a jury found the company had misled consumers in a case arising from allegations that a political consulting firm involved in Donald Trump’s 2016 presidential campaign obtained data from millions of Facebook users ⁠without their consent.

“Facebook’s wrongdoing – ⁠over the course of ​years and systematically broadcast to the public – goes to the heart of Facebook’s core business practices,” Judge Francis Mathew wrote in his order following the verdict.

In the immediate weeks before Muse’s launch, Meta engineers found several security vulnerabilities in the company’s viral AI agent product, at least one of which could have allowed malicious users to break outside of Muse’s intended environment and access Meta’s own sensitive databases and services, 404 Media has learned. The issues were so severe that they reached Mark Zuckerberg and staff worked overtime to fix them.

These specific vulnerabilities were discovered before the launch of the product but required a multi-team “mad dash” to fix “a sudden spike in reported KVM escapes,” according to an internal post by Meta executives to its core infrastructure team seen by 404 Media. In order for Muse to work, a user gives the AI agent access to various important services and accounts that they own. On Meta’s end, each individual Muse instance runs on a kernel-based virtual machine, which connects to, but is supposed to be isolated from, Meta’s own critical infrastructure. A “KVM escape,” then, is when, through a security vulnerability, a Muse instance is able to escape from that virtual machine and interact with the system that runs it, or with other users’ virtual machines. 

According to a Meta source, as well as internal security documentation and internal posts viewed by 404 Media, at least one of the vulnerabilities could have allowed an outside attacker — that is, a normal Muse user — to access data in sensitive internal Meta databases. . At least one of the vulnerabilities was related to an exploit found in Linux kernel-based virtual machine code in July. 404 Media granted the Meta source anonymity to speak about sensitive security matters.

Several of the vulnerabilities were in the underlying Linux virtualization software that Meta uses for Muse. The security issue was considered serious enough that it was raised to Mark Zuckerberg, and several different security teams worked nights and weekends in the leadup to launch to fix the issues. This type of security push is not necessarily unusual prior to the launch of a major product, but is notable considering outside researchers have found several other security issues since Muse’s launch, and in the broader context of agentic AIs from OpenAI and other companies going on major hacking sprees. 

The Meta source said they felt security teams were asked to push hot fixes to these bugs as quickly as possible and in a way that wouldn’t delay Muse’s launch, leading to what they described as “half-baked protections being rushed out to enable the launch. Many senior engineers believe it’s inevitable we’re going to have a massive data breach as a result of Hatch.” Muse is called “Hatch” internally and in Meta’s codebase.

This security push was acknowledged in an internal post made by Meta’s vice president of core infrastructure Surupa Biswas, vice president of engineering Francois Richard, and senior director of engineering Josh Barry to the company’s core infrastructure team on September 18, 10 days following Muse’s launch. 

“With Muse, we are directly hosting and running agents on behalf of end users, a fundamentally different paradigm,” the post said. “A sudden spike in reported KVM escapes, plus heightened awareness of agentic safety issues made us rally on a service hardening push.” 

The post noted this push started on August 27 and lasted a “handful of weeks and weekends,” though Muse was released just 11 days later. The post says that the work involved taking steps to “reduce the surface area accessible to Hatch agents.” The teams also took steps to “constrain port/IP destinations Hatch and VMVM hosts can reach.”  

 A virtual machine escape of Muse is a potentially very serious security issue, and is classified as such in Meta’s bug bounty program. The company says it is willing to pay $300,000 to any security researcher who finds a bug that would allow for a VM escape, the highest payout it lists on its bug bounty website.

“Muse, an AI product from Meta, lets people create their own personalized AI agent — their Muse. Each Muse agent runs in a dedicated per-user virtual machine and connects to that user's own services: email, calendar, messaging, browsing, and third-party accounts. Because a Muse agent holds a user’s most sensitive data and can act on their behalf, we treat compromise of that boundary as a first-class security risk,” the company explains on the bug bounty page. The highest level of risk is “Compromise of Meta production and users beyond Muse” with a VM escape, which it describes as “reaching Meta production services or internal networks from Muse.” This is what at least one of the vulnerabilities could have been capable of, according to the Meta source.

In a statement to 404 Media, a Meta spokesperson said, “Muse is the first personal AI agent built for everyone and we’re proud of the work we’ve done to make it safe, secure and private, with built-in protections and user controls that put people in charge of how they use it. We’ve strengthened Muse through extensive dogfooding, agentic red teaming and our bug bounty program — and that work continues." 

Muse’s rollout has been uneven thus far. The agent has proven popular, or at least buzzy, for being able to do things like cancel subscriptions, make restaurant reservations, and book travel. But security researcher Patrick Wardle found a zero-day in Muse — a vulnerability that, to his knowledge, the company was not aware of at the time — that allowed apps and terminal commands to control a user’s Muse. Another Muse user was able to get Muse to export his Instagram followers, as well as his followers’ followers, something that shouldn’t be possible and which Meta’s security teams investigated, according to the Meta source.

