Handing your car to a valet is a small act of faith. You trust that the kid in the vest will park it, not joyride it, and that the key cabinet behind the podium is locked. Now imagine the valet also holds your house key, your phone, and permission to call your bank on your behalf — and that sometimes, quietly, a different person entirely is doing the driving.
That’s roughly the shape of Meta’s Muse, the personal AI agent the company debuted in late September. And that’s why a headline claiming Muse has “a serious 0-day” lands differently than the usual AI security scare.
What Muse actually is
Muse isn’t a chatbot with a new coat of paint. It’s an agent, which in practice means it does things in the world rather than just talking about them. It lives on the web, in mobile apps, and inside WhatsApp, with integration into Meta’s AI glasses on the roadmap. The feature that made the most noise is phone calling — Muse can place calls for you.
Reuters reported that Meta has been testing a “human concierge” layer behind that feature, with human contractors quietly handling some of the calls placed through the agent. Not a fallback you opt into. A layer underneath the product. Meta has said Muse is being tested with safety protections and hardened against vulnerabilities through a bug-bounty program.
Mark Zuckerberg has pitched supercharged assistants as the next big step for AI models, and as part of the justification for Meta’s enormous spending on data centers and infrastructure. Muse is the consumer-facing version of that argument. TechCrunch framed the open question plainly: will consumers trust it? Worth remembering that the announcement came less than two weeks after Meta agreed to an $18 billion multistate settlement over social media’s consumer harms.
Where I have to be honest with you
I went looking for the specifics of this 0-day. Who found it, what it touches, whether it’s patched, whether it’s being exploited. The sourcing I can verify doesn’t cover any of that. What’s confirmed is the launch and the feature set. Everything past that is, as far as I can tell, unverified.
So I’m not going to describe a vulnerability I can’t substantiate, and you should be suspicious of anyone who does with this much confidence and this few details. A security claim without a disclosure timeline, an affected-component list, or a vendor response is a rumor wearing a lab coat.
What I can do is explain why “Muse has a 0-day” is a more serious sentence than “some chatbot has a 0-day,” regardless of whether this particular claim holds up.
Privilege is the whole story
When reviewing AI tools, the question I keep returning to isn’t how smart the thing is. It’s how much damage it can do when it’s wrong, tricked, or compromised. Call it the blast radius test.
A text-only assistant that hallucinates gives you a bad answer. An agent with calling privileges, messaging access across WhatsApp, and eventually a camera and microphone strapped to your face has a meaningfully larger failure surface:
- It acts, it doesn’t just answer. A successful prompt injection against a chatbot gets you embarrassing text. Against an agent with phone access, it gets you actions taken in your name.
- It sits where your identity lives. WhatsApp isn’t a sandbox. It’s a messaging account tied to a phone number that other services use to verify you.
- The human layer is a data path. If contractors handle some calls, then some portion of what you asked Muse to do ends up in front of a person. That’s not a bug — but it is a disclosure question, and a review question.
- Glasses raise the stakes again. Sensors on your face expand what a compromised agent can observe, not just what it can do.
What I’d want before trusting it
The bug-bounty program is a real signal — it means Meta expects attacks and wants them reported. Good. But bounties are a process, not a guarantee, and they tend to prove that vulnerabilities exist rather than that they don’t.
Before I’d recommend Muse for anything touching money, identity, or sensitive conversations, I’d want clear disclosure of when a human handles a call, granular permissions so calling can be turned off independently of everything else, a visible log of actions taken on my behalf, and a published response process when something does break.
Agents are a genuinely useful idea. But the pitch is “give me more access and I’ll do more for you,” and that trade only works if the security story keeps pace with the permissions. Right now the permissions are moving faster.
I’ll update this when verifiable details on the vulnerability claim surface. Until then, treat the headline as unconfirmed and the privilege model as the actual thing to watch.
🕒 Published: