TWO WEEKS IN, META'S AI BUTLER CAN BE HIJACKED BY A TERMINAL COMMAND

Meta shipped Muse on September 8, a personal AI agent that acts on your email, payment and calendar accounts, with Zuckerberg hyping it as "built from the ground up for privacy and security." Thirteen days later, macOS researcher Patrick Wardle pointed out that any locally installed app or executed code, whatever macOS permissions it has, can change a long list of undocumented Muse settings. Most are harmless, like dark mode. One of them controls where your transcription gets sent. Point that somewhere else and you now hold the token that gives complete control over the Muse account. Wardle's framing is the ugly part. Instead of writing a comprehensive Mac malware stealer, an attacker can "just leverage the AI assistant itself." Muse already asked for disk writes, mic, camera, location and calendars, the exact permissions Apple spent years building defenses around. Muse undoes them. Meta's launch pitch was a Secure VM per agent gated by a watchdog process called Sentinel plus a bounty paying up to $300,000 for a valid vulnerability. Implicator reported Meta launched anyway while its own employees were still reporting security failures. Amazon blocked Muse from shopping on its platform on September 21, citing unauthorized access and no way to identify the agent. Wardle is saving the full technical breakdown for a November conference, which is either a patch window or a countdown.

Why you should give a shit: The token controlling your inbox and your credit card was parked behind a setting Meta never bothered to document, so a $20-a-month agent with purchase authority is a hell of a thing to leave logged in right now.