Adult AI agents, data centres under fire, and a free AI bug hunter for open source

Meta's Muse, a task-focused personal AI agent the company launched on September 8, produced explicit sexual content during testing by a Wired reporter, according to Wired's reporting as republished by other outlets. In the tests, Muse described pornographic scenarios in detail and used crude language about itself.

Meta's response surprised many observers. A spokesperson, Daniel Roberts, told Wired that Muse 'is an app for people 18 and over that allows them to engage in adult conversations, if they choose, using a private and secure VM only accessible to them,' and that it 'doesn't block legal adult behavior.'

Other coverage complicates that picture. Crypto Briefing, citing Wired, says Meta's published rules for Muse ban adult content, erotic chat and pornography without exception, which would contradict the spokesperson's position. We couldn't confirm which description of Meta's written policy is current, and critics have also questioned whether Muse's toy-like mascot could appeal to younger users despite age verification.

Meta has faced similar scrutiny before: a 2025 Wall Street Journal investigation found Meta chatbots holding explicit conversations, including with testers posing as minors, after which Meta said it added safeguards. The new episode reopens questions about age assurance, consistency between policy and behaviour, and what 'private' agent spaces mean for content moderation.

For the industry, the debate over adult content in AI products is shifting from whether to allow it to how to gate it: verified adults, opt-in settings, clear published rules and auditable enforcement. Regulators in several regions are already moving on age verification, and agent products that act privately on a user's behalf will face the same questions.

Why it mattersConsumer AI agents are entering adult-content territory, and inconsistent policies make age verification and content rules a pressing compliance issue for every AI app maker.

Russian tech giant Yandex says a drone attack started a fire at its Sasovo data centre, which has stopped operating entirely. Most reports date the strike to October 8. The company said some services may be unavailable and that it could not yet confirm whether equipment could be restored. The site reportedly hosts tens of thousands of servers, including two Nvidia A100-based supercomputers used for AI, though Yandex has not said whether they were affected.

The disruption was visible from outside. Internet monitor NetBlocks confirmed significant disruption to Yandex's network, with connectivity falling to around 70% of normal, although Yandex said core consumer services such as search and taxi stayed online. Within about two days, Yandex said a drone attack also damaged infrastructure at its Kaluga data centre, knocking out several modules.

Ukraine has not claimed the Sasovo strike, according to reporting cited by DatacenterDynamics. The Sasovo site sits within an industrial complex that also serves Russia's defence industry, which may have shaped targeting. Some roundups reported further strikes on other Yandex sites, but we found confirmation only for Sasovo and Kaluga.

Beyond the conflict itself, the episode changes how the AI industry thinks about risk. Data centres concentrate enormous economic value, and increasingly national AI capability, in a few physical locations. Strikes, sabotage, power-grid failures and extreme weather can take frontier-scale compute offline in hours.

Expect more spending on geographic redundancy, physical security, backup power and multi-region failover, and more pressure on companies to know where their AI workloads physically run. For businesses that depend on a single cloud region or provider, business-continuity planning for AI is no longer optional.

Why it mattersAI compute is concentrated in a few physical sites, and their vulnerability to attack or outage is now a real business-continuity risk.

Anthropic has launched OSS Scanner, a free vulnerability-scanning service for maintainers of established, infrastructure-critical open-source projects. Enrolled projects get periodic security scans run by Anthropic's strongest models inside an isolated environment. Coverage names PostgreSQL, OpenSSL, wolfSSL, HotCRP and curl among early participants.

Maintainers enrol through the OSS Scanner GitHub repository and can pause or leave at any time. Reports include a reproducer, an explanation of the vulnerability and, where possible, a proposed patch. Unlike Anthropic's existing disclosure process, these reports are generated entirely by AI without human review, and Anthropic warns that some may be wrong.

Anthropic shared validation data. In an early run, expert penetration testers reviewed 97 critical and high-severity findings across 48 projects: 85, or 88%, met Anthropic's bar for coordinated disclosure, and only one was judged a false positive. More broadly, Anthropic says it found more than 29,000 possible vulnerabilities over six months but has manually confirmed only about 6,000. Coverage cites different counts of fixes (516 fixed, or 584 CVE advisories), likely reflecting different counting methods.

The service grew out of earlier internal work and lands as AI makes finding vulnerabilities dramatically cheaper for defenders and attackers alike. For open-source maintainers, often unpaid volunteers, the bottleneck is no longer finding bugs but triaging and fixing a flood of reports.

That shift creates real demand for people and tools that can verify AI-found bugs, write patches, coordinate disclosure and keep critical projects maintained. Companies that depend on open source should expect a wave of security updates and plan to apply them quickly.

Why it mattersAI is making vulnerability discovery cheap, which moves the bottleneck to verifying and fixing bugs. That's where skilled people and new tools will be needed.