Muse, Meta's AI assistant with extraordinary permissions on macOS, has a serious zero-day

Meta launched Muse a few weeks ago, an artificial intelligence assistant for macOS (notably, with no Windows version) that Mark Zuckerberg has insistently promoted as "built from the ground up for privacy and security." According to Meta's marketing, Muse can book appointments, fill out forms, handle customer service tasks, make purchases, generate images, create documents and connect with the user's favorite apps and services, including WhatsApp, email, calendar and social networks. When a task requires a tool that does not exist, Muse creates it on the fly. To work this way, the assistant needs the user to grant it access to their accounts and, being a macOS app, broad permissions over operating system resources that Apple has protected for years: writing files to disk, microphone, camera, location and calendar.

A zero-day vulnerability discovered by macOS security expert Patrick Wardle calls that security promise into question. The flaw allows any locally installed application or any command run in the terminal — regardless of the macOS permissions it holds — to access the token that authenticates the user to their Muse account. The developers designed the assistant so that any local process can modify a long list of undocumented settings. Most are harmless, such as controlling dark mode, but one of them makes it possible to change the endpoint where voice transcription is processed. Normally that address is a server operated by Meta; an attacker can redirect it to their own server and, in doing so, obtains the token that grants full control over the Muse account.

Wardle, co-founder of the Objective-See Foundation, author of "The Art of Mac Malware" book series and a former NASA and NSA employee, told Ars Technica: "We can manipulate the agent and leverage its privileges to do whatever we want. So instead of having to write a very comprehensive Mac malware that steals information, we can simply take advantage of the AI assistant itself." He said he has developed several proofs of concept that manage to write malicious files to disk or take photographs with the camera, in many cases without giving any sign even to an attentive user.

One way to exploit the flaw is through an attacker server acting as a proxy between the Muse user and Meta's endpoint. When the user issues a voice instruction, the attacker's server appends a malicious command, such as sending them a file with all of the user's WhatsApp messages. From that point on, the attacker gains permanent control of the Muse account, because the authentication token is also sent to their server. Wardle further demonstrated that a simple variant of a ClickFix attack — an increasingly effective technique for tricking people into infecting their own devices — is enough to take over a Muse account: with a single terminal command he managed to covertly send an instruction to Meta's endpoint, and Muse even replied, incorrectly, that such an action was not possible from an unprivileged attacker.

Wardle attributes the problem to several Meta design decisions. The first is that Muse's voice transcription is processed in the cloud, where Meta can log it, instead of using the mechanism macOS has long offered to handle dictation and transcription securely on the device itself; had that alternative been chosen, the attack would not have been possible. The second is allowing any application to control absolutely every undocumented setting, when the sensible approach would have been to limit that control to user interface settings and not to an endpoint through which the user's sensitive speech travels. "To me, the security bar for this kind of application should be infinitely higher. They don't have to be perfect, but looking at Muse it feels like, in my opinion, they didn't think about security, which is very concerning," Wardle said. "At a minimum, they should be thinking about security from the start, and they simply aren't."

More than twelve hours after the research was published, Meta said it had released an urgent fix (hotfix) resolving the zero-day. In its statement, the company argued that the flaw "was not a remote exploit," a response that overlooks how easily a ClickFix attack — essentially a form of social engineering — can produce the same effect. Meta also did not acknowledge that the flaw dismantled a security architecture Apple has taken years to build, nor did it explain why it opted for cloud transcription instead of the local macOS option. The company had published two blog posts in recent weeks detailing the design decisions adopted to guarantee the security and privacy of an assistant with such extraordinary access to user data and resources.

The episode comes amid growing concern about the security of AI agents: internal testing of Anthropic and Google models has led to unauthorized access to third-party networks that the engineers involved never intended to attack, actions that in a purely human context would probably have resulted in criminal charges. Roughly twelve hours before Wardle made his research public, Amazon began blocking Muse on its platform, showing users a message describing the assistant as an "unauthorized AI agent" that violates Amazon's terms of use. In a statement, the company argued that third-party applications offering to make purchases on customers' behalf must operate openly and respect service providers' decision on whether to take part, and compared the case to food delivery apps or online travel agencies, adding that it has asked Meta to remove Amazon from the Muse experience.

Wardle plans to address this vulnerability in more detail, along with other threats related to AI assistants, at the Objective by the Sea security conference in November. The Muse case adds to a growing list of incidents that raise questions about whether AI agents with privileged access to devices and personal accounts can truly be considered trustworthy in their current state.