Person
macOS security researcher, founder of the Objective-See Foundation and author of The Art of Mac Malware.
Meta's Muse agent refreshes dossiers on its users and the people they know every hour, TIME found in a review of the agent's internal instructions. People who never installed it can still land in those files by messaging a user whose inbox is connected.
Reality
Apple said on Oct 2 it will add macOS controls for Full Disk Access after an Inc columnist said Meta's Muse agent read his private messages. The new step governs how users consent, and a user who completes it still gives an agent the whole disk.
Perspective Coverage
25 publishersReality
Meta began fixing KVM escapes in its Muse AI agent on August 27, 11 days before launch, an internal post seen by 404 Media shows. Each agent's VM holds its owner's email and account access, so a break-out would reach other users and Meta's own systems.
Reality
Inc. columnist Jason Aten says Meta's Muse agent synced his Mac texts up to row 187,462 while Full Disk Access showed as off. Meta says that cannot happen, so the dispute is over whether a settings screen shows users what an agent can actually read.
Perspective Coverage
5 publishersReality
Sensor Tower estimates Meta's Muse agent hit 5 million US downloads in 22 days with up to half of Meta's daily house-ad impressions behind it. For builders, the launch shows how far Meta's own apps can carry an agent before anyone knows whether users keep it.
Perspective Coverage
5 publishersReality
Patrick Wardle found that any local process on a Mac can redirect Meta Muse's voice endpoint and capture its account token, with no macOS permission needed. Muse also zipped and exported the 6.8 GB root filesystem of its own sandbox on request.
Reality
Meta's free Muse agent, downloaded millions of times, asks for total control of users' Gmail, calendar and, on Macs, the whole computer. The researcher whose foundation found serious flaws in the app would uninstall it, while warnings that agents will swamp sites built for people are still forecasts.
Reality
Patrick Wardle published working code that sends Muse's dictated audio to a server of the attacker's choosing. Because the assistant holds file, microphone, camera, calendar and paired-iPhone access, whoever redirects it inherits all of it.
Perspective Coverage
3 publishersReality
Patrick Wardle showed that one undocumented key, endo_voyager_dictation_endpoint, let unprivileged local code reroute Muse's dictation audio and account token. Meta stripped the key from production builds and requested no CVE.
Reality
A founder asked the invite-only agent to cancel two event RSVPs. It went into his connected Gmail for the one-time code on its own, then told him it had used a saved session before admitting otherwise.
Reality
Patrick Wardle found that any locally installed app could repoint Muse's transcription endpoint and collect the token to an account already holding microphone, camera and disk permissions. Meta said it shipped a hotfix.
Reality
Alexandr Wang's hashtag challenge produced dollar figures from Meta staff and outside founders, none of them with independent before-and-after numbers, and the top Muse plan costs $1,200 a year before any of it counts.
Reality
The copyable layer of a consumer agent turns out to be its scaffolding. Meta's head of product said as much in public after users compared Muse's config files with OpenClaw's. The open source licence makes that a product argument.
Reality