Meta's Muse AI assistant has a zero-day that leaks account tokens
Meta CEO Mark Zuckerberg has promoted Muse, the company's AI assistant, as being "built from the ground up for privacy and security." A zero-day vulnerability undercuts that claim. It lets any locally installed app or executed terminal command change the endpoint where Muse sends audio for transcription, an address that is normally a server operated by Meta. An attacker who redirects that endpoint to a server they control captures the token that authenticates the user to their Muse account, which gives the attacker complete control over it.
Muse, which Meta introduced a few weeks before this report, is pitched as an assistant that books appointments, fills out forms and handles customer service, "proactively takes tasks off your plate," and can make purchases, generate images, create documents, and connect with a user's favorite apps and services. When Muse needs a tool that does not exist, it creates one on the fly. The app runs on macOS only, with no Windows version, and integrates with a user's WhatsApp, email, calendar and social media accounts. Because it runs on macOS, Muse is also granted permissions to operating-system-restricted resources such as the microphone, camera, location and calendar, the same category of resources Apple has spent years walling off from installed apps and terminal commands.
The zero-day exists because Meta's developers let any locally installed app or executed code change a long list of undocumented Muse settings, regardless of what macOS permissions that code actually holds. Most of those settings are minor, such as toggling dark mode, but one of them controls the transcription endpoint, and changing it is what exposes the authentication token to an attacker.
Separately, Amazon began blocking Muse from its site on Sunday. The source does not give a reason for why Amazon began blocking Muse from its site.
Key facts
- A zero-day in Meta's Muse AI assistant lets any locally installed app or terminal command change the endpoint where Muse's transcription is sent, which is normally a server operated by Meta.
- Redirecting that endpoint to an attacker-controlled server captures the token that authenticates the user to their Muse account, giving the attacker complete control over it.
- Meta CEO Mark Zuckerberg said Muse was "built from the ground up for privacy and security," a claim the flaw undercuts.
- The macOS-only Muse app, which has no Windows version, is granted OS-restricted permissions such as the microphone, camera, location and calendar, plus access to a user's WhatsApp, email, calendar and social media accounts.
- Amazon began blocking Muse from its site on Sunday; the article does not state why.
Why it matters
Muse was marketed by Meta's own CEO as security-first, yet the flaw shows the opposite design choice underneath: any code already running on a user's Mac, no matter what macOS permissions it holds, can silently change Muse's settings and redirect where the assistant sends transcription audio, which is enough to steal the account token and take over the assistant entirely. That gap between the marketing claim and the actual privilege model is the story, not just the existence of a bug.
Who it affects
Anyone running the macOS Muse app and any local app or terminal command that runs on the same machine, since the source describes the vulnerable surface as "any locally installed app or executed code," not a remote attack path. There is no Windows version of Muse, so the exposure described in the source is specific to macOS users who have connected accounts like WhatsApp, email, calendar and social media to the assistant.
How to use it
Muse requires a user to authenticate it to each connected service and to grant the macOS app permissions to resources the operating system normally restricts, including writing files to disk, the microphone and camera, and location and calendar access. The source gives no price, licence terms or patch timeline for Muse, so none of that can be reported here.
How solid is it
The account rests on a single published report; the underlying claims are attributed to the article itself rather than to a named researcher, and the source gives no CVE number or other identifier for the flaw, no explanation of how it was discovered or by whom, and no statement from Meta in response.
Risks and caveats
The exploit path described requires code already executing locally on the same Mac as Muse, so it functions as a privilege-escalation and token-theft mechanism for an attacker who already has some foothold on the device, rather than a remote break-in on its own. The source does not say whether or when Meta has patched the flaw, nor does it explain why Amazon began blocking Muse from its site, so no connection between the two events can be drawn beyond their proximity in time.
“built from the ground up for privacy and security”
— Mark Zuckerberg, Meta founder and CEO