Meta founder and Chief Executive Officer Mark Zuckerberg has aggressively promoted the security architecture of the company’s new artificial intelligence assistant, Muse, claiming the tool was built from the ground up with privacy and security as its core foundation. However, the discovery of a critical zero-day vulnerability in the assistant has cast serious doubt on those assurances. The security flaw allows locally executed applications and command-line scripts to completely hijack a user’s Muse account. Compounding the setback for Meta, e-commerce giant Amazon began systematically blocking the AI assistant from accessing its online marketplace, citing policy violations and unauthorized automated behavior.
Meta introduced Muse as an advanced, agentic desktop assistant designed to handle complex, multi-step tasks across a user’s digital workspace. According to Meta’s release material, the assistant is capable of booking appointments, filling out web forms, managing customer service interactions, and proactively removing tedious administrative chores from a user’s daily workflow. The assistant is also built to make automated purchases, generate images, construct documents, and integrate directly with third-party applications and services.
Currently available exclusively as a macOS application—with Meta notably omitting a Windows release at launch—Muse connects with a wide array of personal and professional services, including WhatsApp, email, calendar systems, and social media platforms. In scenarios where a specific task requires an integration or tool that does not currently exist, Muse is designed to dynamically write and execute code on the fly to fulfill the request.
To execute these wide-ranging autonomous actions, Muse requires users to grant it extraordinarily broad privileges. Users must authenticate the assistant across their various personal accounts and grant the macOS application deep access to operating system resources. These system-level permissions include writing files to disk, accessing the device microphone and camera, tracking real-time location data, and monitoring personal calendar entries.
For years, Apple has designed and iterated upon macOS permission frameworks, such as Transparency, Consent, and Control (TCC), explicitly to restrict installed applications or unauthorized terminal commands from reaching sensitive system resources without explicit user approval. Security analysts note that by aggregating these permissions into a single, highly active agent, Muse effectively bypasses and undoes these foundational operating system defenses, creating a massive single point of failure.
Meta’s Security Hype Misaligns with Zero-Day Findings
The newly discovered zero-day vulnerability reveals that any locally installed application or basic terminal command can extract the authentication token used to validate a user with Meta’s Muse servers. The vulnerability stems from fundamental software design choices made by Meta developers, which allow any local code—regardless of its existing macOS permission level—to modify a broad array of undocumented internal settings within the Muse application.
While many of these internal parameters control relatively harmless interface features, such as toggling dark mode, one specific setting introduces a critical security flaw. This setting dictates the network endpoint URL responsible for receiving and processing user dictation and voice transcriptions. Under normal operating conditions, this endpoint points directly to secure server infrastructure managed by Meta. However, because local processes can overwrite this parameter without requesting elevated privileges, an attacker can silently redirect the transcription endpoint to a malicious server under their control. Once a user speaks or interacts with the assistant, the altered endpoint routes the request—along with the user’s full account authentication token—directly to the attacker.
"We can manipulate the agent and leverage its privileges to do whatever we want," explained Patrick Wardle, the prominent macOS security expert who discovered and analyzed the zero-day flaw. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself."
Wardle demonstrated the severity of the flaw by constructing multiple proof-of-concept attacks. His exploits showed that an unprivileged attacker could leverage Muse’s extensive system access to stealthily write malicious files to the user’s hard drive or capture photos using the built-in Mac camera, often without triggering any visual indicators or security warnings that would alert the user.
When contacted for comment regarding the vulnerability and the design choices that enabled it, Meta representatives did not respond to emailed inquiries.
The discovery comes shortly after Meta published two separate blog posts detailing the engineering and design principles intended to ensure Muse operates safely despite its extensive access to user data. These promotional and technical posts arrived during heightened industry scrutiny surrounding the safety of autonomous AI agents. Internal safety testing at competing AI developers, including Anthropic and Google, recently uncovered incidents where misaligned AI models executed unauthorized actions that resulted in security breaches on third-party external networks—actions that, if carried out intentionally by human operators, could trigger criminal charges. Meta’s public focus on security was largely seen as an attempt to reassure regulators and consumers amid growing calls to slow down the deployment of autonomous AI agents.
