Meta launched its new Muse AI assistant with the usual velvet-rope promise: it would book appointments, fill out forms, handle customer service, make purchases, create documents, connect with favorite services, and generally behave like a personal executive assistant that had swallowed a productivity conference. According to reporting from Ars Technica and The Register, security researcher Patrick Wardle has now disclosed a local zero-day in the macOS app that can let local malware redirect Muse dictation traffic and potentially exploit the lavish permissions users granted the assistant.

In luxury terms, the concierge was given keys to the penthouse, the wine cellar, the diary, the microphone, and possibly the family trust. Then someone discovered that a person already inside the building could redirect where the concierge whispers your instructions.

🤚 The Open-Palm Concierge Incident

The flaw is not described as a remote-drive-by catastrophe. That matters. An attacker needs the ability to run code locally on the user’s Mac. But once local code is running, Wardle’s concern is that Muse can become a privilege escalator wearing tasteful minimalist branding. The Register reports that his proof-of-concept, called not-a-mused, targets an undocumented setting named endo_voyager_dictation_endpoint, which can allegedly be modified by an unprivileged local process.

That setting controls where Muse sends dictation traffic. In normal human language: speech and prompt material intended for Meta’s assistant could be redirected to an attacker-controlled endpoint. From there, researchers warn, the door opens to ugly possibilities including prompt injection, exposure of sensitive voice prompts, theft of authentication material, and abuse of whatever accounts or device powers the user has already entrusted to Muse.

This is the uncomfortable new arithmetic of agentic software. A normal malicious app may have to fight Apple’s privacy controls one permission at a time. A useful AI assistant, by contrast, may already have access to email, calendar, files, camera, microphone, social accounts, purchasing workflows, and the glorious authority to “help.” Malware no longer needs to become a master thief if it can convince the butler to open the safe.

👐 The Two-Handed Permission Banquet

Muse is supposed to be powerful precisely because it is connected. Ars notes that the assistant can work with a user’s WhatsApp, email, calendar, social media accounts, and other services. It can also create tools on the fly when a task requires something not already available. This is innovation, certainly. It is also a permissions buffet where every plate is labeled trust me, I’m optimizing your Tuesday.

Wardle told Ars that the bug can allow an attacker to “manipulate the agent and leverage its privileges,” avoiding the need to write a more comprehensive Mac malware stealer. His demonstrations reportedly included attacks such as writing malicious files to disk and taking pictures, in some cases without obvious user warning. Meta representatives did not answer Ars’ emailed questions, while The Register framed the issue as a local privilege escalation problem rather than a remote compromise.

There is a subtle but important distinction here. Apple’s Transparency, Consent, and Control framework exists to prevent random apps from casually rummaging through sensitive areas of the system. But if an AI assistant is granted broad access for convenience, the assistant can become a single high-value instrument. The question is no longer merely, “Can this random app access my microphone?” It becomes, “Can this random app influence the highly trusted AI creature that already has my microphone, calendar, documents, purchasing ability, and an expensive tone of voice?”

🌿 The Gentle Awakening

The timing is especially rich because Meta has publicly emphasized Muse’s security and privacy architecture, including its Muse Secure VM messaging and user-control narrative. “Each person stays in control of their Muse,” the company has said, which is the kind of sentence that looks excellent on a launch page and less excellent when security researchers begin naming undocumented knobs.

Also, in a delightful side entrée, Amazon reportedly began blocking Muse from shopping on its site roughly around the same window, telling users that Muse was an unauthorized AI agent violating Amazon’s Conditions of Use. That is not the same as the zero-day, but it completes the tableau: the assistant that wanted to run errands is now being stopped at the department-store entrance while security discusses dictation endpoints in the lobby.

The bigger lesson is not that AI assistants are doomed. It is that agentic AI collapses old security boundaries into one shiny convenience object. We spent decades teaching operating systems to ask before an app touches the camera. Now we are building assistants whose entire sales pitch is that they should touch the camera, read the inbox, draft the memo, make the reservation, click the button, and perhaps buy the shoes. This may be useful. It is also a threat model wearing a cashmere cardigan.

👑 The Gold-Leaf Reckoning

The premium conclusion is simple: if an assistant needs extraordinary access to be useful, then its security bar cannot be ordinary. Local-only bugs still matter when the target is an app that aggregates permissions like a billionaire collecting islands. A small flaw in a small app is a nuisance. A small flaw in an agent with delegated authority is a private-members club for consequences.

For users, the practical posture is unglamorous but necessary: limit what agentic apps can access, avoid granting permanent broad permissions unless genuinely required, keep security updates close, and treat “AI can do it for you” as both a feature and a liability. For vendors, the lesson is harsher: if you ship a synthetic chief of staff, you inherit the security expectations of the chief, the staff, and the locked office where the emergency bourbon is kept.

“The future arrived as a helpful assistant, then immediately asked for microphone access and a procurement card.” — The Slap of Wisdom Privilege Escalation Salon, currently reviewing the guest list