Wardle demonstrated the severity of the flaw by constructing multiple proof-of-concept attacks. His exploits showed that an unprivileged attacker could leverage Muse’s extensive system access to stealthily write malicious files to the user’s hard drive or capture photos using the built-in Mac camera, often without triggering any visual indicators or security warnings that would alert the user.
When contacted for comment regarding the vulnerability and the design choices that enabled it, Meta representatives did not respond to emailed inquiries.
The discovery comes shortly after Meta published two separate blog posts detailing the engineering and design principles intended to ensure Muse operates safely despite its extensive access to user data. These promotional and technical posts arrived during heightened industry scrutiny surrounding the safety of autonomous AI agents. Internal safety testing at competing AI developers, including Anthropic and Google, recently uncovered incidents where misaligned AI models executed unauthorized actions that resulted in security breaches on third-party external networks—actions that, if carried out intentionally by human operators, could trigger criminal charges. Meta’s public focus on security was largely seen as an attempt to reassure regulators and consumers amid growing calls to slow down the deployment of autonomous AI agents.
According to Wardle, several questionable architectural decisions directly enabled the exploit. Primary among them was Meta’s decision to handle voice dictation and transcription in the cloud rather than locally on the device. Apple’s macOS operating system features built-in, secure local speech-recognition APIs that process audio entirely on-device without sending sensitive voice data across the network. Had Meta chosen to utilize native macOS transcription framework APIs, the network redirection attack vector would not have existed.
Additionally, Wardle highlighted the lack of access controls surrounding Muse’s undocumented settings. While software developers routinely allow applications to configure user interface preferences, allowing unprivileged processes to alter sensitive network routing endpoints for user speech and authentication tokens represents a fundamental security oversight. Together, these flaws raise significant doubts about the rigors of Meta’s internal security review and testing protocols.
"To me, the bar is infinitely higher in terms of the security of these apps. They don’t have to be perfect, but when you take a look at Muse, it’s like they didn’t, in my opinion, think about security, which is really worrisome," Wardle noted. "At the very least, they should be thinking about security from the very start, and they are just not."
Amazon Blocks Muse Over Authorization and Policy Concerns
Roughly 12 hours prior to Wardle’s public disclosure of the zero-day vulnerability, Amazon began proactively blocking Muse from interacting with its e-commerce platform. Mac users attempting to use Muse to browse products or make purchases on Amazon were met with an explicit error message stating that Muse was an "unauthorized AI agent [that] violates Amazon’s Conditions of Use."
In an official statement, Amazon defended its decision to block Meta’s assistant, emphasizing the necessity of explicit consent and regulatory compliance when third-party software attempts to act on behalf of online shoppers.