“This issue is that Hatch makes the virtualization boundary a production security boundary,” Wardle told 404 Media of a potential Muse KVM escape. “We have users with root privileges inside a VM that is itself placed within Meta's production environment and given (by design) limited access to internal services. A single failure in KVM (or even a vulnerability or misconfiguration in an internally reachable service) can therefore turn arbitrary user code into production access. I feel like this design is inherently risky, particularly risky as AI lowers the cost of finding, analyzing, and exploiting exactly these kinds of complex virtualization vulnerabilities.”

“I know everything is always a tradeoff between usability and security, but this is why in top security environments, systems are air-gapped, as its always assumed that connected systems can be exploited,” he added. “Of course, there's no expectation to Meta to go that far, but having access to production environment literally one KVM escape away, is plain irresponsible.”

Last week, Meta executives announced that its much-hyped AI agent, Muse, had a new feature: It could call businesses for you to do things like make a restaurant reservation or a haircut appointment. But in reality, Meta is testing having these calls being made by human beings in call centers, 404 Media has learned.

“We just expanded the @muse beta for outbound calls to US businesses,” Ryan Fox, the principal engineer on Muse posted on X on Sept. 16. Alexandr Wang, Meta’s chief AI officer, posted “we’re expanding our phone beta for muse!” 

Internally, however, the company announced the features to employees and said that it had “added a human agent layer for calls to get completed,” and that “Muse human agent calls [sic] is ready for company dogfooding,” or testing. 

“Muse doesn’t just dial a number. It calls a business on your behalf, handles the conversation, completes your request, and reports back with a transcript and a summary,” the internal message board post to employees, seen by 404 Media, reads. “It also no longer works alone. Muse is now able to hand requests to a trained human agent, who places the call and works it through.” 

“This is still a confidential, pre-launch product,” the post adds. “Please don’t share it, or anything it producers, with anyone outside the company.” 

Once again, a core feature of a major piece of AI technology will actually just be people working in a call center, doing work that a company says AI is doing. It is not clear how often or when a call is routed to a so-called “human agent,” and when a call is done exclusively by AI.

The fact that human beings are involved in the call raised questions among employees, who wondered both about the privacy implications of sharing people’s call requests with other human beings as well as the perception that its AI assistant wasn’t advanced enough to do calls on its own. 

“Not sure what I am missing here but why is this a ‘feature?,’ one employee wrote on Meta’s internal message board for workers. “This has potential for so much negative PR. It could portray us as ‘their AI is not good enough so they still need humans’ kind of coverage for this launch.” 

That Meta is at least sometimes letting human beings read users’ chats and make phone calls on their behalf is part of a time honored tradition in which companies launch an AI product, claim that it is AI, only for it to be later learned that human beings are doing some or all of the work. And it is the latest example of a tech giant passing potentially highly sensitive information to human beings; it is easy to imagine someone asking Muse to make a sensitive doctor’s appointment, for example, and the user not knowing that a human being might make that call. 

In internal communications seen by 404 Media, Meta suggested to employees that potentially sensitive information shared by the user with AI — and then passed to human contractors — was still safe because the contractors had undergone “a lot of training to make sure all your data is safe and secure.” An employee commented that the training “is not a [security] mechanism.”

“This is absolutely going to create a ton of outcry if we publicly launch this as default-on. It will kill all the goodwill and organic press we’re getting from early adopters,” they wrote. “Please think about how the headlines will scream ‘Meta uses humans behind the scenes to make calls’ or ‘Muse AI is actually independent contractors’ and result in a ton of bad press about the privacy and security of our data handling […] please PLEASE do not release this as-is and at least make this a user preference if we absolutely must launch this. Please.”

Other employees who had tested the system said that it was a “bad bad idea,” and that they were not made aware that a human being did the call for them until after the call had been made: The tester “was not made aware of the caller being human and was only told after,” one employee wrote. “So they were concerned with information that they shared with the assumption that it is the secure AI which is making the call. Even with clear indication of human calling, I can think of many scenarios where I wouldn’t be comfortable with this and I am not positive about how our users will react to this.” 

Various Meta employees and regular users have posted about Muse’s ability to make phone calls, and their experience with it. Ravid Shwartz Ziv, who does AI research at Meta, posted on X that “this week, Muse called customer service on my behalf. It navigated the phone tree, waited on hold, spoke with a human rep, and resolved the issue (worked great!). The crazy thing for me (besides that it works) is that the rep didn’t blink. Talking to a bot was completely natural to them.” Others have posted that the call function didn’t work, or that the person on the other end hung up on the agent (some have said that Muse did what it was supposed to do). 

“Internal testing, aka dogfooding, is core to the product development process. While the response from employees has been overwhelmingly positive, the entire point is to get feedback so we can implement safety and privacy protections and improve features before we release them publicly,” a Meta spokesperson told 404 Media. “We’re working with merchants to continue improving this potential calling feature, and will only roll it out when it's ready and with the proper disclosures.”

[L'article Meta pourrait verser presque 17 milliards $US pour interrompre un procès a d'abord été publié dans InfoBref.]