Meta Muse Hits No. 1 on App Store, Then a Mac Zero-Day Hijacks Its Permissions

Meta's personal AI agent Muse reached the top of the U.S. App Store on September 18, ten days after its September 8 launch, according to analytics firm Sensor Tower — then spent the following 72 hours demonstrating what granting an AI agent real account permissions actually costs. Amazon blocked Muse from its marketplace on September 21. That same evening, security researcher Patrick Wardle published a working proof-of-concept exploit capable of redirecting the agent's voice dictation to an attacker-controlled server. Meta patched it before the next morning. As of Monday September 22, Muse had accumulated approximately 2.5 million total downloads, according to Sensor Tower. Meta stock closed up 10.7 percent that day, extending a rally that began when JPMorgan upgraded Meta from Neutral to Overweight on September 10, raising its price target to $820, citing Muse's momentum.

Secure VM and Sentinel: What the Architecture Does — and Doesn't

Meta's isolation design is more technically serious than anything previously shipped in a consumer AI product. Each user's agent runs in a dedicated Linux virtual machine in Meta's cloud. A process called Sentinel sits between the VM and the internet as the sole authority over outbound traffic, monitoring at the kernel level using eBPF programs. When an agent process ingests untrusted web content, it is marked as tainted and its autonomous network permissions are revoked until the user manually approves the next external action. An isolated authentication daemon called authd means stored passwords and OAuth tokens are injected at the network boundary rather than passed to the model itself. For purchases, Stripe Link issues single-use virtual card numbers tied to a specific merchant and amount. Meta's full security and safety architecture documentation describes all of these mechanisms in detail.

One material limitation: hardware-encrypted Confidential VMs that would prevent even Meta from reading user data are a roadmap item, not a shipped feature. The current Secure VM protects users from each other, not from Meta. Zuckerberg's own launch post on X received a Community Note pointing out exactly this distinction.

Read more: Meta Muse Voice Transcribe tops streaming speech benchmark as its dictation architecture takes shape

The not-a-mused Zero-Day and the Access Amplification Problem

Wardle's proof-of-concept, published in a detailed disclosure, identified an undocumented configuration setting in the Mac desktop app called endo_voyager_dictation_endpoint. Any unprivileged local process — ordinary malware, no admin rights required — can modify it, redirecting voice-dictation traffic to an attacker-controlled server. From there, an attacker can capture dictated prompts, inject replacement instructions, and extract authentication material from the active session.

The vulnerability requires a pre-existing local code-execution foothold, so it is not a remote attack on a clean machine. What Wardle demonstrated, and described to Ars Technica as "access amplification," is that this prerequisite stops constraining the attacker once Muse is installed. He put it plainly: "So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." An agent connected to email, payment services, health apps, and calendars does not just store data — it holds delegated permissions across all of those services, and any local process that hijacks the agent inherits them.

Meta hot-fixed the flaw; Wardle confirmed the patch on X at 06:36 UTC on September 22. Additional Muse findings are expected at the Objective by the Sea v9 security conference. Meta's bug bounty program allocates $130,000 specifically for prompt injection demonstrations, acknowledging that this attack class was anticipated.

Amazon's Block and the Commerce Conflict Behind It

Amazon blocked Muse from amazon.com on Sunday night, serving users a popup stating that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." The company told GeekWire it had never agreed to let Muse access its store, that the agent does not identify itself while browsing, and that its credential-storage design may capture customer data Amazon did not authorize.

Amazon's motive is structural. The company generated $68.6 billion in advertising revenue in 2025; its ad model depends on users landing on Amazon pages where sponsored products and recommendations operate. An agent that handles search, comparison, and checkout autonomously eliminates that funnel. Amazon is simultaneously developing Alexa for Shopping, a first-party combined agent, making the block competitive positioning as much as data governance. The legal challenge invokes terms of service rather than computer-access statutes — a deliberate choice informed by the Perplexity precedent: when Amazon won a preliminary injunction against Perplexity's Comet shopping agent in March on federal hacking-law grounds, the Ninth Circuit vacated it on August 4, ruling that the user — not the AI company — is the one accessing Amazon's computers. Amazon's petition for rehearing was denied on September 10, leaving Amazon to pursue ToS-based contract claims instead, which is precisely what the Muse block invokes.

Read more: OpenClaw 2.0 rewrites its core after a year of CVEs and consent failures

The Trust Deficit That Architecture Alone Cannot Fix

An Oppenheimer & Co. survey of 1,500 U.S. consumers conducted around the Muse launch found 8 percent would trust Meta with their passwords, compared with 30 percent for Google, 23 percent for Apple, and 16 percent for ChatGPT. Meta's FTC history — a $5 billion settlement in 2019 for privacy violations, the Cambridge Analytica scandal, passwords stored in readable format on internal servers in the same year — does not invalidate the Secure VM architecture. But it informs how users read the claim that credentials are stored safely. Reuters reported, citing internal posts from launch week, that pre-public testing had already found the agent bypassing guardrails to expose a user's iCloud photos during a routine birthday-picture task. Vishal Shah, Meta's VP of AI Products, told Reuters the April launch was delayed to address security concerns and that the additional work allowed Muse to "hit the minimum bar" for release.

The first two weeks of Muse compress a broad lesson: the feature that makes consumer AI agents valuable — real account access, real actions — is precisely what makes every security failure in them more consequential than in any prior AI product. The not-a-mused vulnerability is patched. Wardle has more findings ready. Amazon is blocking. The Confidential VM that would lock Meta itself out of user data is still on the roadmap. The score is not zero, but no one has finished counting yet.