Meta’s Muse is off to a strong start. The company’s new personal AI agent has already climbed to the top of Apple’s US App Store, beating ChatGPT.
That’s an impressive start for an AI agent that’s supposed to do much more than answer questions. Muse can book appointments, fill out forms, deal with customer service, browse the web, and even make purchases. Connect your accounts, and it can work across services to complete multi-step tasks for you. But the more an AI agent can do for you, the more access you have to trust it with. And Muse has just received a pretty uncomfortable reminder of that trade-off.
A security flaw with some scary possibilities
Security researcher Patrick Wardle has discovered a zero-day vulnerability affecting Muse’s macOS app (via Ars Technica). According to Wardle’s findings, software running locally on a Mac could alter an undocumented Muse setting that determines where voice transcription is processed. An attacker could redirect that traffic to a server they control and potentially obtain the authentication token associated with the user’s Muse account. That’s especially concerning because Muse may already have access to things you wouldn’t want an attacker anywhere near.
Wardle demonstrated proof-of-concept attacks on X that could exploit Muse’s existing privileges to perform actions such as writing files or taking photos. Rather than malicious software having to obtain all those permissions itself, the concern is that an attacker could effectively piggyback on permissions the user has already granted Muse. Wardle also found that a variation of the increasingly common ClickFix attack where users are tricked into running a command themselves could be enough to hijack a Muse account. That’s particularly awkward considering how heavily Meta has emphasized Muse’s security. The company says Muse includes automated protections and controls intended to prevent unauthorized actions, while users can manage permissions and review what their agent has been doing.
And Amazon has already shown Muse the door
The security disclosure isn’t Muse’s only headache. As per a report by GeekWire, Amazon has also blocked the AI agent from shopping on its website. The retailer says Muse was accessing Amazon without identifying itself as an AI agent and that Meta hadn’t received Amazon’s permission to use the service this way. People attempting to shop through Muse are now being told that the agent violates Amazon’s Conditions of Use. It’s worth separating the two issues: Amazon’s decision isn’t a response to Wardle’s vulnerability. But having them arrive at almost the same time spotlights the larger challenge facing powerful AI agents.
The whole appeal of Muse is that it can actually do things rather than just tell you how to do them. For that to work, we’re being asked to trust it with accounts, personal information, and permissions. Muse’s early popularity suggests plenty of people are willing to make that trade. But this zero-day also reminds us that the more capable these agents become, the consequences of something going wrong get much bigger.