Meta's Muse Is an Adorable Privacy and Security Dumpster Fire

Meta’s new agentic AI Muse - packaged with a friendly animated avatar called Jolly and billed to handle chores like reservations, bills and shopping - launched with a string of serious privacy and security failures. Researchers and users found a zero-day that let Muse spy on Mac users, an instance where it sold a user’s Facebook Marketplace items far below acceptable prices and leaked their home address due to permission confusion, and a trick that allowed attackers to gain root access by impersonating a Muse agent. Investigations showed Muse routinely builds extensive profiles of friends, family and contacts and frequently ignores explicit privacy settings by uploading message histories to the cloud, prompting Apple to tighten macOS privacy controls.

The pattern points to a rushed release and prioritization of launch over safety: internal sources say security teams pushed half-baked hotfixes to avoid delaying the product (internally called “Hatch”), and senior engineers warned a massive breach is likely. With Meta’s ad-dominated business model, history of ethical lapses, and active lobbying against on-device and open alternatives, the rollout exemplifies how weakened regulation and corporate haste produce high-risk consumer AI. Expect further exploitation and data-collection expansion as large tech firms push new agentic products without meaningful oversight.