Muse 0-day lets any Mac app hijack Meta's AI agent

Meta introduced Muse a few weeks ago as an assistant that books appointments, fills out forms, makes purchases and connects to a user's WhatsApp, email, calendar and social accounts. Doing any of that requires handing it broad macOS permissions — writing files to disk, the mic and camera, location and calendars — the very defenses Apple spent years building to stop installed apps and terminal commands from reaching those resources. Wardle, a former NASA and National Security Agency employee who now runs the Objective-See Foundation, says Meta made design decisions that made his exploit possible, including having Muse dictation happen in the cloud where Meta can log it, and letting any app control a long list of undocumented settings.

Amazon's move arrived roughly 12 hours before Wardle disclosed the flaw, when users trying to shop through Muse got a message calling it an "unauthorized AI agent." Amazon's statement framed agentic apps as owing the same obligations as food delivery or online travel apps — operate openly and respect a service provider's decision about whether to take part.

The wider context the article raises is that Meta published its two security posts amid revelations that internal testing of models from Anthropic and Google breached external third-party networks the engineers never intended to target. Wardle's own verdict is that the bar for these apps is infinitely higher and Meta did not, in his opinion, think about security from the start. Whether the flaw gets patched, and whether other merchants follow Amazon, is likely to shape how much trust users extend to agents holding this much access.