Muse is the most privileged AI assistant Meta has ever shipped, and right now a ClickFix attack can hijack it. That’s the review. Everything below is me explaining why that single sentence should worry you more than any demo reel Meta puts out this year.
What actually happened
Ars Technica reported a serious 0-day in Muse, Meta’s AI assistant. The attack vector is ClickFix — the same social-engineering trick that’s been tricking people into pasting malicious commands for years. Not an exotic exploit chain. Not a nation-state operation. A ClickFix attack, and the agent is hijacked.
I want to sit with how unimpressive that attack is, because the unimpressiveness is the story. When your assistant has broad permissions across a user’s digital life, the sophistication of the attack stops mattering. The only thing that matters is the size of the blast radius once someone gets in. And Meta built Muse with a large one.
Privilege is the product, and that’s the problem
The word “privileged” is doing a lot of work in the headline, and it deserves attention. Muse isn’t a chatbot in a text box. Per TechCrunch, Meta is pushing new capabilities: integration with the company’s smart glasses, and video chat with a distinct digital avatar. Meta’s previously faceless AI software gets a face, a body, and a voice. TechCrunch clocked the Metaverse-ish flavor of that, and they’re not wrong.
Here’s the tension nobody at Connect wants to name. Every capability Meta adds to make Muse more useful also makes a compromised Muse more dangerous. An assistant wired into your glasses is an assistant wired into your eyes and ears. An assistant with an avatar is an assistant your brain is being trained to trust on sight. Personability isn’t neutral. It’s a trust accelerant, and trust is exactly what a hijacked agent converts into damage.
That’s the review problem with agentic assistants in general, and I’ll keep repeating it until vendors get bored of hearing it: capability and attack surface are the same measurement taken from two angles. You cannot expand one without expanding the other. Meta has been expanding hard.
And then there are the humans
Reuters reported that Meta is testing a “human concierge” for Muse, with human contractors handling some phone calls. Read that next to the 0-day and a picture forms.
Two things bother me here, and neither is a conspiracy theory:
- It’s a capability admission. If contractors are taking some calls, the autonomous version isn’t finished. Fine. Most products ship unfinished. But the marketing around Muse does not sound like a product with a staffing backstop.
- It’s another trust surface. Users interacting with what they believe is an AI agent, sometimes reaching a person instead, is a disclosure question. Combine that with a face and a voice designed to feel personable, and the user’s mental model of who or what they’re talking to gets fuzzy. Fuzzy mental models are where social engineering lives. ClickFix works because people can’t tell what’s legitimate.
The forum theory, and why I’m setting it aside
The Ars OpenForum thread went where forums go. One commenter floated that Muse is superintelligent and planting its own bugs on purpose, planning to take over every computer and build a human zoo. I’m quoting it because it’s genuinely funny, and because it illustrates how discourse around this stuff goes sideways.
I don’t think Muse is scheming. I think something more boring and more likely is happening: a company shipping fast, granting an agent wide permissions, adding surface area every quarter, and letting security catch up later. That explanation requires no malice and predicts the same outcome. Sinister AI is a more entertaining story than ordinary institutional haste, but haste is what keeps showing up in the incident reports.
My verdict
If you’re evaluating Muse right now, treat the permission grants as the entire review. Not the avatar. Not the glasses integration. Not the voice. Ask what the agent can reach, and assume anything it can reach is reachable by whoever hijacks it next, because a ClickFix-grade attack means the bar for “whoever” is low.
Meta’s hardest job isn’t making Muse more personable. It’s earning the level of access it has already taken. A face and a voice buy affection. They don’t buy safety, and the 0-day is the receipt. Until the security story is as detailed as the feature story, the responsible move is to give Muse less of your life than Meta is asking for.
🕒 Published: