Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

Meta only introduced Muse a few weeks ago, but the assistant is already in trouble. Mark Zuckerberg has been talking it up as “built from the ground up for privacy and security,” yet a zero-day flaw lets locally run apps and terminal commands take over the agent completely. That is not a small crack in the armor. It is the whole door swinging open.

Muse is meant to do a lot: book appointments, fill out forms, handle customer service, make purchases, generate images, create documents, and connect to other apps and services. On macOS, it can also work with a user’s WhatsApp, email, calendar, and social media accounts. And if it needs a tool it does not already have, it can create one on the fly. That is a lot of reach for a product that only arrived a few weeks ago.

But to do any of that, users have to hand it access first. They authenticate it to each service, then give the app permissions across macOS-protected resources, including the ability to write files, use the mic and camera, and monitor location and calendars. Those protections exist for a reason. Apple built them to keep installed apps and terminal commands away from sensitive parts of the system.

The problem is that Muse appears to undo those default safeguards. The result is hard to square with the security story Meta has been selling. Amazon’s move on Sunday to start blocking Muse from its site only sharpens the point. A tool this ambitious was always going to live or die on trust, and right now it is bleeding it.