Meta Muse launched with a zero-day. Here is what to check.

Meta launched Muse, its personal AI agent, with a prominent promise from CEO Mark Zuckerberg that it is "built from the ground up for privacy and security." The agent can book travel, send emails, fill out forms, handle customer service, make purchases, and create tools on the fly when existing ones fall short. It runs as a dedicated app on iOS and Android, at Muse.ai, and via WhatsApp. A macOS desktop version also exists. To do any of this, Muse needs broad access to your accounts, your calendar, your microphone and camera, your location, and your files.

That combination, deep account access meeting fresh software, is exactly where security researchers look first. Within weeks of launch, macOS security expert Patrick Wardle found a zero-day vulnerability that handed any locally installed app or terminal command complete control over a user's Muse account. Meta has since released a hotfix, but the episode raises questions worth sitting with before you connect your accounts to any AI agent.

What the Muse zero-day vulnerability actually did

Wardle discovered that Meta designed Muse so that any locally running code, regardless of what macOS permissions it held, could alter a long list of undocumented application settings. Most of those settings were harmless, covering things like dark mode. One was not. Any process could change the endpoint where Muse sends its transcription data. Normally that endpoint is a Meta server. An attacker could redirect it to their own server instead, and in doing so receive the authentication token that gives full control of the Muse account. "We can manipulate the agent and leverage its privileges to do whatever we want," Wardle told Ars Technica. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." He developed proof-of-concept attacks that wrote malicious files to disk and triggered the camera, often with no visible sign to the user. Meta released a hotfix more than 12 hours after the story was first published.

Why the access Muse requests makes any flaw more serious

The reason this vulnerability mattered so much is the same reason Muse is useful at all. Because the macOS app connects to WhatsApp, email, calendars, social media, and location, a compromised Muse account puts a meaningful slice of your digital life at risk beyond the agent itself. Apple spent years building permission barriers to stop installed apps from quietly accessing these resources. The macOS version of Muse requires users to grant permissions that bypass many of those barriers. Amazon separately began blocking Muse from its site around the same time the vulnerability became public, saying agentic apps that make purchases on a customer's behalf should operate openly and respect a retailer's decision not to participate. Meta does include some structural protections: a Secure VM architecture isolates each user's activity in a virtual machine, and a component called Sentinel monitors what data leaves that environment. Payments go through Stripe's Link system, which issues single-use card numbers rather than exposing real payment details. Those features are real, but they did not prevent the zero-day.

Meta's trust problem and the wider AI agent context

Meta is not the only company building AI agents with this kind of reach. Muse was developed inside Meta Superintelligence Labs to compete with agents like OpenClaw and Instinct. The launch comes as separate incidents involving internal testing of Anthropic and Google models resulted in unintended security breaches of external networks, putting the whole sector under scrutiny. Meta published two posts in as many weeks explaining its security design decisions, which reads as a direct response to that pressure. The company has a long history of public trust difficulties, and asking users to hand Muse access to their most sensitive accounts is a significant ask, even with the hotfix now applied.

What to check before connecting accounts to Muse or any AI agent

If you are evaluating Muse or a similar agent, a few practical checks are worth doing. First, confirm you are running the latest version. Meta issued the hotfix after the zero-day was reported, so any installation that has not updated since launch may still carry the original flaw. Second, audit what permissions the app actually holds on your device, particularly microphone, camera, location, and file system access, and revoke anything the agent does not need for the tasks you actually use it for. Third, consider which accounts you connect. Linking a secondary calendar for scheduling is a lower-risk starting point than linking your primary email or social media accounts. Fourth, check whether the services you rely on have taken any steps to restrict Muse access, as Amazon's move to block the agent shows that third-party platforms may make their own decisions independently of Meta. The payment protection via Stripe Link is a genuine safeguard for purchases, but it does not protect the rest of your connected accounts if an authentication token is exposed.