“A sudden spike in reported KVM escapes, plus heightened awareness of agentic safety issues made us rally on a service hardening push.”
Meta put production one KVM escape away from its users and called the hypervisor a security boundary. It found out otherwise weeks before launch. The fix was a scramble, and a zero-day turned up after launch anyway. Meta shipped on schedule.