A zero-day vulnerability in Meta's new AI assistant Muse has raised concerns about the system's security model, allowing external applications to gain full control of user accounts. Security researcher Patrick Wardle demonstrated that any locally installed app or terminal command could access authentication tokens and redirect sensitive data processing to malicious endpoints. The flaw specifically affects how Muse handles voice transcription, which Meta processes on external servers rather than on-device. Once exploited, attackers could silently harvest messages, capture camera feeds, or generate unauthorized purchases through the assistant. Amazon began blocking Muse from its shopping platform around the same time, citing violations of its terms of service. Meta has not publicly addressed the vulnerability, though internal documentation reveals design choices that prioritized functionality over security hardening. Wardle noted that the system's architecture creates unique risks compared to traditional malware, as compromised agents could leverage their privileged access to bypass conventional defenses. The incident highlights growing tensions between AI development speed and robust security validation, particularly for systems requiring extensive user permissions.