Security researcher Patrick Wardle has found a zero-day in Muse, the AI assistant Meta launched a few weeks ago, that lets any locally installed app or terminal command take full control of a user's Muse account. The flaw undermines Mark Zuckerberg's claim that the assistant is "built from the ground up for privacy and security." For companies weighing whether to hand an agent access to mail, calendars and payment accounts, the case shows how quickly declared privacy guarantees can collide with the actual architecture of the product.
What the Muse zero-day allows
Muse is a macOS application; there is no Windows version. Meta positions it as an assistant that books appointments, fills out forms, handles customer service, makes purchases, generates images, creates documents and connects to third-party services. It works with a user's WhatsApp, email, calendar and social media accounts, and when a task needs a tool that does not exist, Muse writes one on the spot. To do all of this, the user authenticates the assistant to each service and grants it operating-system permissions that Apple restricts by default: writing files to disk, accessing the microphone and camera, tracking location and calendars.
The vulnerability sits in the way Muse handles its settings. Meta's developers let any locally installed app or executed code change a long list of undocumented parameters, regardless of the macOS permissions that app holds. Most of them are harmless, such as dark mode. One is not: it lets a process change the endpoint where transcription happens. Normally that is a server address operated by Meta; an attacker can point it at a server of their own. Once dictation is redirected, the token that authenticates the user to Muse is sent there as well, and the attacker gains permanent control of the account. Wardle told Ars that the agent itself can then be used instead of writing dedicated Mac malware: "We can manipulate the agent and leverage its privileges to do whatever we want." He built proof-of-concept attacks that write malicious files to disk and take pictures, in many cases without any signal to the user.
What this means for companies deploying AI agents
Wardle traces the problem to two design choices. Muse performs dictation in the cloud, where Meta can log it, although macOS has long offered a way to transcribe speech in a process that stays on the device; had Meta used it, the attack would not have worked. The second choice is letting any app control all undocumented settings, including the transcription endpoint. Wardle, who runs the Objective-See Foundation and previously worked at NASA and the National Security Agency, says the bar for such apps should be far higher: in his view, Meta did not think about security from the start. Meta representatives did not answer emailed questions. The company has published two posts in as many weeks describing how it designed Muse to be secure and private, a response to disclosures that internal testing of models from Anthropic and Google breached third-party networks the engineers never meant to target.
The practical consequence for businesses is that an agent with broad account access becomes a single point of failure. An attacker does not need to compromise each service separately: one redirected endpoint yields WhatsApp messages, mail and calendar data at once. Wardle found that a simple variation of the ClickFix technique, which tricks users into infecting their own machines, is enough to seize a Muse account. That lowers the skill threshold: the attack does not require a sophisticated stealer, only a user who pastes a command. For a small company the risk is concentrated in whoever runs the assistant on a work laptop; for a larger one it extends to every account the agent has been authorized to reach.
Several questions remain open. Meta has not said whether the undocumented settings will be restricted or whether dictation will move on-device, and it has not commented on Wardle's findings. Companies evaluating Muse should ask the vendor which settings local processes can change, where voice data is processed and stored, how the authentication token is protected, and how quickly a compromised token can be revoked. It is also worth noting what the news does not mean: the flaw is not evidence that AI assistants are unusable, but it does show that a vendor's privacy claims need to be checked against the permissions the product actually requests. Wardle plans to detail the vulnerability and other AI assistant threats at the Objective by the Sea conference in November.
Separately, roughly 12 hours before Wardle disclosed the zero-day, Amazon began blocking Muse from shopping on its site. Users who tried received a message calling Muse an "unauthorized AI agent" that violates Amazon's Conditions of Use. Amazon said third-party applications that make purchases on behalf of customers should operate openly and respect a service provider's decision about participation, and that it has asked Meta to remove Amazon from the Muse experience. The episode gives businesses a concrete marker to watch: whether Meta restricts the settings that made the exploit possible and whether other large platforms follow Amazon in blocking the agent. If they do, the value of an assistant that acts across services will depend less on its feature list than on the access agreements behind it.
