Zero-day hands local apps full control of Meta's Muse as teardown exposes its runtime

A zero-day that bypasses macOS permissions

Meta's AI assistant Muse is facing two uncomfortable disclosures within days of each other. According to Ars Technica, a zero-day vulnerability lets any locally installed app or terminal command take complete control of a user's Muse account — even as CEO Mark Zuckerberg had heavily promoted the assistant as architected around privacy and security from the start.

Introduced a few weeks earlier, Muse books appointments, fills out forms, handles customer service, makes purchases, generates images, creates documents and connects to a user's WhatsApp, email, calendar and social media accounts. When a task needs a tool that does not exist, Muse builds one on the fly. Ars Technica notes there is no Windows version; the macOS app requires both service authentication and broad operating system permissions, including writing files to disk, accessing the microphone and camera, and monitoring location and calendars.

The flaw sits in how Meta's engineers designed the settings system. Any local process, regardless of its macOS permissions, can modify a long list of undocumented settings. Most are trivial, such as dark mode. One, however, controls the endpoint where transcription is sent. Normally that is a Meta-operated server, but an attacker can repoint it to their own infrastructure and capture the token that authenticates the victim to their Muse account. Ars Technica argues this effectively undoes the permission defenses Apple has spent years building, and separately reported that Amazon had begun blocking Muse from its site.

Muse exported its own runtime

A teardown published on mouse.dev on September 22 describes a different kind of leak. The researcher asked Muse to archive the files it could see and send them to Google Drive. It complied, producing roughly 2.7 GB compressed and 6.8 GB unpacked — what appeared to be the root filesystem of the Linux environment assigned to the session, including Ubuntu system files, internal documentation, integration code, app templates, memory files, agent logs and SSH key files.

The researcher reported the findings through Meta's bug bounty program and is not publishing the archive, keys or session logs. It was not established whether the SSH keys were active or what access they could grant, and the researcher did not demonstrate a container escape, despite a claim in the chat suggesting one.

Inside Hatch

According to mouse.dev, "Hatch" is Meta's internal name for Muse and appears throughout the runtime. The per-user environment is assembled from a runtime-cell directory containing scripts for building the root filesystem, launching it with systemd-nspawn, and running startup hooks and daemons.

The agent's home directory holds files named SOUL.md, IDENTITY.md, USER.md, MEMORY.md, AGENTS.md and TOOLS.md, plus a directory of 113 subagent records with JSONL traces. Around 20 Markdown documents cover browser use, connectors, payments, credentials, data handling, voice, goals and scheduling, with separate guides for WhatsApp, a paired Mac, Tailscale and a device integration called Home Link. Roughly 68 skill directories pair instruction files with command-line tools, spanning Google Workspace, Meta's social apps, Outlook, travel, shopping, health services, home devices and media generation. Two configuration files also list unreleased connectors including Slack, Dropbox, Polymarket, Canva, Klaviyo and an internal Facebook CLI.

The largest code project, a framework called Spaces, builds and serves apps, with a TypeScript starter containing a React client, a Drizzle SQLite schema, migrations and Bun configuration. Separate builders generate documents, PDFs, presentations and spreadsheets.

One curiosity: Codex CLI version 0.149.0 ships in the image, but mouse.dev found no evidence Muse uses it as a coding agent. Meta appears to use only its bundled bubblewrap sandbox, which confines ffmpeg and ffprobe jobs for video processing and thumbnails — run as user nobody, without network access or extra privileges.

How Muse remembers

Memory lives in plain Markdown: a short sheet of facts, preferences and commitments, plus dated daily files. An hourly background job checks new claims against the original messages, recording quotes and message IDs. A Postgres layer makes the files searchable, storing text chunks, 384-dimensional embeddings and a claims table that tracks evidence, confidence and status, with newer claims able to supersede older ones. A nightly "dream" job reviews recent conversations and writes guidance for future sessions, which a synthesis file turns into standing instructions. A dedicated forget workflow stages claims for retraction, removes linked material and rebuilds the index.

Why it matters

An assistant holding WhatsApp, email, calendar and payment credentials is a high-value target, and these two findings show its defenses failing at different layers: one at the operating system's permission boundary, the other at the conversational boundary, where a simple request was enough to make the agent exfiltrate its own internals. The detailed memory subsystem also raises questions about what these agents retain and how reliably they can forget. Ironically, the export offers the clearest public picture yet of how a production consumer agent is actually built.