{"id":36961,"date":"2026-11-13T03:56:26","date_gmt":"2026-11-12T16:56:26","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=36961"},"modified":"2026-11-13T03:56:26","modified_gmt":"2026-11-12T16:56:26","slug":"muse-ai-vulnerabilities-and-privacy","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/muse-ai-vulnerabilities-and-privacy\/36961\/","title":{"rendered":"More musings on AI security: capabilities and vulnerabilities of the Muse AI agent"},"content":{"rendered":"

That\u2019s how the Odyssey<\/em> might have opened if it were about Muse, Meta\u2019s new AI agent. For now, the agent is available only as an iOS, Android, or macOS app and on the web. Even so, it\u2019s already caught on: according to Meta\u2019s official figures<\/a>, Muse had been downloaded more than 10\u00a0million times by October\u00a021.<\/p>\n

The agent can do a lot: read your conversations and calendars, remind you about meetings and tasks, reply to messages and emails, track your spending, make purchases, search the web, generate content, and much, much more. In short, a full-blown concierge service for the chronically busy. Muse\u2019s creators have admitted they drew heavily on the headline-grabbing AI agent OpenClaw, which researchers coincidentally found full of serious security holes<\/a>.<\/p>\n

But soon after launch, the bad news about Muse started piling up. First, a journalist discovered that the agent had gotten into his conversations without explicit permission. Around the same time, a researcher found a vulnerability that let an attacker take control of Muse and act on the owner\u2019s behalf. And then it turned out that the calls the AI was supposedly making were actually being handed off to\u2026 human operators.<\/p>\n

We look at how all this could happen, and how to use Muse as safely as possible.<\/p>\n

When the agent reads more than it should<\/h2>\n

Journalist Jason Aten installed Muse on his iPhone and Mac, and deliberately didn\u2019t give the agent access to the Messages app. Yet after he exchanged messages with a colleague about the new iPhones, Muse unexpectedly offered<\/a> to draft a column on that very topic, citing his editor\u2019s message about the deadline. Aten immediately asked the agent how it had acquired that information.<\/p>\n

Muse\u2019s explanation was that the Mac app had merely been passing it the text of notification pop-ups, which sounded quite plausible at first glance. But then Aten discovered that Muse had been syncing data directly from the local message database on his Mac. The sync had reached row 187\u00a0462 of the database. That number alone doesn\u2019t reveal exactly how many messages were processed, but this was clearly far more than a few notifications.<\/p>\n

According to a Meta employee<\/a>, Muse could read conversations only if the user had separately allowed access to Messages and given the app Full Disk Access. How the agent managed to read the conversations without explicit permission<\/a> remains unclear. The likely culprit was an opaque permissions interface.<\/p>\n

Zero-day vulnerability in Muse<\/h2>\n

Just as the message-snooping scandal broke, researcher Patrick Wardle found<\/a> a serious vulnerability in Muse tied to how the app stores and uses its internal settings.<\/p>\n

Muse keeps several of these settings locally, and some of them could be changed with hardly any restrictions. One of these settings determines which server receives your voice input for speech recognition. Normally, these requests go to a Meta server, but Wardle found that almost any local app or Terminal command could change the address.<\/p>\n

In practice, an attacker could do this in one of two ways: infect the victim\u2019s device with malware, or talk the victim into pasting a specially crafted command into Terminal under the guise of \u201chelpful instructions\u201d. These dangerous instructions are often spread through fake websites<\/a> or infected browser extensions<\/a> that alter the content of the web pages people view.<\/p>\n

Once the Meta server in the settings had been swapped for the attacker\u2019s, Muse\u2019s voice requests went there instead. Along with those requests, the attacker received an authorization token, which let them impersonate the account owner and control the agent remotely. If the user had already given Muse access to their camera, messages, files, and other data, the attacker could use all that for their own ends: take photos with the camera, write malicious files to disk, read conversations, locate linked devices, and much, much more.<\/p>\n

\"Muse<\/a>

Once in control of Muse, an attacker can use the same features as the agent itself: take pictures with the front camera, view photos, read files and modify or delete them, show notifications\u2026 All told, the researcher counted more than 50 such commands. Source<\/a><\/p><\/div>\n

What\u2019s more, the attacker could route Muse\u2019s voice traffic through their server, and quietly slip their own instructions in with the victim\u2019s voice commands. They would pick up the Muse token along the way, so after the first successful attack they could keep their access to the agent and go on controlling it remotely. Meta has already released an update that fixes the vulnerability, but stories like this are far from rare in the AI world.<\/p>\n

Meatbags to the rescue<\/h2>\n

Muse has an experimental feature that calls U.S. businesses on the user\u2019s behalf: the agent can phone a company itself, ask for the details it needs, and then show a transcript of the call. But as Reuters<\/a> and 404 Media<\/a> discovered, Meta had also been testing a curious add-on to this feature with its own employees: handing the calls off to trained call-center operators. Fully automated calls weren\u2019t getting the job done: people on the other end simply hung up as soon as they heard a robotic voice. Meanwhile, many Meta employees had no idea their requests were being handed off to real people.<\/p>\n

After a barrage of criticism, Meta shut down the human operator experiment. Company representatives said it had been a mistake to run the experiment without warning and promised to improve the feature.<\/p>\n

Protecting your privacy: which Muse settings to check<\/h2>\n

Meta really does process a huge amount of data when people use Muse: conversations with the chatbot, photos, metadata, uploaded and generated files\u2026 This also includes information from any third-party apps you\u2019ve connected to the agent. Meta employees can access this data on an as-needed basis.<\/p>\n

We recommend checking the following settings and turning off any features you don\u2019t need:<\/p>\n

System permissions on Mac<\/h4>\n