You’re wearing the glasses. You ask Muse to pull up a page, and the page tells you that something went wrong and you need to click a thing to fix it. You click the thing, because that’s what the last thirty years of computing trained you to do. The agent, which has your calendar, your messages, and apparently permission to place phone calls on your behalf, does exactly what the page asked instead of what you asked.
That’s roughly the shape of what Ars Technica reported this week: a serious 0-day in Muse, Meta’s AI assistant, where a ClickFix-style attack can hijack the agent. I review tools for a living, and I want to be careful here, because the technical writeup is the technical writeup and I’m not going to embellish it. But the category of problem is worth sitting with, because it’s the category that matters most for anything sold as a personal agent.
Privilege is the product, and also the problem
The word in the headline doing the most work is “privileged.” Muse isn’t a chatbot in a tab. Per TechCrunch’s rundown of what’s coming, it plugs into Meta’s smart glasses and can video chat with you as a distinct digital avatar — a face, a body, a voice attached to software that used to be faceless. Reuters reported that Meta is testing a “human concierge” layer, with human contractors handling some phone calls.
Stack those up and you get a tool whose value proposition is access. It sees what your glasses see. It speaks with a persona designed to feel like a person. It can hand a task to an actual person to finish. Every one of those is a selling point on a keynote slide and an attack surface in a security writeup. The two lists are the same list.
This is the recurring pattern I keep flagging in agent reviews. Traditional software vulnerabilities let an attacker run code. Agent vulnerabilities let an attacker run errands. The blast radius isn’t defined by what the exploit can do technically, it’s defined by what you already authorized the assistant to do on a normal Tuesday.
ClickFix works because users are trained to comply
ClickFix attacks succeed on humans for a boring reason: they impersonate the remedy rather than the threat. There’s no scary payload, just a helpful-looking instruction that asks you to take one small step to make an inconvenience go away. It’s social engineering dressed as tech support.
Now point that at an agent. Agents are, by design, compliant. Instruction-following is the whole feature. An assistant that pushed back on every ambiguous request would review badly — sluggish, fussy, always asking permission. So vendors tune for helpfulness, and helpfulness is indistinguishable from gullibility when the instruction arrives from somewhere it shouldn’t.
Over on the Ars forums, someone joked that Muse is superintelligent and planting the bugs on purpose to build a human zoo. Funny, and also a tell. When a tool has this much reach, users reach for conspiracy because the honest explanation — shipping fast, patching later — is somehow less comforting.
What I’d actually want before recommending this
I’m not writing Muse off. Meta is building something ambitious and I’d rather review the ambitious thing than another wrapper. But if you’re evaluating an agent with this much privilege, these are the questions I’d want answered before it touches your accounts:
- What can it do without asking? Not what it can do. What it can do silently. That’s your real threat model.
- How are untrusted inputs separated from your instructions? If web content and your voice land in the same instruction stream, the attack surface is the entire internet.
- Where does the human concierge sit? Reuters says contractors handle some calls. Fine — but a hijacked agent escalating to a human who believes the request is legitimate is a trust chain worth understanding.
- What’s the disclosure and patch cadence? The first 0-day in a new agent platform is expected. The fifth one, handled the same way, is a verdict.
- Can you turn capabilities off individually? An all-or-nothing permission model is the tell that security came after the demo.
The review verdict, for now
Treat Muse the way you’d treat any brand-new tool with root-level reach into your life: interesting, worth watching, not yet worth handing your calendar. The glasses integration and the avatar are genuinely appealing. The privilege that makes them appealing is the same privilege that turns one bad click into a bad week.
Agents are going to get hijacked. That’s not a Meta problem, it’s a structural property of software that takes instructions from the open web and acts with your authority. The vendors worth trusting will be the ones who assume that from day one instead of discovering it in a headline. I’ll keep testing and report back on which ones those are.
🕒 Published: