Security1 publisher2 min readPublished
Meta's Muse agent asks new users for total control of their Gmail, calendar and Mac
Meta's free Muse agent, downloaded millions of times, asks for total control of users' Gmail, calendar and, on Macs, the whole computer. The researcher whose foundation found serious flaws in the app would uninstall it, while warnings that agents will swamp sites built for people are still forecasts.
The Watch · Security desk
What happened
- Muse drives its own web browser to run unsupervised tasks, including cancelling gym memberships, haggling with customer service and buying groceries.
- OpenAI has just announced a new agent of its own, and the BBC reports that more are coming.
- Meta says Muse was designed to be safe, secure and private, with built-in protections and user controls, and that it asks permission before buying.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Anyone who can exploit or steer a Muse install inherits whatever access its user granted, up to control of the whole Mac.
- decision Admins running Mac fleets have to decide whether to allow an agent that requests whole-computer control while the reported flaws remain undescribed in public.
- constraint First-come, first-served booking for tickets, tables and government appointments assumes each request costs a person time; a free agent removes that cost for every user who installs one.
For an attacker, a Muse install is one process holding everything its user handed over, and it drives its own browser through tasks nobody checks step by step [3][1]. A working flaw in the app is a route to that access [3][5]. Patrick Wardle co-founded Objective-See, the US nonprofit security foundation that uncovered serious flaws in Muse, according to the BBC [5]. "I wouldn't use it," Wardle said. "Personally, I would tell you to uninstall it altogether." [4]
A Meta spokesperson told the BBC, "Safety and security is a huge priority for us," and said Muse faced extensive testing [7]. The report does not describe the flaws Objective-See found or say whether Meta has fixed them. That means their exploitability cannot be rated from the public record [5].
The only scale figure in the traffic argument is an install count: millions of downloads in Muse's opening weeks [8]. Everything past that is forecast, from the BBC and the experts it interviewed [11][12]. The BBC expects people to fight bots for concert tickets and appointments. It expects small businesses to drown in machine-made pestering, and users to be buried in endless loops of proving they are human [11]. "There's going to be a huge escalation of the problems we're already having with bots," said Calli Schroeder, director of the AI and Human Rights Program at the Electronic Privacy Information Center [12].
Those bot problems already exist. In 2024, scalpers pushed US prices for Taylor Swift tickets so high that flying to concerts abroad was cheaper, the BBC notes [13]. A free, full-featured agent from a big company changes who runs the automation [10]. The BBC's line is "Now everyone can have their own personal scalper bot." [14] It also expects some people to book five appointments just in case, because doing so takes no effort [15].
Schroeder said she sees little preparation. "I haven't seen a lot of plans to address these things," she said. "We're just launching these tools and saying, 'well, we'll deal with the problems when they come up'." [16]
What to watch
- Objective-See publishing its Muse findings and Meta stating whether they are fixed; only then can the flaws be rated for exploitability.
- Muse gaining the phone-call ability the BBC says is coming soon would put unsupervised agent requests on voice customer-service lines.
- Ticketing, booking or support operators publishing measured agent request volumes would turn the traffic forecasts into data.