A researcher says a flaw in Meta's Muse app for Mac lets any app or terminal command gain access to the token that authenticates users to their Muse account
Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of its new AI assistant Muse, claiming it is …
Ars TechnicaDan Goodin
Context & Ripple Effects
Meta expanded Muse from mobile and web to a Mac app with access to files and other apps on September 18, then saw the agent reach the top of Apple’s US free-app ranking. The reported token-access flaw puts security scrutiny on the desktop client precisely as Muse’s distribution and permissions footprint are widening.
The issue also follows reported cybersecurity-testing concerns around Muse Spark 1.1, which Meta attributed to an evaluation-partner sandbox misconfiguration. That makes the boundary between an agent’s capabilities and the local software able to invoke them a central product-security question.
First-order effects
Muse for Mac users face potential account-token exposure to any local app or terminal command able to exploit the reported flaw, requiring Meta to secure the client’s authentication-token handling.
Because Muse can manage files and pull from apps, a compromised token may turn local Mac access into access to actions performed through a user’s Muse account.
Second-order effects
Meta’s rapid Mac rollout faces a sharper trade-off between broad desktop integrations and a security model that prevents other local software from inheriting the agent’s authority.
Security researchers and enterprise buyers will evaluate Muse’s client controls alongside its model capabilities, particularly after the earlier reported sandbox misconfiguration during testing.
Third-order effects
Personal AI agents are becoming a distinct endpoint-security category: account tokens and connected-app permissions can concentrate access that malware previously had to obtain from several separate tools.
If desktop agents continue to combine local data access with account authority, trusted-tool boundaries—not model output alone—will become a competitive and procurement requirement.
The trend: AI assistants are shifting security risk from standalone apps toward the privileged local clients, tokens, and integrations that let agents act across a user’s digital environment.
And once a Mac is exploited, you can interact with any of the users “connected” devices also running Muse. ...meaning you remotely task their mobile (iOS) Muse client ...invisibly 📲🔓👀 What can you do? Welll, some very neat iOS stuff!
this requires local access, so while it needs to be fixed this isn't a doomsday scenario kinda thing i do still think giving contemporary agents root on your own machine is going to result in a lot of painful lessons though lol
#4 Why is this bad? On a scale of meh to f*cked: 🎙️ Steal your dictated audio 💉 Inject prompts Muse trusts/executes 🔑 Steal your auth token & invisibly control Muse directly Anything you gave Muse access to? Now the (local) attacker has it too: msgs, emails, finances... 💀
This is a new class of endpoint risk: personal AI agents. Please don't rush on every AI tool that ships. First understand the privileges you are actually granting. Muse is software with broad access to mail, files, messages, and whatever else you connect.
Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀 Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life. But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it. Let me show you. 🧵
First, one of 0day PoCs: https://github.com/... Run with ‘-h’ for some fun options from the 50+ commands Muse exposes. Then click Muse's 🎙️ and dictate a prompt. That's the trigger. 👀
#3 (This) bug details Muse has an undocumented setting: endo_voyager_dictation_endpoint ...that can be redirected locally with no special privileges! So when you click 🎙️ and dictate a prompt, Muse sends it to the attacker's endpoint instead 🤦♂️
‼️ BREAKING: A zero-day has been released for Muse, Meta's new AI agent, and a Meta AI security engineering manager who left the company this month says he would never use it, citing security and privacy concerns. He was reacting to the zero-day a researcher posted, which lets ma…