"We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," Amazon said in an emailed statement. "This helps ensure a safe, secure, and reliable customer experience, and it is how others operate including food delivery apps and the restaurants they take orders for, delivery services apps and the stores they shop from, and online travel agencies and the airlines they book tickets with for customers. Agentic third-party applications such as Muse have the same obligations, and we’ve requested that Meta remove Amazon from the experience."
Amazon’s position highlights an emerging corporate battleground over agentic AI tools that automatically scrape, navigate, and execute transactions across commercial websites without formal corporate partnerships or standardized application programming interfaces (APIs).
Exploitation Vectors and the Threat of ClickFix Attacks
The mechanics of the zero-day vulnerability allow for multiple sophisticated attack scenarios. In one primary attack vector, an adversary sets up a proxy server positioned between the Muse user and Meta’s infrastructure. When the user issues a standard voice command or text instruction to Muse, the proxy server intercepts the traffic and appends a malicious hidden prompt. This injected prompt can order Muse to perform sensitive background tasks, such as archiving the user’s entire WhatsApp message history and transmitting the archive to an off-site server controlled by the attacker. Because the initial exploit also hands the authentication token to the attacker’s server, the adversary maintains persistent, long-term administrative control over the target’s Muse account.
While software developers often argue that an application’s security boundaries no longer apply once a user’s physical machine is compromised by local malware, Wardle pointed out that exploiting Muse does not require complex local rootkits. Instead, an attacker can achieve total account compromise using a simple variation of a "ClickFix" attack—a social engineering technique that tricks users into copying and running malicious commands in their system terminal under the guise of fixing software errors. ClickFix tactics have surged in popularity due to their high success rate in compromising both Windows PCs and Macs.
Wardle, who serves as the founder of the Objective-See Foundation—a non-profit organization dedicated to advancing open-source macOS security—is a widely recognized authority on Apple platform security. A former researcher for both NASA and the National Security Agency (NSA) and author of the technical book series The Art of Mac Malware, Wardle revealed that he plans to present a comprehensive technical breakdown of the Muse zero-day vulnerability and broader threats posed by agentic AI assistants at the upcoming Objective by the Sea security conference in November.
To demonstrate how easily the vulnerability can be triggered, Wardle published proof-of-concept command-line interactions. In his demonstration, Wardle executed a basic terminal command that surreptitiously passed an unauthorized prompt to Meta’s backend server endpoints. When queried directly by the command about how an unprivileged local process could successfully send commands to the assistant, Muse generated a response asserting that such unprivileged interaction was impossible—even as the system was actively processing and responding to the malicious command.
The extraordinary system permissions required for autonomous agents like Muse to function as intended impose a heavy responsibility on developers to ensure robust security architectures. The findings demonstrate that contrary to Meta’s marketing claims regarding privacy and security, high-privilege AI assistants can introduce unprecedented security risks when fundamental application hardening is neglected.
