Muse, Meta's highly favored AI assistant, suffers from a critical zero-day vulnerability

A newly discovered zero-day vulnerability in Meta's Muse AI assistant lets any locally installed app or terminal command steal the authentication token for a user's Muse account, undermining the company's privacy pitch at launch. The flaw surfaced weeks after CEO Mark Zuckerberg promoted the assistant as "built from the ground up for privacy and security," and it arrived alongside a separate setback: Amazon began blocking Muse from its site on Sunday.

What Muse Does and Why Access Matters

Meta introduced Muse only a few weeks ago. The assistant books appointments, fills out forms, and handles customer service. It also proactively takes tasks off your plate, makes purchases, generates images, creates documents, and connects with your favorite apps and services. The macOS app — notably, there is no Windows version — links to a user's WhatsApp, email, calendar, and social media accounts. When a task needs a tool that doesn't exist, Muse builds one on the fly.

To perform any of this, users must first hand over their accounts. That means authenticating the assistant to each service and, because the app runs on macOS, granting it broad access to operating system-restricted resources: writing files to disk, using the microphone and camera, and reading location and calendar data. Apple spent years building these protections specifically to keep installed apps and terminal commands away from such resources. Muse effectively dismantles those default safeguards.

How the Zero-Day Works

The vulnerability centers on how Muse stores and validates its configuration. Meta's developers designed the assistant so that any locally installed app or executed code — regardless of its macOS permissions — can modify a long list of undocumented settings. Most are harmless, such as toggling dark mode.

One setting, however, is critical: it lets a local process change the endpoint where transcription takes place. Under normal operation, that endpoint is a server address operated by Meta. An attacker can redirect it to infrastructure under their own control. Once the redirect is in place, the attacker captures the token that authenticates the user to their Muse account, gaining complete control over it.

Amazon Already Pushing Back

Questions about the assistant extend beyond the technical flaw. On Sunday, Amazon began blocking Muse from its site, adding commercial friction to the security concerns.

Muse's launch is a test of how far consumers will go in granting AI agents sweeping account access. The zero-day suggests the permissions model — and how it can be abused by other software already on a machine — deserves scrutiny before such assistants become mainstream. Watch for whether Meta patches the flaw quickly and whether other services follow Amazon's lead.