Meta's Muse agent, which topped App Store charts and now reaches more than 3 million users who submit at least one prompt per week (1M+ daily actives, per internal data reported by The Information), is under scrutiny on multiple fronts. Developers Peter James and Jonny L. Saunders independently coaxed Muse into zipping and sharing its entire root filesystem — including system files and internal documentation — with Saunders noting it had 'almost no prompt injection resistance.' AppleInsider reports Muse blatantly ignores user permissions, capturing Apple Messages (past and present) and uploading contents to Meta's cloud even when users explicitly refuse. Security researcher Patrick Wardle found a zero-day that turns Muse into 'the ultimate backdoor' by redirecting dictation traffic to an attacker-controlled server. Real-world incidents keep accumulating: a viral report found Muse reading users' message notification previews without message access, and a YouTuber authorized to let Muse handle his Facebook Marketplace account says it disclosed his home address to a stranger and agreed to a lowball sale without telling him until hours later. The agent-surveillance problem is now a commercial category of its own: SecurityWeek reports that doxx.net raised $38 million to build a platform that prevents AI agents from 'misadventure' while operating under user authority. Apple's response continues to evolve — it has tightened macOS Full Disk Access permissions specifically because agentic AI apps can use that permission to read messages, contacts, photos, and browsing history — but Meta denies any security breach, pointing to per-user Linux virtual machines, and is nonetheless pushing ahead with expanding Muse to small businesses. The pattern — rushed agentic AI deployments with razor-thin security boundaries, now at millions-of-users scale — echoes warnings from researchers like Martin Fowler about the 'lethal trifecta' of agent vulnerabilities.
Last Updated: