Zero-Day in Meta's Muse AI Assistant Undoes macOS Defenses

A zero-day vulnerability in Muse, Meta's newly launched AI assistant, gives locally run apps and terminal commands complete control of the agent — directly undercutting CEO Mark Zuckerberg's claim that the assistant is "built from the ground up for privacy and security."

Zuckerberg has gone to great lengths to hype Muse's security posture, but the zero-day raises serious doubts about those assurances. Amazon added its own signal on Sunday, when it began blocking Muse from its site.

Meta introduced Muse a few weeks ago. The assistant "books appointments, fills out forms and handles customer service," "proactively takes tasks off your plate," and can "make purchases, generate images, create documents, and connect with your favorite apps and services," according to Meta's announcement. The macOS app — notably, there is no Windows version — also works with a user's WhatsApp, email, calendar, and social media accounts. When a task requires a tool that doesn't exist, Muse creates one on the fly.

That capability set is exactly what makes the zero-day consequential. For Muse to do any of these things, users must first give it access to their accounts. That includes authenticating the assistant to each service. Because the app runs on macOS, it also means granting it permissions to a broad range of operating system-restricted device resources: writing files to disk, accessing the mic and camera, and monitoring location and calendars.

Apple has spent years developing these defenses specifically to prevent installed apps or terminal-entered commands from reaching those resources, precisely because it considers them a security threat. Muse completely undoes those default measures, concentrating an extraordinary set of privileges behind a single agent.

The stakes go beyond one product. Muse represents a new class of AI assistant that acts across a user's entire digital life — messaging, purchases, documents, and device-level resources — and can improvise new tools at runtime. A zero-day in such an agent does not expose one service; it exposes all of them at once. Amazon's decision to block Muse from its site, coming the same week the vulnerability surfaced, suggests platforms are already treating agentic assistants with sweeping account access as a distinct risk category.

Ars Technica first reported the vulnerability. The company has not yet publicly addressed the flaw or Amazon's blocking, and the question now is whether Meta can patch the zero-day before attackers demonstrate what full control of a hyper-privileged agent can actually do.