Meta founder and Chief Executive Officer Mark Zuckerberg has aggressively promoted the security architecture of the company’s new artificial intelligence assistant, Muse, claiming the tool was built from the ground up with privacy and security as its core foundation. However, the discovery of a critical zero-day vulnerability in the assistant has cast serious doubt on those assurances. The security flaw allows locally executed applications and command-line scripts to completely hijack a user’s Muse account. Compounding the setback for Meta, e-commerce giant Amazon began systematically blocking the AI assistant from accessing its online marketplace, citing policy violations and unauthorized automated behavior.
Meta introduced Muse as an advanced, agentic desktop assistant designed to handle complex, multi-step tasks across a user’s digital workspace. According to Meta’s release material, the assistant is capable of booking appointments, filling out web forms, managing customer service interactions, and proactively removing tedious administrative chores from a user’s daily workflow. The assistant is also built to make automated purchases, generate images, construct documents, and integrate directly with third-party applications and services.
Currently available exclusively as a macOS application—with Meta notably omitting a Windows release at launch—Muse connects with a wide array of personal and professional services, including WhatsApp, email, calendar systems, and social media platforms. In scenarios where a specific task requires an integration or tool that does not currently exist, Muse is designed to dynamically write and execute code on the fly to fulfill the request.
To execute these wide-ranging autonomous actions, Muse requires users to grant it extraordinarily broad privileges. Users must authenticate the assistant across their various personal accounts and grant the macOS application deep access to operating system resources. These system-level permissions include writing files to disk, accessing the device microphone and camera, tracking real-time location data, and monitoring personal calendar entries.
For years, Apple has designed and iterated upon macOS permission frameworks, such as Transparency, Consent, and Control (TCC), explicitly to restrict installed applications or unauthorized terminal commands from reaching sensitive system resources without explicit user approval. Security analysts note that by aggregating these permissions into a single, highly active agent, Muse effectively bypasses and undoes these foundational operating system defenses, creating a massive single point of failure.
Meta’s Security Hype Misaligns with Zero-Day Findings
The newly discovered zero-day vulnerability reveals that any locally installed application or basic terminal command can extract the authentication token used to validate a user with Meta’s Muse servers. The vulnerability stems from fundamental software design choices made by Meta developers, which allow any local code—regardless of its existing macOS permission level—to modify a broad array of undocumented internal settings within the Muse application.
While many of these internal parameters control relatively harmless interface features, such as toggling dark mode, one specific setting introduces a critical security flaw. This setting dictates the network endpoint URL responsible for receiving and processing user dictation and voice transcriptions. Under normal operating conditions, this endpoint points directly to secure server infrastructure managed by Meta. However, because local processes can overwrite this parameter without requesting elevated privileges, an attacker can silently redirect the transcription endpoint to a malicious server under their control. Once a user speaks or interacts with the assistant, the altered endpoint routes the request—along with the user’s full account authentication token—directly to the attacker.
"We can manipulate the agent and leverage its privileges to do whatever we want," explained Patrick Wardle, the prominent macOS security expert who discovered and analyzed the zero-day flaw. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself."
