Meta's Muse Faces Serious Zero-Day Allowing Privilege Takeover
Unpatched flaw reported in Meta's AI assistant Muse allows credential theft from device.
Based on reporting by Dan Goodin for Ars Technica.
Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of its new AI assistant Muse, claiming it is “built from the ground up for privacy and security.” A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts.
The zero-day allows any app or terminal command to gain access to the token that authenticates users to their Muse account.
“We can manipulate the agent and leverage its privileges to do whatever we want,” Patrick Wardle, the macOS security expert who discovered the zero-day, told Ars.
Editorial Opinion
In the short term, we expect a reassessment of Muse for macOS operations. Limits on enterprise use and renewed reviews of granted permissions could spread. We assess that attention is focused on whether Amazon’s blocking move will spread to other companies.
In the long term, we expect the design principles for highly privileged assistants to be called into question. We assess that architectures bundling device permissions with external service integrations combine convenience with danger. Separation of privileges and isolation of credentials are expected to become standard requirements.
We expect the question of how much privilege assistants should be given to remain. There are doubts about whether displays allow users to fully grasp the scope of permissions. We assess that designs that loosen default protections for convenience are being called into question.
References
- “Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day”, by Dan Goodin — Ars Technica, 2026-09-21T22:24:38.000Z (CC BY-NC-ND)
- Source URL: https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/
Frequently Asked Questions
- What should users watch for when using highly privileged assistants
- We see a need to check how far granted permissions extend to external integrations and device operations. We assess that disabling unnecessary integrations and limiting the scope of use is advisable. For organizational use, we expect pre-deployment permission reviews to become important.
- What is expected to be prioritized in future assistant design
- We expect least privilege and isolation of credentials to be central. We assess that implementations that do not bypass device protections will be required. Transparency in explaining permissions to users will also be an issue.
Comments