Campaigners say the avatar of a 21-year-old researcher was sexually assaulted in Meta's virtual reality platform Horizon Worlds.
Corporate accountability group SumOfUs, for whom the researcher works, says it shows Meta needs better plans to mitigate harms in the metaverse.
Meta's annual shareholder meeting takes place on Wednesday.
The company told the BBC there were safety tools in Horizon Worlds to help people have a "positive experience".
Noting that Meta had not yet seen the full SumOfUs report, a spokesperson told the BBC the firm wanted everyone in Horizon Worlds to access the safety procedures "and help us investigate and take action".
Horizon Worlds is currently only available to users in the US and Canada. Avatars in the platform have a simplified, cartoonish appearance.
SumOfUs says that virtual assaults can be intensely traumatic.
"It still counts, it still has a real impact on users," the group's campaigns director Vicky Wyatt told the BBC Tech Tent podcast.
Ms Wyatt said the researcher subjected to the alleged assault felt that "part of them was really shocked, part of them thought, 'OK, this isn't my real body, this is an avatar' and another part of them thought 'this is really, really important research that I'm doing, I need to capture this footage'".
The BBC has seen some of that footage. The avatar of the researcher is not in vision, as it is taken from her perspective, but there are two male avatars in the room, one of whom is observing while the other appears very close to her. The pair make lewd comments and share a virtual bottle of drink.
Not a single space
There is no single agreed definition of the metaverse, and proponents admit it is a work-in-progress.
It draws upon several different pre-existing technologies, including virtual reality and augmented reality.
The metaverse is not a single space, and many different 3D virtual environments – including established games and virtual worlds – are said to be part of it.
Of the parts of the metaverse that presently exist, only some – such as Horizon Worlds – are owned by Meta. However, the company has championed the idea, is investing billions of dollars in developing the concept and plans to hire thousands of staff to work on it.
Earlier reports of virtual assaults on avatars and inappropriate "creepy" behaviour prompted Meta to introduce new safeguards into its virtual worlds in February
Personal Boundary prevents avatars from coming within a set distance of each other, making it easier to avoid these unwanted interactions.
It stops others "invading your avatar's personal space", said Meta.
"If someone tries to enter your Personal Boundary, the system will halt their forward movement as they reach the boundary."
According to Meta, the default Personal Boundary setting is roughly 4ft (1.2m) virtual distance between your avatar and those of anyone not on your friends list.
The company says it also offers a number of ways to block and report users.
According to SumOfUs, the researcher was "encouraged" to disable the Personal Boundary feature.
The researcher also witnessed homophobic slurs and virtual gun violence, the group claims.
SumOfUS has filed a resolution with a small group of shareholders, asking for a risk assessment of the human rights impacts of the metaverse to be conducted by the company.
The group also criticised a recent blog post by Meta's president of global affairs, Nick Clegg.
In it, he wrote: "We wouldn't hold a bar manager responsible for real-time speech moderation in their bar, as if they should stand over your table, listen intently to your conversation, and silence you if they hear things they don't like."
Ms Wyatt says that Meta needs to act now to tackle issues: "Rather than Facebook rushing headlong into building this metaverse, we're saying look, you need to stop look at all the harms that are happening on your platforms right now that you can't even deal with.
"Let's not repeat and replicate those in the metaverse. We need a better plan here on how to mitigate online harms in the metaverse".