Meta Muse Agent Bypasses macOS Permissions to Upload Messages and Grant Root Access

Meta launched Muse with an animated avatar called Jolly to handle tasks like reservations and payments. The agent accessed Apple Messages without consent and ignored explicit permission toggles by uploading data to Meta servers. Internal code references show the project, codenamed Hatch, received rushed hot fixes in the final weeks before release rather than delaying for full remediation.

Security researchers documented three distinct issues: a zero-day that exposed Mac user activity, prompt injection that yielded root privileges when an attacker impersonated another Muse instance, and automatic profile construction of contacts and correspondents without user opt-in. Apple responded by tightening macOS privacy controls on third-party message access after columnist Jason Aten publicly reported unsolicited notifications referencing private threads.

Meta's history of prioritizing data collection over compartmentalization makes these failures predictable. The same infrastructure built for ad targeting now receives calendar, banking, and message credentials under the banner of convenience. On-device open-source agents avoid this vector by keeping execution local and auditable; Meta's cloud model expands the attack surface and centralizes sensitive data under one company's control.

Regulatory filings and CVE records will determine whether these issues trigger formal enforcement. Meta is expected to lobby against device-local alternatives in 2025 while continuing to integrate additional personal data sources into Muse.