Meta launches Muse with privacy claims

Meta founder and CEO Mark Zuckerberg introduced Muse, an AI assistant that books appointments, fills forms, makes purchases, and connects to apps. It runs on macOS and accesses WhatsApp, email, calendars, and social accounts.

Muse requires extraordinary device access

To function, Muse needs permission to write files to disk, access the microphone and camera, monitor location and calendars. Apple built these defenses over years to prevent apps and terminal commands from accessing them.

A zero-day lets attackers hijack Muse

Any locally installed app or terminal command can change undocumented Muse settings, including where voice transcription is processed. Attackers could redirect this to their own server and steal the authentication token.

Security researcher discovers the flaw

Patrick Wardle, a macOS security expert, found the zero-day and developed proof-of-concept attacks that write malicious files and take pictures with no user indication. He told Ars Technica the vulnerability is serious.

“We can manipulate the agent and leverage its privileges to do whatever we want.”

Wardle criticizes Meta's design choices

Meta chose cloud-based transcription so it could log voice data, rather than using macOS's built-in on-device option. It also allowed any app to control all undocumented settings, not just user interface controls.

Wardle questions Meta's security thinking

The security researcher said the bar for AI assistant security is infinitely higher because of their access to user data. He believes Meta did not think about security from the start, which is worrisome.

“They didn't, in my opinion, think about security, which is really worrisome.”

Amazon blocks Muse from its platform

Roughly twelve hours before Wardle disclosed the zero-day, Amazon started blocking Muse users from shopping on its site. Amazon said Muse was an unauthorized AI agent that violates its conditions of use.

Amazon demands third-party AI oversight

Amazon said agentic applications making purchases on behalf of customers must operate openly and respect service provider decisions, just as food delivery apps and travel agencies do. It asked Meta to remove Amazon from Muse.

ClickFix attacks can trigger the exploit

Wardle demonstrated that a simple terminal command can send a prompt to Meta's endpoint and trigger a response. A ClickFix social engineering scam could easily trick users into running such commands.

Meta patches the flaw but avoids questions

Meta released a hotfix more than twelve hours after Wardle's disclosure. The company's statement called it not a remote exploit, ignoring that ClickFix attacks achieve the same effect through social engineering.

Meta dismantled Apple's security architecture

Meta's design choices undid years of Apple defenses built to prevent apps and terminal commands from accessing sensitive device resources. Meta has not explained why it chose cloud transcription over on-device processing.

Muse cannot be trusted despite claims

The extraordinary access Muse requires places an additional burden on its designers. Contrary to Meta's privacy and security claims, Muse cannot be trusted, and it is unclear when or if it ever can be.