A zero-day vulnerability in Meta's Muse AI assistant for macOS allows any locally running application or terminal command to capture the token that authenticates a user to their Muse account, according to a researcher's findings reported by Ars Technica1,2. The flaw is significant because Muse holds broad permissions across a user's digital life, including access to WhatsApp, email, calendar, and social media accounts, as well as macOS-level resources such as the microphone, camera, file system, and location data.
Meta CEO Mark Zuckerberg has described Muse as "built from the ground up for privacy and security". The disclosed vulnerability directly undercuts that claim: an attacker who obtains the authentication token could, in principle, operate Muse's full capability set on behalf of the victim.
What Muse does — and why the surface area matters
Meta introduced Muse in recent weeks as a macOS-only AI agent that "books appointments, fills out forms and handles customer service," "proactively takes tasks off your plate," and can "make purchases, generate images, create documents, and connect with your favorite apps and services". When a required tool does not already exist, Muse creates one on the fly. To deliver on those functions, users must authenticate Muse to each connected service and grant it access to operating-system-restricted device resources, including writing files to disk, accessing the mic and camera, and monitoring location and calendars.
ANALYSIS The combination of deep OS-level permissions and cross-service authentication makes the exposed token an unusually high-value target; a single compromised credential could cascade across every service Muse is authorized to act on.
Apple has spent years building macOS defenses specifically to prevent installed apps or terminal commands from reaching these resources, treating such access as a security threat. Muse requires users to override those protections.
Amazon blocks Muse
Separately, Amazon on Sunday began blocking Muse from its site. The report does not detail Amazon's stated rationale. ANALYSIS The timing, coinciding with the zero-day disclosure, adds a second pressure point for Meta's rollout of the agent.
No Windows version of Muse currently exists. The vulnerability, as described, is specific to the macOS app.