What if the most dangerous thing about an AI assistant isn’t what it says, but what it’s allowed to touch?
That’s the question sitting in front of Meta right now. Muse, the assistant Mark Zuckerberg has spent real effort positioning as “built from the ground up for privacy and security,” reportedly has a zero-day vulnerability that lets any local app or terminal command grab its authentication token and take full control. Amazon has blocked it over security concerns. That’s the whole verified picture, and honestly, it’s enough.
I review toolkits for a living. I install things, I break things, I write down what happened. So let me tell you what this particular failure mode looks like from the inside of a reviewer’s workflow, because it’s not exotic. It’s the same trap a dozen agent tools have walked into this year.
Privilege is the product, and also the problem
An assistant is only useful in proportion to what it can reach. Read your files, read your messages, run your commands, act on your behalf. Every capability you add makes the demo better and the blast radius bigger. Muse is described as extraordinarily privileged, and that’s not an insult, that’s the pitch. It’s why people want it.
But a highly privileged agent holds a credential that represents all of that access in one place. If a local process can read that token, the process inherits the agent. Not a slice of it. All of it. The agent’s permissions become the attacker’s permissions, and from the operating system’s point of view nothing unusual happened, because the legitimate token was used legitimately.
That’s the part that should bother you. There’s no clever exploit chain to admire here. A local app asks for something it shouldn’t be able to see, and gets it.
Why Amazon’s block matters more than the patch will
Vulnerabilities get fixed. That’s normal, and I’d rather use a tool that ships fixes than one that pretends it never needed any. What doesn’t get fixed quickly is a corporate security team’s memory.
Amazon blocking Muse is a signal worth reading carefully. Enterprise security teams don’t block software because a bug exists; they block it because the bug reveals something about how the software was designed. A token sitting somewhere any local process can read it says the threat model assumed the local machine was friendly. For consumer software, that assumption is arguable. For a tool that’s supposed to operate inside a company, it’s a non-starter.
Once you’re on the blocklist, getting off requires more than a version bump. It requires the security team to re-audit, and security teams have long queues and longer memories.
The marketing problem Meta created for itself
Here’s where I get a little unsympathetic. Meta didn’t just ship an assistant, it built the launch narrative around security. Privacy and security from the ground up. That framing is a bet, and the payout structure is brutal: if you’re right, you get modest credit, and if you’re wrong, every skeptic gets a free quote.
Plenty of tools ship with rough security and survive because they never claimed otherwise. Users calibrate. They sandbox it, they give it a scoped token, they keep it away from anything that matters. But when a vendor tells you the security work is done, users stop compensating. They grant the broad permissions because the vendor said it was safe to. The marketing didn’t just oversell, it actively removed the caution that would have limited the damage.
What I’d actually do right now
If you have Muse installed and you’re wondering whether to keep it, my read:
- Assume anything the assistant can reach is currently reachable by anything else running on that machine. Plan from there, not from the marketing copy.
- Don’t run it on a device that holds credentials, client work, or anything under an NDA. A personal machine with nothing sensitive on it is a different risk calculation than your work laptop.
- Watch how Meta communicates the fix, not just whether one ships. A quiet patch with no explanation of the design change tells you the threat model didn’t move.
- Treat Amazon’s decision as free security research. A team with resources looked at this and said no. You don’t have to repeat their work.
The uncomfortable pattern
Agent tools are converging on a shape where enormous privilege is held behind a single local secret. That design works right up until it doesn’t, and then it fails completely rather than partially. Muse is the current example, not a special case.
The tools I’ll end up recommending are the ones that treat every permission as something to justify, scope, and expire. Not the ones that ask for everything up front and promise to be careful with it. Careful is not a security control. It’s a hope.
Meta can recover from this. A solid fix, an honest explanation of what the token handling looked like before and after, and less certainty in the press materials next time. What they can’t recover is the version of this launch where security was the headline feature.
🕒 Published: