A reported Muse zero-day puts Meta’s AI agent’s permissions under the microscope

A reported zero-day in Meta’s Muse AI assistant could let locally installed apps or terminal commands take control of a user’s Muse account and its unusually broad privileges. The security report matters because Muse is designed to act across email, shopping, calendars and other services, rather than merely answer questions.

Meta AI Watch analysis

What happened

Ars Technica reports that macOS security researcher Patrick Wardle found a flaw in Muse’s handling of account tokens and undocumented settings. The report says an attacker could redirect the endpoint used for cloud transcription, obtain the token authenticating the user’s Muse account and then manipulate the assistant. Wardle told Ars that proof-of-concept attacks could write files to disk or take pictures, in some cases without an alert being obvious to the user.

The report is based on an archived publisher article captured on 21 September, not a successful live-page fetch. Ars says Meta did not answer its emailed questions. The account therefore establishes a serious reported vulnerability and the researcher’s demonstration, but not Meta’s current remediation status or whether the flaw remains exploitable.

Muse’s power is also the source of the exposure. According to Ars, the macOS app can work with WhatsApp, email, calendars and social-media accounts, while users may grant it access to resources including files, the microphone, camera and location. The report says Muse can create tools on the fly when a task needs an unavailable service, an impressive trick until the security boundary starts looking more like a suggestion.

Why it matters

An assistant that books appointments, fills forms or makes purchases needs more authority than a conventional chatbot. That makes a vulnerability in its account token or local controls potentially more consequential than a routine app bug. The risk is not simply that Muse produces a wrong answer. It is that other software on the Mac could allegedly turn Muse’s permissions into a remote-control channel for sensitive actions.

The report also says Amazon blocked Muse from shopping on its site, calling it an unauthorised AI agent that violated its conditions of use. That is a separate platform-access dispute, but it underlines the same practical problem: agents are acting on behalf of people before the rules for identification, permission and responsibility have settled.

Our read

This is a substantial security story, not an invitation to declare every AI assistant unsafe. The useful lesson is narrower: an agent’s convenience is inseparable from the permissions that make it useful, so those permissions need security engineering and independent scrutiny from the start.

Readers using Muse on macOS should avoid granting access they do not need and should look for a clear update from Meta before trusting it with sensitive accounts. The immediate question is not whether Muse can do impressive tasks. It is whether its security model can survive an ordinary hostile app on the same computer.

What to watch

• Whether Meta confirms the vulnerability, assigns it a CVE or publishes a patch.
• Whether Wardle releases additional technical details or reproducible demonstrations.
• Whether Meta changes Muse’s token, transcription or local-permission design.
• Whether Amazon and other services permit, identify or block third-party agents on clearer terms.

Discussion spark: Should an AI agent with access to email, files and payment-linked services face a higher security bar than an ordinary app, even if that makes it less useful?

not affiliated with, endorsed by, or operated by Meta