Introduced just weeks ago, **Muse** is designed to streamline user tasks, offering capabilities from booking appointments and filling forms to making purchases and generating images. The macOS-only application integrates deeply with a user's **WhatsApp**, email, calendar, and social media accounts, even creating tools on the fly when needed. ### Deep Access, Deeper Concerns For **Muse** to function as intended, users must grant it extensive access to their accounts and macOS system resources. This includes authenticating with various services and allowing permissions for sensitive device resources like disk writing, microphone and camera access, and location monitoring. These are precisely the types of permissions **Apple** has spent years securing to prevent unauthorized access by installed applications or terminal commands. However, a severe zero-day vulnerability, discovered by macOS security expert **Patrick Wardle**, completely undermines these default security measures. The flaw allowed any locally installed app or executed code to access the token authenticating users to their **Muse** account. Crucially, it enabled processes to alter the endpoint where transcription occurs, normally a **Meta**-operated server. Attackers could have redirected this to their own endpoint, thereby obtaining the full control token for the **Muse** account. "We can manipulate the agent and leverage its privileges to do whatever we want," **Wardle** told Ars ahead of the hotfix. "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." **Wardle** developed proof-of-concept attacks, demonstrating how malicious files could be written to disk and pictures taken without user notification. **Meta** released a hotfix patching the zero-day more than 12 hours after this post went live. ### Questionable Design Choices Under Scrutiny **Wardle** highlighted several design decisions by **Meta** developers that made the exploit possible. One key choice was to handle **Muse** dictation in the cloud, where **Meta** can log it, rather than utilizing macOS's built-in on-device transcription capabilities. Had the latter, more secure option been chosen, the attack would have been impossible. Another critical flaw was allowing any app to control a broad range of undocumented settings, including the sensitive transcription endpoint. While some UI settings might understandably be controllable by other apps, the ability to redirect the processing of sensitive user speech presents a grave security oversight. "To me, the bar is infinitely higher in terms of the security of these apps. They don't have to be perfect, but when you take a look at **Muse**, it's like they didn't, in my opinion, think about security, which is really worrisome," **Wardle** stated. "At the very least, they should be thinking about security from the very start, and they are just not." ### Amazon Blocks Muse, ClickFix Attacks Loom Adding to the controversy, **Amazon** began blocking **Muse** from its site approximately 12 hours before **Wardle** disclosed the zero-day. Users attempting to shop with **Muse** received a message indicating it was an "unauthorized AI agent [that] violates **Amazon's** Conditions of Use." "We think it's fairly straightforward that third-party applications that offer to make purchases on behalf of customers from other businesses should operate openly and respect service provider decisions about whether or not to participate," **Amazon** explained in a statement. **Wardle**, the founder of the **Objective-See Foundation** and author of *The Art of Mac Malware*, plans to elaborate on this vulnerability and other AI assistant threats at the **Objective by the Sea** security conference in November. He demonstrated that a simple variation of a **ClickFix** attack—a social engineering technique highly effective in tricking users into infecting their devices—is sufficient to take control of a **Muse** account. This directly contradicts **Meta's** statement that the zero-day was "not a remote exploit," as **ClickFix** attacks achieve a similar effect through user interaction. **Meta** has yet to explain its choice of cloud-based transcription over the more secure on-device **macOS** option, nor has it acknowledged that the flaw dismantled a security architecture painstakingly built by **Apple**. The extraordinary access required by **Muse** demands a higher standard of security design, a standard that, according to **Wardle** and the evidence, **Meta** has seemingly failed to meet.