Meta's Muse wants your work accounts. Decide what it can touch

An assistant that acts in your accounts

Muse is Meta's personal AI agent. An agent is software that does errands for you (reading mail, booking, buying, filling in forms) instead of only answering questions. Since Meta's Connect event this week, it can also reach tools a lot of people use at work. Meta's Connect post lists them:

For getting work done, there's Notion, Granola, GitHub, and Box.

In the same post, Meta says Muse will get an email address of its own. Meta launched Muse on September 8, rolling out in the US on iOS, Android and muse.ai. Muse also has a Mac app: that is the version the security research below concerns, and the one John Gruber singles out. By Meta's description, each person's Muse lives on its own computer in Meta's cloud, and that is also where the logins for every service you connect are stored. On price, Meta says only that it is "free for most of what people need, with subscription plans for people who want to do more."

So the decision in front of you is not whether the assistant is clever. It is what you are willing to let one program hold at once: your notes, your code, your shared files, and possibly the right to send email as you. Everything Meta says about keeping that safe is Meta's own description, and this week outsiders started putting some of it under pressure.

Work access arrived in the same week as outside tests began

The cause is two things landing together. Meta widened what Muse can reach, and people outside Meta showed where that reach can go wrong. In a few days:

• Around September 20, Amazon began blocking Muse from shopping on its site, Ars Technica reports.
• Security researcher Patrick Wardle published a flaw in Muse's Mac app. It is a local attack: it only works if an attacker can already run a program on your Mac. Meta said it released a hotfix, an urgent update, Ars Technica reports.
• On September 24, at Connect, Meta added the work connectors and announced that Muse will get its own email address.
• The Verge reported that users could download everything stored on Muse's cloud computer. Meta says that is intended.

What this means for someone deciding: the safety promises in the launch post have not changed, but they now stand between an agent and your company's documents rather than your shopping basket. The work tools came in the same days as a researcher's published attack on the app that holds them, and a retailer's public refusal to let the agent in.

Meta's promises, and what outsiders have actually checked

Meta's case is a list of controls in its launch post, shown at the top of this page. Meta says Muse cannot see your passwords:

Muse has no visibility into people's passwords or payment methods.

Meta also says a second, separate program, which it calls the Sentinel, checks everything Muse tries to send out:

Nothing Muse does reaches the internet unless the Sentinel approves it

Meta says Muse asks before sensitive actions such as sending an email or making a purchase, that it shows a complete audit trail of what it has done and plans to do, and that for email you choose whether it only reads or can also send. Meta's safety write-up adds that the agent only ever handles stand-in keys, with the real ones swapped in by the Sentinel at the last moment, so tricking the agent into handing over your secrets gets nowhere, by Meta's account. In the sources we found, no one outside Meta has reported testing the Sentinel, the swap to stand-in keys, the audit trail or the read-only setting for email.

An outside test came from Wardle, who published a working demonstration on GitHub. In one sentence: Muse's Mac app has a hidden setting that decides where your spoken instructions are sent, and a program already running on your Mac can change it.

A local attacker or malware can modify this endpoint without special privileges.

"Without special privileges" means no administrator password. This is where the two sides talk past each other. Meta's controls are built to keep your passwords away from the agent. Wardle's concern is that someone could take over the agent itself, and potentially with it everything you connected. His own page states the limit, and it belongs next to every mention of this flaw:

This is a local attack. An attacker must already be able to execute code as the local user.

According to Ars Technica, Meta said it released a hotfix, and its statement called the flaw "not a remote exploit": it cannot be set off over the internet alone. Dan Goodin, who wrote the Ars piece, argues that is weaker than it sounds, because of ClickFix, a scam that tricks people into running code on their own computer. A "0-day" is a flaw made public before a fix exists.

The Meta statement said the 0-day was "not a remote exploit" even though an increasingly effective social engineering scam has the same effect.

Wardle, interviewed by Goodin, goes further, and hedges it himself:

when you take a look at Muse, it's like they didn't, in my opinion, think about security, which is really worrisome

Amazon's objection is commercial. In a statement emailed to Ars Technica, Amazon said apps that buy from other businesses for a customer should operate openly and respect a store's decision not to take part, as delivery apps and travel agencies do. It went on:

Agentic third-party applications such as Muse have the same obligations, and we've requested that Meta remove Amazon from the experience.

