Meta’s Muse AI Assistant Exposed a Dangerous Security Gap as Amazon Blocks Shopping Access

Meta’s new AI assistant Muse has been hit by a serious zero-day flaw that could let a local app or terminal command take over an account and access sensitive data, while Amazon separately moved to block the assistant from shopping on its platform. The twin developments cast fresh doubt on Meta’s claims that Muse was built “from the ground up” for privacy and security.

The vulnerability matters because Muse is designed to handle high-trust tasks such as booking appointments, filling out forms, making purchases, and connecting to services like email, calendars, WhatsApp, and social media. A flaw that exposes the account token behind those capabilities turns a convenience tool into a potential security liability.

What happened with Meta’s Muse?

Meta launched Muse only weeks ago, pitching it as an assistant that can complete routine work, connect with personal accounts, and even create documents or images when asked. The app currently runs on macOS, and Meta has not released a Windows version.

Security researcher Patrick Wardle later found a zero-day flaw that made it possible for a locally installed app or terminal command to gain control over the token used to authenticate a user’s Muse account. In practical terms, that token could have given an attacker broad control over the assistant and, by extension, access to the services tied to it.

Meta said it released a hotfix more than 12 hours after the issue was publicly disclosed.

Why the flaw is so serious

The problem is not just that Muse was vulnerable; it is that the flaw reached through multiple layers of macOS protections that Apple uses to keep apps and commands from touching sensitive device resources without permission.

To function, Muse asks users to connect accounts and grant broad access to operating-system features, including the microphone, camera, files, location, and calendars. Those permissions are already a major trust decision. The zero-day undermined them further by letting local software change internal settings that Meta appears to have intended for safer, user-facing purposes.

One of those settings controlled where speech transcription occurred. Instead of staying on-device, transcription happened in Meta’s cloud. Wardle said that design choice created an opening for attackers to redirect the process to a malicious endpoint and capture the token that secures the account.

How could an attacker exploit it?

According to Wardle, the attack could be carried out by placing a malicious server between the user and Meta’s endpoint or by using a simple social-engineering trick to run a command on the victim’s Mac. In both cases, the result was the same: the attacker could manipulate Muse into sending sensitive data or commands to an endpoint they controlled.

Wardle said the exploit could be triggered with a variation of the ClickFix technique, a scam in which victims are tricked into pasting or running a command that installs or enables malicious behavior. That matters because it means the weakness was not purely theoretical or limited to deep system compromise.

Wardle said the assistant’s privileges could be abused to perform actions that would otherwise require attackers to build custom malware, including writing files to disk and taking pictures.

He added that some proof-of-concept attacks he developed could work with little or no visible warning to a user, which raises the stakes for anyone relying on the assistant for day-to-day work.

How did Meta’s design choices contribute?

The exploit appears to have depended on architectural decisions that gave local software more control than security experts would normally expect from a product with access to personal accounts.

Wardle argued that Meta could have reduced risk by using the on-device transcription option already built into macOS, rather than routing speech processing through the cloud. That would have kept more sensitive data inside the operating system’s standard privacy protections.

He also said Meta allowed almost any local process to modify a broad set of undocumented settings. Some of those settings were harmless, such as dark mode. But others reached into sensitive areas, including the location where transcription traffic was sent. That is a very different kind of control surface than a simple appearance setting.

The result, he said, suggested that security may have been an afterthought rather than a foundational part of the assistant’s architecture.

What did the security researcher say?

Wardle, who is well known in the macOS security community and founded the Objective-See Foundation, said AI assistants that hold this much power should face a much higher security bar than ordinary desktop apps.

He said the issue appeared to show that security had not been treated as a first-order design requirement and warned that products with this level of access need to be engineered and tested with far greater care.

Wardle plans to discuss the vulnerability and broader AI-assistant risks at the Objective by the Sea security conference in November.

Why Amazon blocked Muse

Roughly 12 hours before Wardle disclosed the zero-day, Amazon began blocking users from using Muse to shop on its site. People who tried received a notice saying the assistant was an unauthorized AI agent and violated Amazon’s conditions of use.

