Meta's Muse was supposed to be the assistant that finally made an AI agent feel like a real digital employee. Within weeks of launch, it did something few Meta products manage: it climbed to the top of the app charts. Now the same product is at the center of a security storm, after a zero-day vulnerability was disclosed that hands complete control of the agent — and, by extension, the accounts it has been trusted with — to any locally run app or terminal command on the same machine.
The flaw lands as a direct rebuke to the company's marketing. Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype Muse's security, claiming it is:
"Built from the ground up for privacy and security."
— Mark Zuckerberg, Meta CEO
Security researchers describe the vulnerability as raising "serious doubts" about that claim — a stark contrast to the launch narrative that has driven Muse's commercial momentum.
A blockbuster launch built on trust
Meta introduced Muse a few weeks ago as a do-everything agent rather than a chat window. According to the company, the assistant "books appointments, fills out forms and handles customer service," "proactively takes tasks off your plate," and can "make purchases, generate images, create documents, and connect with your favorite apps and services."
The launch has been macOS-only — curiously, there is no Windows version — and the app plugs directly into a user's WhatsApp, email, calendar, and social media accounts. Perhaps its most striking capability is improvisation: when a task requires a tool that doesn't exist, Muse creates one on the fly. That design is precisely what makes the product feel magical, and precisely what makes it dangerous.
Forbes framed the release in commercial terms, noting that Muse "proves real stories drive AI downloads" after topping the app charts — evidence, in that outlet's telling, that consumer AI adoption is now driven by narrative and word of mouth as much as raw capability. Digital Trends struck a similar note, calling the agent "a big hit" while noting that "a big security alarm" had gone off at the same time. MSN's headline went further still: Meta's assistant, it said, suffers from a zero-day "despite promise of privacy and security."
The zero-day: full account control
The technical problem is structural, not cosmetic. For Muse to work at all, users must first authenticate it to each service it touches and, because the app runs on macOS, grant it permissions to a broad range of operating system-restricted device resources — writing files to disk, accessing the microphone and camera, and monitoring location and calendars.
Apple has spent years building defenses to prevent installed apps, or commands typed into the terminal, from reaching those resources — clearly because the company treats such access as a security threat. Those defenses are enforced through layered protections including sandboxing and user-consent prompts.
The reported zero-day defeats that model from the inside. Rather than bypassing Apple's protections outright, it subverts the agent that has already been granted them: locally run apps and terminal commands can seize complete control of Muse, inheriting every authenticated session and every permission the user approved. In practice, that means an attacker who can execute code on the machine may be able to act as the user across email, messaging, cloud documents, and payment methods the agent has been wired into.
- Who is affected: Muse users on macOS who have authenticated the assistant to third-party accounts and granted it system permissions.
- What is at stake: Account credentials, communications, files, camera and microphone access, location data, and the ability to make purchases.
- Patch status: As a zero-day, no publicly available fix existed at the time of disclosure.
Amazon shuts the door
The security disclosure was not the only bad news of the week. On Sunday, Amazon began blocking Muse from its site — a striking move given that the assistant's headline feature set includes making purchases on a user's behalf. Amazon did not immediately explain the decision, and Meta has not publicly responded to either development. But the block lands as retailers and marketplaces grapple with how to treat autonomous agents that transact on their platforms, often without a human in the loop and sometimes against the platform's terms of service.
The bigger picture: agents are a new attack surface
Muse's troubles are a case study in the central tension of the agentic AI era. To be useful, an agent must be powerful, persistent, and deeply credentialed — it needs real keys to real accounts. To be safe, it must be the opposite. Every permission granted to a helpful assistant is a permission an attacker can borrow once the assistant is compromised, and every tool the agent generates on the fly is a piece of code whose provenance is hard to audit.
That is why the disclosure matters beyond a single product. Vibe-driven launches that top app charts can embed themselves in millions of workflows in weeks, long before the security community has had a chance to probe them. When the flaw arrives — and here it arrived within weeks — users have already handed over their calendars, inboxes, and cards.
The competitive pressure is only intensifying. Meta's willingness to ship an unusually privileged assistant reflects a market in which Google, OpenAI, Apple, and Amazon are all racing to own the agent layer. The lesson from Muse's first month may be that the winner will not be the agent that does the most, but the one that can prove it can be trusted with what it has already been given. For Meta, that proof now has to be produced under a spotlight it did not choose.
