Meta Muse turns a consumer AI assistant into a persistent agent — and its first Mac zero-day tests the containment model

On September 8, 2026, Meta launched Muse in the United States across iOS, Android, muse.ai and WhatsApp. Unlike a conventional chatbot, Muse can continue executing tasks after the user closes the app, use a browser, fill forms, negotiate, send emails with approval, make purchases and coordinate longer-running goals. Meta runs each user’s agent and connected data inside a dedicated Muse Secure VM and places a separate Sentinel agent between Muse and the internet. Users choose which services the agent can access and can revoke those permissions. Meta says a more strongly encrypted Confidential VM mode is planned later in 2026. On September 21, macOS security researcher Patrick Wardle disclosed a separate client-side weakness: an unprivileged process already running under the user’s account could rewrite an undocumented Muse dictation endpoint, redirect traffic and authentication material, then steer the agent using permissions the user had already granted it. Meta issued a hotfix on September 22. Meta stresses that this was a local privilege-escalation path, not a remote exploit, because malicious code first had to be running on the Mac.

Consumer AI is moving from answering questions to holding credentials and taking consequential actions over time. That makes identity, permission scopes, approval checkpoints, payment delegation, audit trails, prompt-injection defenses and revocation central UX. The macOS flaw adds an important architectural lesson: isolating the cloud agent and putting a policy layer around its internet actions is not sufficient if an ordinary local process can tamper with the client-side channel used to instruct that agent. A compromised agent can become a confused deputy, reusing permissions the user deliberately granted to trusted software.

Muse can continue work after the user closes the client and return when something changes or when approval is needed. Meta describes tasks ranging from travel booking and selling a car to longer-running plans. That persistence matters because the risk model is no longer limited to one synchronous prompt/response turn: the system may encounter new pages, messages and state while the user is absent.

Meta says every Muse runs in its own Muse Secure VM with a browser. Connected-service data and credentials are stored there rather than shared across users. Muse itself is designed not to see raw passwords or payment details; credentials can be used from secure storage, and payments can use one-time-use card details through Stripe Link. Meta says Shop Pay and 1Password support are planned.

Meta separates a Sentinel agent from Muse at the system level. Internet-bound actions pass through Sentinel, which can allow, block or require user confirmation. Sensitive actions such as sending an email or making a purchase are designed to trigger explicit approval, and Muse exposes an audit trail of completed and planned activity.

Wardle found that Muse for macOS exposed an undocumented setting controlling the endpoint used for dictation. A process already running as the logged-in user could change that setting without administrator privileges, redirecting dictation traffic to an attacker-controlled endpoint. Reporting on Wardle’s proof of concept says the path could expose Muse authentication material and let the attacker inject instructions that Muse executed with permissions already granted to the agent. Demonstrations included writing files and taking pictures. This did not remotely compromise a clean Mac: the attacker first needed local code execution under the user account.

Meta’s David Singleton said the company issued a hotfix and characterized practical risk as low because malicious local code was already required. That limitation matters, but so does the amplification: ordinary local malware may be constrained by macOS permission boundaries, while a trusted agent can already hold access to files, camera, microphone, calendar and connected services. The episode shows why agent security must include the integrity of local configuration and instruction channels, not only cloud isolation and policy enforcement.

Users choose which services Muse connects to and, for some integrations, what level of access it receives—for example read-only email versus permission to send. Access can be revoked later. That is a useful pattern for any consumer agent: broad account connection should not automatically imply every available action, and revocation needs to work independently of conversational memory.

Meta says Muse Confidential VM will arrive later in 2026 with encryption controlled by a user-held key so that even Meta cannot access the VM’s data and conversations. The launch product instead relies on Secure VM isolation, policy controls and an opt-out from using interactions to train Meta’s models. Builders should distinguish shipping privacy guarantees from announced future architecture.