A 0-day in Meta's Muse AI lets locally run apps and terminal commands seize full control of the agent — as Amazon begins blocking Muse from its site.
Meta's Muse Has a 0-Day, and It's a Big One
Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of the company's new AI assistant, Muse, claiming it is "built from the ground up for privacy and security." A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts about that framing. Further raising questions, Amazon on Sunday began blocking Muse from its site.
The combination is uncomfortable for Meta: a flagship assistant marketed on trust, an unpatched local vulnerability that hands over the keys, and a major e-commerce platform quietly cutting it off at the door.
What Muse Is Supposed to Do
Meta introduced Muse a few weeks ago. The assistant is pitched as an agentic layer that sits on top of your digital life. According to its positioning, it:
- "books appointments, fills out forms and handles customer service"
- "proactively takes tasks off your plate"
- can "make purchases, generate images, create documents, and connect with your favorite apps and services"
The client is a macOS app — curiously, there is no Windows version — and it also works with a user's WhatsApp, email, calendar, and social media accounts. When a task requires a tool that doesn't exist, Muse creates one on the fly.
That ability to synthesize new tools on demand is exactly what makes Muse useful. It is also what makes its local security posture so consequential.
The Privilege Bargain Behind Agentic AI
Of course, for Muse to do any of these things, users must first give it access to their accounts. This includes authenticating the assistant to each service and, because the app runs on macOS, giving it permissions to a broad range of operating system-restricted device resources, like writing files to disk, accessing the mic and camera, and monitoring location and calendars.
What Muse Asks For on macOS
Muse permission surface (macOS):
- read / write files on disk
- microphone access
- camera access
- location monitoring
- calendar monitoring
- authentication to each connected serviceApple has spent years developing these defenses to prevent installed apps or commands entered into the terminal from accessing these resources, clearly because the company considers them a security threat. Muse completely undoes these default measures.
Zuckerberg's pitch — "built from the ground up for privacy and security" — rests on the assumption that the agent's local surface can be trusted. A 0-day is the exact scenario that assumption ignores.
Why a Local 0-Day Is Worse Than It Sounds
The vulnerability class matters as much as the vulnerability itself. This is not a flaw in a remote endpoint that Meta can patch on its own schedule — it lives in the local execution path, and it grants locally run apps and terminal commands complete control of the agent.
The logic is straightforward: any local process that can commandeer Muse inherits the full permission set the user granted it. That means the same accounts, the same files on disk, the same microphone and camera, and the same location and calendar streams. Apple's sandboxing model exists precisely to stop installed apps or terminal commands from reaching those resources — a defense Muse is described as undoing by default.
The more capable the agent, the broader the blast radius of a single local bug. Muse was designed to be extraordinarily privileged. It is now demonstrably exploitable at that privilege level.
Amazon Draws a Line
Further raising questions, Amazon on Sunday began blocking Muse from its site. For an assistant explicitly designed to "make purchases," losing access to one of the world's largest retail platforms is not a minor operational inconvenience — it directly undercuts a headline capability.
Why Amazon acted, and whether the block is permanent, aren't spelled out. But the timing — days into a public security controversy — is hard to ignore.
The Trust Paradox of a Super-Privileged Assistant
Muse sits at the center of a tension that every agentic AI vendor now faces. To be genuinely useful, an assistant needs deep access: accounts, files, sensors, calendars, payments. To be genuinely safe, it needs to be locked down so tightly that those same capabilities become hard to deliver.
Meta chose reach. It authenticated Muse into WhatsApp, email, calendar, and social accounts, handed it OS-level permissions Apple engineered to restrict, and let it spawn new tools when nothing suitable exists. That design produces a compelling demo and a very large attack surface.
- The capability story: Muse books, buys, drafts, and connects on your behalf.
- The security story: a zero-day gives local apps and terminal commands complete control of it.
- The third-party story: Amazon has begun blocking it.
A single unpatched local flaw doesn't just compromise an app — in an agentic architecture, it compromises everything the agent was trusted with. That is the lesson Muse is currently teaching the industry the hard way.