Meta hardens Muse warnings after two vulnerabilities exposed the agent’s unusually broad reach

Meta is adding a clearer in-product warning to Muse after a bug-bounty researcher found a flaw that could have let an attacker reach a user’s virtual machine, where emails and files may be present. The company classified the problem as SEV-2, the third-highest level in its five-tier system. Muse had been downloaded 2.8 million times in its first two weeks, so even a narrow defect deserved a rapid, visible response.

A separately disclosed macOS zero-day illustrated a different path to the same prize. A local application—or a command induced through social engineering—could redirect Muse’s transcription endpoint, steal its authentication token and take control of the agent without requesting special macOS permissions. Meta issued a hotfix about 12 hours after disclosure. The researcher described a ClickFix-style attack in which a victim is persuaded to paste a command; Meta emphasized that this was not a conventional remote exploit.

These should not be collapsed into one incident. The first concerns access to Muse’s hosted working environment; the second concerned local token theft on macOS. Together, however, they reveal a shared architectural risk. Muse can interact with WhatsApp, email, calendars, social accounts, the disk, microphone, camera and location. Compromising the agent can therefore bypass the many separate prompts and permission checks that would normally protect those systems.

A warning is useful but cannot carry that security burden. High-privilege agents need short-lived, narrowly scoped tokens; explicit confirmation before consequential actions; strong isolation between local inputs and cloud sessions; and an activity log users can audit and revoke. The more an assistant becomes a universal control plane, the less adequate ordinary app-style permission design becomes.