Meta's new AI assistant Muse launched with a zero-day vulnerability that could give locally installed apps or terminal commands complete control of the agent, according to Ars Technica and Wired. CEO Mark Zuckerberg had promoted Muse as "built from the ground up for privacy and security." The macOS-only app (there is no Windows version) books appointments, fills forms, makes purchases, and connects to a user's WhatsApp, email, calendar, and social accounts. To function, users grant it broad macOS permissions, including writing files to disk and accessing the mic and camera. According to the reports, Muse undoes Apple's default protections. The flaw let any app change a long list of undocumented settings, including the endpoint where voice transcription occurs. By redirecting that endpoint to their own server, attackers could obtain the token granting full control of the Muse account. "We can manipulate the agent and leverage its privileges to do whatever we want," said macOS security researcher Patrick Wardle, who discovered the issue and built proof-of-concept attacks that write malicious files and take pictures without alerting the user. More than 12 hours after the report went live, Meta said it released a hotfix patching the zero-day. Separately, Amazon began blocking Muse on Sunday, calling it an "unauthorized AI agent" that violates its Conditions of Use.
- The zero-day let any local app or terminal command seize the token controlling a user's Muse account, per Ars Technica and Wired.
- Researcher Patrick Wardle traced the flaw to Muse's cloud-based transcription endpoint being changeable via undocumented settings.
- Meta released a hotfix more than 12 hours after the report published; Amazon separately began blocking Muse as an 'unauthorized AI agent.'
What it means for you
Meta launched an AI assistant that can act on your accounts and files, and it shipped with a hole that let malicious software on your Mac take full control of it. Meta says it has since patched the problem. The broader lesson: an assistant with sweeping access to your email, calendar, purchases, and camera is a big prize for attackers, and even a well-funded company got the security wrong on day one.
Try this
If you installed Muse, update the app immediately so you have the hotfix, and review which accounts and permissions you granted it, revoking anything it doesn't strictly need.
Who should care
Mac users who have installed Muse or are considering any AI assistant that requests access to email, calendars, purchases, or device resources like the mic and camera.
Skip this if
You haven't installed Muse and aren't planning to hand a broadly permissioned AI agent access to your personal accounts.
Sources: Ars Technica AI, Wired AI — read the original