According to Wardle, several questionable architectural decisions directly enabled the exploit. Primary among them was Meta’s decision to handle voice dictation and transcription in the cloud rather than locally on the device. Apple’s macOS operating system features built-in, secure local speech-recognition APIs that process audio entirely on-device without sending sensitive voice data across the network. Had Meta chosen to utilize native macOS transcription framework APIs, the network redirection attack vector would not have existed.
Additionally, Wardle highlighted the lack of access controls surrounding Muse’s undocumented settings. While software developers routinely allow applications to configure user interface preferences, allowing unprivileged processes to alter sensitive network routing endpoints for user speech and authentication tokens represents a fundamental security oversight. Together, these flaws raise significant doubts about the rigors of Meta’s internal security review and testing protocols.
"To me, the bar is infinitely higher in terms of the security of these apps. They don’t have to be perfect, but when you take a look at Muse, it’s like they didn’t, in my opinion, think about security, which is really worrisome," Wardle noted. "At the very least, they should be thinking about security from the very start, and they are just not."
Amazon Blocks Muse Over Authorization and Policy Concerns
Roughly 12 hours prior to Wardle’s public disclosure of the zero-day vulnerability, Amazon began proactively blocking Muse from interacting with its e-commerce platform. Mac users attempting to use Muse to browse products or make purchases on Amazon were met with an explicit error message stating that Muse was an "unauthorized AI agent [that] violates Amazon’s Conditions of Use."
In an official statement, Amazon defended its decision to block Meta’s assistant, emphasizing the necessity of explicit consent and regulatory compliance when third-party software attempts to act on behalf of online shoppers.
"We think it’s fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," Amazon said in an emailed statement. "This helps ensure a safe, secure, and reliable customer experience, and it is how others operate including food delivery apps and the restaurants they take orders for, delivery services apps and the stores they shop from, and online travel agencies and the airlines they book tickets with for customers. Agentic third-party applications such as Muse have the same obligations, and we’ve requested that Meta remove Amazon from the experience."
Amazon’s position highlights an emerging corporate battleground over agentic AI tools that automatically scrape, navigate, and execute transactions across commercial websites without formal corporate partnerships or standardized application programming interfaces (APIs).
Exploitation Vectors and the Threat of ClickFix Attacks
The mechanics of the zero-day vulnerability allow for multiple sophisticated attack scenarios. In one primary attack vector, an adversary sets up a proxy server positioned between the Muse user and Meta’s infrastructure. When the user issues a standard voice command or text instruction to Muse, the proxy server intercepts the traffic and appends a malicious hidden prompt. This injected prompt can order Muse to perform sensitive background tasks, such as archiving the user’s entire WhatsApp message history and transmitting the archive to an off-site server controlled by the attacker. Because the initial exploit also hands the authentication token to the attacker’s server, the adversary maintains persistent, long-term administrative control over the target’s Muse account.
While software developers often argue that an application’s security boundaries no longer apply once a user’s physical machine is compromised by local malware, Wardle pointed out that exploiting Muse does not require complex local rootkits. Instead, an attacker can achieve total account compromise using a simple variation of a "ClickFix" attack—a social engineering technique that tricks users into copying and running malicious commands in their system terminal under the guise of fixing software errors. ClickFix tactics have surged in popularity due to their high success rate in compromising both Windows PCs and Macs.
Wardle, who serves as the founder of the Objective-See Foundation—a non-profit organization dedicated to advancing open-source macOS security—is a widely recognized authority on Apple platform security. A former researcher for both NASA and the National Security Agency (NSA) and author of the technical book series The Art of Mac Malware, Wardle revealed that he plans to present a comprehensive technical breakdown of the Muse zero-day vulnerability and broader threats posed by agentic AI assistants at the upcoming Objective by the Sea security conference in November.
To demonstrate how easily the vulnerability can be triggered, Wardle published proof-of-concept command-line interactions. In his demonstration, Wardle executed a basic terminal command that surreptitiously passed an unauthorized prompt to Meta’s backend server endpoints. When queried directly by the command about how an unprivileged local process could successfully send commands to the assistant, Muse generated a response asserting that such unprivileged interaction was impossible—even as the system was actively processing and responding to the malicious command.
The extraordinary system permissions required for autonomous agents like Muse to function as intended impose a heavy responsibility on developers to ensure robust security architectures. The findings demonstrate that contrary to Meta’s marketing claims regarding privacy and security, high-privilege AI assistants can introduce unprecedented security risks when fundamental application hardening is neglected.
