Meta Muse Zero-Day Exposes Risk of Over-Privileged AI Agents

What happened

Meta's new AI assistant, Muse, has run into the kind of security trouble that critics of agentic AI have long predicted. Security researcher Patrick Wardle, founder of Objective-See, disclosed a zero-day vulnerability in the macOS version of Muse. He released a proof-of-concept exploit with the playful name "not-a-mused." 4 The flaw lets locally running apps or terminal commands take full control of the agent. 1

The mechanism is simple. Muse exposes an undocumented configuration setting, endo_voyager_dictation_endpoint, that an unprivileged local process can change without any elevated permissions. 4 Rewriting that value sends Muse's dictation traffic to a server the attacker controls. From there, the attacker can capture spoken prompts before they reach Meta's backend, alter the instructions the agent receives, and harvest authentication material. 4

This is not the only flaw to surface. The Information reported a separate vulnerability, flagged by an outside researcher through Meta's bug bounty program. It could have let an attacker reach users' virtual machines holding personal emails and files. 32 Meta classified that issue internally as a high-severity SEV-2 incident and responded by adding a clearer safety warning inside the app. 2

The fallout has spread beyond Meta. Amazon began blocking Muse from its site on Sunday. 1 Separately, reporting from CNET and AppleInsider found that Muse synced roughly 187,000 lines of a user's Apple Messages even after Full Disk Access had been switched off. Apple then updated its macOS privacy settings in response. 5

Why the privilege problem matters

The core issue is how much Muse is trusted. The assistant is built to shop, book travel, send email, and make payments for its users. 2 To do that, users have to authenticate it to each service. On macOS, they also have to grant it a wide range of operating-system-protected resources: writing files to disk, using the microphone and camera, and tracking location and calendars. 1

Apple has spent years walling off those resources from installed apps and terminal commands precisely because it treats them as attack surface. Ars Technica argues that Muse effectively undoes those defaults. 1 Wardle's findings show the practical result. Malware already running under a user's account doesn't need to break Apple's protections itself. It can hijack Muse and inherit everything the user has already handed over. 4

This is the structural weakness of highly privileged agents. Each permission a user grants makes the agent more useful, and it also makes the agent a more valuable target. A bug that would be minor in an ordinary app becomes a skeleton key when the app holds credentials to email, payments, and shopping accounts at once.

Hype versus posture

Mark Zuckerberg has promoted Muse as "built from the ground up for privacy and security." 1 The surrounding evidence complicates that claim. A Surfshark analysis of App Store disclosures found Muse claims 31 of 35 possible data types, including location, sexual orientation, and biometric data. By the same count, ChatGPT claims 17 and Gemini claims 24. 5 CNET also cites a TIME finding about Muse building user dossiers. 5

Meanwhile, adoption has been fast. The figures vary by source and timeframe. The Straits Times, citing The Information, reported about 2.8 million downloads in two weeks, with Muse topping app store charts. 2 CNET puts the total at 5 million. 5 These numbers likely reflect different points in a steep growth curve rather than a contradiction. Either way, millions of people have handed broad access to a product whose security story is now under strain.

Reading the response

The responses from the companies involved are telling. Meta's visible fix, at least as reported, was a clearer warning, not an architectural change. 2 That puts the burden on users to understand risks that even seasoned security researchers had to reverse-engineer. Amazon's block suggests at least one major platform is unwilling to let an agent with this profile operate on its storefront. 1 Apple changed macOS privacy settings after the Messages sync finding. 5 That signals the platform owner sees agent behavior as a problem it may have to contain at the operating-system level.

Taken together, the picture is less about any single bug and more about a design philosophy under pressure. Bugs get patched. But an assistant that asks for nearly every permission and data type, while marketing itself as privacy-first, will keep producing findings like these. In each case, the damage scales with the access granted.

What to watch

The open questions are whether Meta narrows Muse's default permissions or keeps relying on warnings, and whether other retailers follow Amazon's lead. Another is whether Apple's adjustments evolve into firmer limits on what third-party agents can do on macOS. For users, the practical lesson is to treat any AI agent's permission requests as a security decision, not a setup step.