Amazon said third-party applications that purchase goods on behalf of customers should do so openly and should respect the choices of the businesses they interact with. The company pointed to examples such as delivery apps, travel booking platforms, and food-ordering services, arguing that agentic AI tools should follow similar rules.

In an emailed statement, Amazon asked Meta to remove Amazon from the Muse experience.

Why does this matter for AI shopping agents?

It matters because the incident highlights a growing conflict between AI companies that want assistants to act on users’ behalf and major platforms that want direct control over how third-party automation interacts with their services.

As AI agents become able to make purchases, fill out forms, and carry out account actions, companies like Amazon may push back when those tools operate outside established partner frameworks. That is especially true when an assistant can take action without a clear, trusted integration layer.

What Meta said about security and privacy

Meta has spent the past several weeks making a public case that Muse was designed to be private and secure. The company published multiple posts describing the reasoning behind its design decisions and emphasizing protections around user data.

Those messages landed awkwardly as researchers and industry observers continue to raise alarms about AI models and agents behaving in ways their developers did not intend. Meta’s public stance also comes at a time when internal testing of systems from other AI companies has reportedly produced security incidents involving external networks.

Meta has not fully explained why Muse used cloud-based transcription rather than the safer local option embedded in macOS, nor has it addressed all of the security concerns raised by Wardle’s findings.

How the attack worked in practice

The exploit path was complicated enough to require some technical sophistication, but not so complicated that it could be dismissed as hypothetical. That distinction matters because security teams often treat bugs as less urgent if they seem too hard to weaponize.

Wardle described a chain in which local software could alter Muse settings, redirect transcription traffic, and ultimately obtain the authentication token associated with the account. Once an attacker had that token, they could potentially operate the assistant as if they were the legitimate user.

In one demonstration, Wardle used a simple terminal command to send a prompt in a way that masked the attacker’s lack of privileges. Muse reportedly responded incorrectly, suggesting that the action would not have been possible from an unprivileged source.

Why this vulnerability is about more than one app

Muse is not the first AI agent to raise questions about trust, but it is a vivid example of the tradeoffs involved when a system is allowed to act with human-like authority. The more an assistant can do, the more damaging a compromise becomes.

That creates a difficult design problem for AI companies. If the assistant is too restricted, it becomes less useful. If it is too powerful, a bug or social-engineering trick can turn it into an attack surface with outsized reach.

This is why security researchers increasingly argue that AI agents need a different standard than consumer chatbots. A model that merely answers questions is not the same thing as one that can send messages, access calendars, make purchases, and create tools on demand.

The issue also underscores a broader tension in the industry: companies are racing to add agentic features while the underlying security practices are still catching up. The result can be a product that looks futuristic but inherits familiar weaknesses from software history, including privilege escalation, token theft, and social engineering.

What happens next?

Meta has already patched the known issue, but the bigger story is just beginning. The release of Muse and the quick emergence of a serious security bug will likely intensify scrutiny of how AI assistants are built, tested, and deployed.

Questions remain about whether cloud transcription was the right choice, why undocumented settings were accessible to any local process, and how much independent security validation happened before launch. Those questions matter not only for Meta, but for any company building a tool that can act on a user’s behalf.

Amazon’s block adds another layer of uncertainty. If major platforms increasingly refuse to work with third-party agents, AI companies may face a fragmented environment where assistants can act only where service providers permit them to do so.

For now, Muse remains a case study in the gap between AI ambition and operational security. It is a reminder that giving software broad authority is not just a product decision; it is a trust decision with real consequences when the safeguards fail.

• Muse was promoted as a privacy-focused AI assistant with access to personal accounts and device features.
• A zero-day flaw allowed local software or terminal commands to potentially hijack the account token behind the assistant.
• Wardle said the exploit could be triggered through social engineering, not only full device compromise.
• Amazon blocked Muse from shopping on its site, calling it an unauthorized AI agent.
• The episode raises broader questions about how agentic AI should be secured before it is widely deployed.