On the filesystem download, Meta argues that openness is the point. The Verge reports that David Singleton of Meta Superintelligence Labs wrote on X:

This was a very deliberate choice - your Muse Secure VM truly is your own computer in the cloud.

A VM, or virtual machine, is a computer in Meta's data centre set aside for you. We found no independent critic of this choice. The Verge's report, as far as it could be read without a subscription, carried Singleton's explanation and no objection.

The most useful outside voice is split. John Gruber praises the engineering:

It's the first consumer-accessible agentic AI system, and Meta has truly done an amazing job with that.

In the same post, he doubts that people know what they have switched on:

I don't think people realize how powerful — and thus dangerous — Muse is, especially if it's running on your Mac.

What nobody outside Meta has reported testing, in the sources we found: whether the Sentinel stops what it should, whether the swap to stand-in keys holds, whether the audit trail is complete, and whether "read only" on email stays read only. Nor has anyone outside Meta reported whether Meta's hotfix closed the whole class of problem or only the one setting Wardle found.

Connect narrowly, and keep public errands off its list

If you try Muse at work, set it up so that a mistake, or an attacker, can do as little as possible.

• Read before send. Meta says that for email you choose whether Muse only reads or can also send. Choose read. Apply the same rule to Notion, GitHub and Box: connect the smallest scope the settings offer, and never a workspace you could not afford to have copied.
• Use its address, not yours. Meta describes Muse's coming email address as another way to communicate with it. Once that address is live, forwarding it the one thread you want handled gives it that thread, not your whole mailbox.
• Keep out of reach: sending as you, saved payment methods, and any code repository or shared drive your company owns.
• Check first: that the Mac app is updated to include the hotfix Meta says it released for Wardle's flaw, which needs a program already running on your Mac; that training on your interactions is switched off, which Meta says you can do; the audit trail after the first few tasks; and your employer's policy on connecting outside agents.
• Mind the machine. Wardle's condition is a program already running on your Mac. If you install tools from unfamiliar sites or paste commands from web pages, that Mac is the weak point, and Goodin's ClickFix argument describes you.

Some errands people will give Muse never needed their accounts at all: checking a supplier's stock page every morning, submitting the same public form each week, pulling a price off a public listing. For those, a scripted browser is the plainer tool. In Latenode, a workflow can drive a cloud browser with Puppeteer, a library in which every step (open this page, wait for that button, type into this field, copy that number) is written out before the run, so you can read exactly what it will do and it does only that. The task needs no login to your inbox or your files, so there is nothing of yours for it to hold. You pay for the CPU-seconds a run uses, meaning the computing time it consumes, with no minimum charge per run, so a short check costs proportionally little. The free tier includes 10,000 CPU-seconds a month and five active workflows, which leaves room to try a daily check without paying. This is not a Muse connection, and it does not need to be one: it takes the errands that never required your accounts off the agent's list.

Yes to a read-only trial. No to your outbox, your wallet and your company's files

Try it at work if you are a founder or solo operator whose calendar and notes would embarrass no one if read, and give it read access only. Gruber is right that Meta has put something new in ordinary people's hands, and an agent that can read your notes and calendar is worth an afternoon of testing.

Do not give it the right to send email as you, a payment method, or any GitHub repository or Box folder that holds client or company data. Keep it that way until someone outside Meta publishes a test of the Sentinel and the audit trail. Those controls, together with Meta's promise that Muse asks before it sends, are what stands between a mistake and an email to a client in your name, and right now all of them are Meta's description.

Do not use it for work at all if your employer has not approved it, if you handle client data under contract, or if you would run it on a Mac where you routinely install unvetted software or paste commands you found online. That is the case Wardle's local-attack condition and Goodin's ClickFix argument both describe.

Look again when an independent review of the Sentinel appears, or when Meta says what the hotfix covered. Until then, the agent gets what you would hand a new temp on their first day: something to read, and nothing to sign.