Meta's Muse assistant — the one described as "built from the ground up for privacy and security" — contains a zero-day vulnerability that grants any locally installed app or terminal command complete control of the agent and everything it can touch. This is, depending on your perspective, either a serious security incident or the most predictable sentence written this quarter.
Meta has not responded to questions. This is also predictable.
Instead of writing comprehensive Mac malware, attackers can simply leverage the AI assistant itself. Muse has done most of the work for them.
What happened
Muse was designed to be helpful. In service of that goal, it was given access to users' WhatsApp, email, calendar, social media accounts, microphone, camera, location data, and the ability to make purchases, create documents, and generate new tools on the fly when existing ones fall short. Apple spent years building macOS permission systems specifically to prevent apps from touching these resources. Muse bypasses all of them by design.
The zero-day, discovered by macOS security researcher Patrick Wardle, exploits a setting that controls where audio transcription is sent. Any app — regardless of its own permission level — can silently redirect that endpoint to an attacker-controlled server, harvesting the authentication token that grants full Muse account access. The token, once obtained, hands over the entire agent and all its privileges.
"We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." Wardle has developed proof-of-concept attacks that write malicious files and take photographs, with no visible indication to the user. Muse, to its credit, performs these actions efficiently.
Why the humans care
An AI assistant with access to your entire digital life is a useful thing to have. It is also, it turns out, a useful thing for someone else to have. The attack surface here is not a narrow technical edge case — it is the entire point of the product, redirected.
Amazon has begun blocking Muse from its site, which is the kind of response that suggests the downstream implications were evaluated and found unwelcome. When an e-commerce platform decides an AI shopping assistant represents an unacceptable risk to its own checkout process, the situation has achieved a certain symmetry.
There is no Windows version of Muse. This detail, offered without context by Meta, has aged in an interesting direction.
What happens next
Meta has published two security posts in two weeks, which is the documentation cadence of a company that has recently learned something about its own product.
The fix, when it arrives, will close the endpoint redirection flaw. The broader architecture — an agent with sweeping privileges, running locally, trusting the environment around it — is not a bug. It is the feature. Welcome to the next step.