Mark Zuckerberg said Muse was "built from the ground up for privacy and security." A zero-day vulnerability in the macOS AI assistant, disclosed this week, contradicts that claim in the starkest terms possible. The flaw gives any locally installed application or terminal command complete control over a user's Muse account, regardless of the macOS permissions that app holds. Amazon has already begun blocking the assistant from its site.
What Muse actually does
Muse launched a few weeks ago as a macOS-only assistant with broad ambitions. It books appointments, fills forms, handles customer service, makes purchases, generates images, creates documents, and connects to third-party apps and services. It integrates with WhatsApp, email, calendars, and social media accounts. When a task requires a tool that does not exist, Muse creates one on the fly. To do any of this, users authenticate the assistant to each service they want it to access and grant it permissions to macOS-restricted resources like the filesystem, microphone, camera, location, and calendar data.
Apple has spent years building permission boundaries to prevent installed apps and terminal commands from accessing those resources. Muse undoes those defenses entirely.
How the vulnerability works
The core flaw is simple. Muse exposes a long list of undocumented settings that any local process can modify. Most are harmless, dark mode toggles and similar preferences. One is not. The setting controls the endpoint where voice transcription occurs. By default it points to a Meta-operated server. An attacker can change it to point to an endpoint they control.
Once the endpoint moves, every transcription request goes to the attacker's server instead of Meta's. Those requests carry the authentication token for the user's Muse account. That token grants full access to everything the assistant can reach, all connected services, all authenticated accounts. The attacker needs no special macOS permissions. A unsigned app, a script, or a terminal one-liner is enough. The entire chain runs within the normal permission model that Apple designed to prevent exactly this kind of escalation.
Why this matters beyond Muse
The vulnerability exposes a fundamental architectural problem with AI assistants that integrate deeply with operating systems and third-party services. Muse is not a casual chatbot. It holds credentials for email, messaging, calendars, and social platforms. It can make purchases and create documents. The attack surface is not a single service. It is every service the user connected.
And the attack requires no social engineering. There is no phishing email to click, no malicious link to follow. The victim simply has to have Muse installed and running. Any other application on the system, including those downloaded from the Mac App Store with sandbox restrictions, can reach the undocumented settings interface and redirect transcription.
Meta's response and Amazon's reaction
Meta has not publicly detailed a patch timeline. The company's marketing around Muse emphasized privacy and security as foundational design principles, language that now reads as premature. Amazon's decision to block the assistant from its site suggests the company's security team assessed the risk as material, particularly for any integration involving account credentials or purchase flows.
The incident follows a pattern in the AI industry where features ship faster than threat models mature. AI assistants that create tools on the fly and hold persistent authentication tokens across multiple services represent a new class of high-value target. The security boundaries that kept those services separate from each other and from local system resources collapse when a single agent holds keys to all of them.
For developers building or integrating AI assistants, the lesson is direct. An undocumented settings interface reachable by local processes is not a feature. It is an attack surface. The permission model of the underlying operating system exists for a reason, and AI assistants that bypass it inherit every vulnerability that model was designed to prevent.